Site2Site between 2 Cisco ASA

[Dom2201]

Hi everyone,

I am doing some learning Labs an I have a question to a special szenario. Maybe it is easy, but I am not able to get the solution.

This is my Lab environment:




- HQ is a Checkpoint R77.30
- Site A is a Cisco ASA
- Site B is a Cisco ASA

Now here is my question:

The Tunnels are working fine, only traffic between SITE-A and SITE-B is not working.

How I said, maybe it is an easy solution, but I don´t get the point...

[mcnallym]

What you need to do at the Check Point side is

1.) Make sure is a Single Star Community that has the Cisco as Satellites
2.) Set the VPN Routing in the Community so that Satellites can communicate
3.) Make sure that have rules on the Check Point allowing SiteA networks to SiteB
4.) Make sure that the Cisco Configured to send traffic for remote site via the Check Point

[Dom2201]

Ok,

thank you for your comment.

Actually I made 2 Star Communities, for every ASA one Star Community.

I will change this and try again. So Checkpoint devides 2 Star Communities strictly from each other. (It makes totally sense ;-) )

Unfortunately I don´t get the point with the routing from A to B over the HQ.

I know that I need a static route, but what destination (next hop) should I put into the route?

[Bob_Zimmerman]

Ok,

thank you for your comment.

Actually I made 2 Star Communities, for every ASA one Star Community.

I will change this and try again. So Checkpoint devides 2 Star Communities strictly from each other. (It makes totally sense ;-) )

Unfortunately I don´t get the point with the routing from A to B over the HQ.

I know that I need a static route, but what destination (next hop) should I put into the route?

"VPN Routing" is a section of the VPN community configuration which lets you specify that the center gateways should forward traffic with a source behind one satellite and a destination behind another satellite in the same community.

In terms of actual routing on the ASAs, you should probably just use your default route to send it out to the Internet. Ultimately, what gateway you specify for the route shouldn't matter, since the only goal is to get it going out the right interface. The packet shouldn't be clocked out in the clear, so the gateway address of the route should never be used.

The crypto maps on each ASA will need to be modified to include the networks behind the other ASA so as to trigger encryption. Once encrypted, the packet's destination IP will be the center Check Point gateway, so Internet routing should take over from there.

When the Check Point gateway receives the encrypted packet, it will verify it using the HMAC, decrypt it, then check to see if the source and destination are allowed to talk to each other in a VPN. This involves checking the encryption domains of the objects it has for the ASAs and checking the VPN Routing setting in the community, as described above. If they are allowed to talk, the Check Point gateway will then re-encrypt it to the second ASA.

Things get a little more complicated if you want to use route-based VPNs (with a tunnel interface), but not enormously so.