1100 - site to site route based VPN

[fabiomeneses]

Hi,

I have an 1100 running latest version and need to setup a site-to-site VPN and route to that site only HTTP/HTTPS traffic.
Im able to create IPSEC VPNs managed by the routing table but this configuration doesn't allow me to setup any source or service for the route so I can't accomplish it this way.

Is there another way to setup a VPN Site to Site on those smaller devices that will allow be to route traffic based on source and service?

Thanks!
Fabio

[jflemingeds]

Hi,

I have an 1100 running latest version and need to setup a site-to-site VPN and route to that site only HTTP/HTTPS traffic.
Im able to create IPSEC VPNs managed by the routing table but this configuration doesn't allow me to setup any source or service for the route so I can't accomplish it this way.

Is there another way to setup a VPN Site to Site on those smaller devices that will allow be to route traffic based on source and service?

Thanks!
Fabio

I haven’t tried that before but the route table seems to support that. Are you really using a vti or are you doing domain based vpn? Also is this centrally by a smart center?

[fabiomeneses]

Thanks for your response.
It seems to support, but when I try to set it up I get a message saying that source and service should be set to ANY.

Im managing this appliance locally. don't have centralized management.

Any ideas of how to set this up?

[PhoneBoy]

VPN Service based link selection is not supported on the SMB appliances.
It is listed as a known limitation.
https://supportcenter.checkpoint.com...ionid=sk105380

[jflemingeds]

VPN Service based link selection is not supported on the SMB appliances.
It is listed as a known limitation.
https://supportcenter.checkpoint.com...ionid=sk105380

But couldn’t you do that with pbr and a vti?

[PhoneBoy]

But couldn’t you do that with pbr and a vti?

Except the WebUI is clearly not allowing this configuration.
The fact it's limited as a known limitation suggests it's not an accident.

[jflemingeds]

Except the WebUI is clearly not allowing this configuration.
The fact it's limited as a known limitation suggests it's not an accident.

Challenge accepted!

I made a bogus vti interface, then added a pbr route. Next hop options are ip, interface, vti vpn.

If I chose next hop of remote vti peer it takes it. Granted this is not much of a test and could still not work.

Btw is this really link selection? I thought that had to do with picking the out bound interface for encryption? could be very wrong.