Create VPN Tunnel Between CheckPoint FIrewall and WatchGuard FireBox Firewall

12/20/2020

This post describes how to configure a Branch Office VPN (BOVPN) between WatchGuard Firebox on Prem and a Check Point device at my home which is behind my home router.

There are some configuration I found interesting which I mentioned in the following. Local network setting is confusing me although I got it working. It might be because of the specialty of Firebox

Topology

Make Sure Firewalls UDP500 Expose to Internet

UDP500 is IPSEC Protocol.

Since in local site, I am having a home router in front of Checkpoint firewall 192.168.2.22, I will have to open UDP 500 port to checkpoint firewall gateway.

Create Gateway on each site

1 On CheckPoint Firewall, create a new Interoperable device:

You also can create a VPN Community to add both gateways into settings:

2 On WatchGuard, create a new Branch Office Gateway:

Under the Credential Method section, select Use Pre-Shared Key and enter a same key as you entered in the Checkpoint firewall.

Create Phase 1 (Main) Policy

1 On CheckPoint Firewall,

2 On WatchGuard,

In this Lab, I am using SHA1 and AES128 with DH Group 2.

Create Phase 2 (Quick) Policy

1 On CheckPoint Firewall,

2 On WatchGuard,

In this Lab, I am using SHA256 and AES256 with DH Group 14.

One thing I found interesting is to set up local ip. If I set a local route172.x.x.0/24 this kind of network, the tunnel will be failed. With one static ip could not find route.

If I set it to 172.x.x.x/32 or Any IPv4, the tunnel comes up right away. Strange.