check point firewall wont start vpn tunnel

There are a bunch of different options for selecting which tunnels to make permanent, but for this lab, I will select to make all the tunnels in the community permanent (which really isn't a lot in my case, since there are only two Gateways in my topology). This feature uses a Check Point proprietary protocol running on port UDP 18234 to send some kind of keep-alive packets through the VPN tunnel from time to time, according to Check Point's documentation. Here, you can configure the VPN tunnel to always be active, even if there is no actual traffic keeping the VPN tunnel up and running. Next up is the Tunnel Management section, which has some interesting features for us. One of the good things about configuring a VPN tunnel between two Gateways that are managed by the same SMS-server is that the settings are applied to both, so you know there is no possibility of the settings being different on the Gateways, causing the VPN tunnel not to be established (which is more common than not when you are setting up VPN tunnels manually on each side).įor authentication between the Gateways, certificates will be used, but you will not have to worry about this because it is all handled by the SMS server automatically. To make some sense of what we are setting up, take a look at the VPN topology down below, which shows how all these terms come together.

Which type of VPN Community will fit your need is up to you to research, but for this lab, we will be going with the Meshed Community. If you have a lot of Gateways, this will mean a lot of VPN tunnels will be created as well, and traffic is allowed to flow from any Gateway to any other Gateway directly. If data needs to be sent from the LAN of one Satellite Gateway to the LAN of another Satellite Gateway, this traffic will be passed through the Star Gateway first and then onwards towards the destination Satellite Gateway.Ī Meshed VPN Community means that every Gateway that participates in the VPN Community will set up a VPN tunnel between them and EVERY other Gateway that is in the same VPN Community, creating a Mesh network of VPN tunnels. In this type of topology, every Satellite Gateway has only one VPN tunnel destination, the Star Gateways, which acts as a “centerpiece” of all data that needs to go through the VPN tunnels. Two types of VPN Communities can be configured: Star or Meshed.Ī Star VPN Community appoints one Gateway as the Star and the other gateways as Satellites, which are other terms for a Hub-and-Spoke network. The VPN Community is what decides which of your Gateways will be part of the VPN solution as a whole. Publish and Install Policy on both your Gateways.

Check point firewall wont start vpn tunnel