Simultaneous SSLVPN & IPSEC VPN

[nickliako]

Hello,

On our checkpoint we have setup a site2site VPN with a remote site which use a cisco router (interoperable device).
Is it possible for the employees of the remote site to have simultaneous SSLVPN access as well ?
I am asking that because, whenever an IPSEC session is established between Checkpoint and Cisco, then an employee cannot access https://external_checkpoint_ip/sslvpn.

Regards.

[mcnallym]

Short Answer is that if a Check Point has a Site to Site VPN with an IP then it cannot establish a Remote Access from it.

Basic idea is that if have a Site to Site then why not just use that.

The fix is to hide traffic leaving the Cisco behind a second IP so that the SSL VPN seen coming from a different IP address.

[cciesec2006]

Short Answer is that if a Check Point has a Site to Site VPN with an IP then it cannot establish a Remote Access from it.

Basic idea is that if have a Site to Site then why not just use that.

The fix is to hide traffic leaving the Cisco behind a second IP so that the SSL VPN seen coming from a different IP address.

The answer is yes IF you setup the site-to-site VPN in "traditonal mode" instead of "simplified mode (aka VPN community)". In traditional mode, Checkpoint does not see the Cisco VPN peer as part of the encryption domain. Haven't used CP VPN in a while so I am not sure if "tradidional mode" is even available in R77.30 or R80.x

[PhoneBoy]

Haven't used CP VPN in a while so I am not sure if "tradidional mode" is even available in R77.30 or R80.x

Simplified Mode was introduced in NG FP3 and has been the recommended configuration since then.
Traditional Mode is formally deprecated in R80.x.