Route-Based VPN

Overview of Route-Based VPN

Route-Based VPN provides a flexible and scalable approach to secure communication between Security Gateways. Unlike traditional domain-based VPNs, Route-Based VPN leverages virtual interfaces - known as VPN Tunnel Interfaces (VTIs) - to route traffic dynamically based on IP routing decisions.

Each VTI acts as a virtual point-to-point link between peer Security Gateways, enabling encrypted traffic to flow seamlessly across the VPN tunnel, that are defined with all of its properties within a VPN Community.

Traffic destined for a peer's VPN domain is automatically routed through the corresponding VTI, allowing the use of dynamic routing protocols such as OSPF or BGP. This setup enables routing daemons on each gateway to exchange information as if they were directly connected, improving network adaptability and performance.

Route-Based VPN can only be implemented between Security Gateways within the same VPN Community.

Simplified Route-Based VPN

Simplified Route-Based VPN Overview

Starting from R82.10, you can use Simplified Route-Based VPN to automate the configuration of Route-Based VPNs, including Virtual Tunnel Interfaces (VTIs) and dynamic routing protocols such as BGP. It makes manual setup easier, improves consistency, and accelerates deployment across Check Point environments.

Simplified Route-Based VPN supports both Mesh and Star (hub-and-spoke) VPN communities and is fully integrated with SmartConsole.

Simplified Route-Based VPN Key Features

• Unified Configuration: All the setup is done within SmartConsole.
• Auto-Generated VTIs: VTIs with editable IP addresses are created automatically between internally managed Security Gateways in the VPN community.
• Auto-Generated Dynamic Routing: BGP settings are created automatically on the Security Gateways based on the VPN community and Security Gateway configuration in the Management Server.
• Simplified Policy Matching: Select the VPN community object in the VPN column of the Access Control policy rule to match the Route-Based VPN traffic.
• Better performance: Host-to-host tunnel is supported when all members in the Route-Based VPN community are R82.10 Check Point Security Gateways.
• Manual Overrides: Administrators can override VTI IP addresses, ASN, and BGP settings.
• Topology Support: Compatible with on-premises and cloud architectures.
• Interoperability: Supports clusters and VSX, and third-party devices with manual configuration on remote peers.
• Automatic Cleanup: Configuration is automatically removed when gateways are deleted or route-based VPN is disabled.

• Handle conflicts: Detects and preserves manual configurations.

Simplified Route-Based VPN Limitations

• OSPF and iBGP are not supported.
• CGNAT devices and Check Point host objects are not supported.
• GVC, unnumbered VTIs, and VPN Profiles are not supported.
• Quantum Spark appliances are not supported.
• VSNext is not supported.
• On VSX (Legacy) Gateways, you must manually delete the VTIs if you discard the Route-Based configuration before completion.
• Database Revisions are not supported.

Simplified Route-Based VPN Configuration

To configure Simplified Route-Based VPN:

1. Enable Route-Based VPN:

   1. In SmartConsole, open the Objects Pane (F11).
   2. Click VPN Communities, and open the applicable community.
   3. In the Gateways tab > Routing Mode section, select Route-Based.

2. Configure the community general BGP settings:

   1. To configure the Route-Based settings, click the Edit button next to Route-Based.
   2. In BGP Settings, the apply BGP configuration check-box is selected by default.
   3. In the Advanced settings, configure BFD and Graceful Restart options.
   4. Click OK to save the Route-Based Settings.

3. You can configure specific BGP settings for a Security Gateway in this VPN community or in the Security Gateway’s object properties later.

4. To configure specific BGP settings:

   1. Double-click the Security Gateway name in the Gateways section.
   2. BGP Settings: Select to apply the BGP configuration based on the Security Gateway object configuration or override the routes to export.
   3. Click OK to save the VPN configuration settings for this Security Gateway.
   4. Click OK to save the changes in the VPN community.

5. Customize Settings (Optional):

   • To change the VTI IP address, follow the steps in SmartConsole.

6. Add rules in the Access Control policy: Starting in R82.10, Route-Based VPN traffic can be matched by selecting the community object in the VPN column of the Access Control policy rule.

7. Publish the changes in SmartConsole and install the policy.

8. Verification: Examine the Security Gateway configuration for auto-generated VTIs and BGP settings.

Troubleshooting

Log files:

• VCE logs are available for auditing and troubleshooting. They are located in the $FWDIR/log/VCE/ directory.
• Management Server logs are in $FWDIR/log/CPM.elg.

Manual Route-Based VPN

Manual Route-Based VPN is the former method of using this feature, and is still supported in R82.10.

VPN Tunnel Interface (VTI)

A VTI is the foundational component of a Route-Based VPN. It acts as a virtual point-to-point interface on a Security Gateway, enabling encrypted communication with a remote peer. Each VTI corresponds to a specific VPN tunnel and is configured on both ends of the connection. Once established, traffic routed through the VTI is automatically encrypted and securely delivered to the peer Security Gateway.

In this scenario:

• There is a VTI connecting "Cluster GWa" and "GWb".
• There is a VTI connecting "Cluster GWa" and "GWc".
• There is a VTI connecting "GWb" and "GWc".

A virtual interface behaves like a point-to-point interface directly connected to the remote peer. Traffic between network hosts is routed into the VPN tunnel with the IP routing mechanism of the Operating System. Security Gateway objects are still required, as well as VPN Communities (and Access Control policies) to define which tunnels are available.

When a connection that originates on GWb is routed through a VTI to GWc and is accepted by the implied rules, the connection leaves GWb with the local IP address of the VTI as the source IP address. If this IP address is not routable, return packets will be lost.

Using Dynamic Routing Protocols

VTIs allow the ability to use Dynamic Routing Protocols to exchange routing information between Security Gateways.

The Dynamic Routing Protocols supported on Gaia are:

• BGP4
• OSPFv2
• RIPv1
• RIPv2

Configuring Anti-Spoofing on VTIs in SmartConsole

1. From the left navigation panel, click Gateways & Servers.
2. Right-click the Security Gateway object and select Edit.
3. From the left tree, click Network Management.
4. Select a VTI interface, and click Edit.
5. In the IP Addresses behind peer Security Gateway section, configure accepted IP addresses.
6. In the Anti-Spoofing section, select Perform Anti-Spoofing based on interface topology.
7. Click OK and install the Access Control Policy.