Site to Site VPN

[nlbakos]

I have a VPN-1/Firewall-1 Version NGX R62 and a VPN-1 UTM Edge X.

Reading in the manual, Virtual Private Networks Version NGX R62, on chapter 4 "introduction to Site to Site VPN". There are apparently 2 ways for me to setup the Gateway. 1) Internally Managed Gateway 2) Externally Managed Gateway.

We are a small company with 1 remote office. How should I setup the Gateway on the VPN-1/Firewall-1? I think I can set up the gateway either way. What would be the best method/preferred?

[abusharif]

Internally managed means that configuration (firewall rules, vpn settings) are added on the SMARTCENTER only and your edge fetches this config, meaning no vpn/rules changes needs to be done on the edge boxes. It also means that logging will be centralized (logs sent from edge to smartcenter). Also you skip using pre-shared secrets and vpns are established with help of certificates etc....

If you want it internally managed then make sure "externally managed" checkbox on the edge object in your smartcenter is not chosen and make sure that you from EDGE connect to "service center" (your smartcenter) to establish trust.

[nlbakos]

Is better to have the Edge managed by itself this way it might be easier to isolate any problems in the future. Or would it be better manage all the rules,vpn settings on my SmartCenter? how would you set it up to be managed, Internally or Externally?

[nlbakos]

also does Internally managed mean that all traffic from the Edge is passed through the VPN-1/Firewall-1 site as opposed to using its own bandwith?

[abusharif]

Originally Posted by nlbakos

also does Internally managed mean that all traffic from the Edge is passed through the VPN-1/Firewall-1 site as opposed to using its own bandwith?

No this is customized by your self. It can be standalone meaning u send only vpn relevant traffic via vpn, or route all traffic to it.

[abusharif]

Originally Posted by nlbakos

Is better to have the Edge managed by itself this way it might be easier to isolate any problems in the future. Or would it be better manage all the rules,vpn settings on my SmartCenter? how would you set it up to be managed, Internally or Externally?

I would set it up internally managed. Only way u setup standalone is when u dont have smartcenter to connect to. Ofc both way works, but if u want centralized "overview" and configuration connecting it to smartcenter is the way to go

[nlbakos]

thank you for getting back to me so quickly. based on your recommendation i will setup the gatway to be managed internally.

cross your fingers.

thank you for your time.

[abusharif]

Originally Posted by nlbakos

thank you for getting back to me so quickly. based on your recommendation i will setup the gatway to be managed internally.

cross your fingers.

thank you for your time.

Np and good luck :)

[nlbakos]

i have setup the gateway to be managed by the smartcenter. i have attempted to create a site to site vpn however; i cannot connect to computers at either end of of the site to site vpn. l looked at the smartview tracker logs and i see the following error messages see attached.

i have refered to solution sk19423 in the knowledge database, but i don't understand how to fix this issue.

[abusharif]

well it says invalid certificate so number 1 to check is that TIME and DATE on the edge is correct.

No valid SA, could mean that you have missmatch in encryption domain, check enc domain on EDGE object in smartcenter.


Start with date check on edge :)