checkpoint endpoint security vpn configuration

This procedure assumes that the Check Point device is already configured with the inside interface or group object with multiple inside interfaces and an outside interface that will communicate with the Web Security Service. Prerequisite-Verify that the device is ready for configuration. The screenshots in the following procedure might not reflect this advisory. If the current setting is less than four hours, you can leave that value. Note: Symantec has seen outages occur if the Phase 2 Timeout value is set to longer than four (4) hours. The best practice is to set the rekey at the specified lifetime interval instead of for lifebytes.After successful testing, you then add production subnets. You can create a designated host or subnet that tests the IPsec connectivity to the Web Security Service without interrupting the production traffic.Do not send Auth Connector traffic to the Web Security Service.The device must have an external routeable IP address.Depending on your geographical location, you must create at least two VPN gateways. The most basic concept for this method is configure the router with a site-to-site VPN connection and configure the device policy rules to send web-based traffic to the Web Security Service and ignore everything else.Note: R77.20 is the minimum supported version because of the Dead Peer Detection requirement. It is likely that you have an existing Check Point device configured in your network therefore, slight alterations to the existing deployment might be required. This procedure provides a guideline configuration that you can apply to the above model or other Check Point models. The following procedure demonstrates the Simplified Mode with pre-shared secret method, which requires a unique gateway IP address (no NAT-T). Symantec tested and validated that Check Point® devices are able to forward web traffic to the Web Security Service for policy checks and malware scanning. For current instructions to configure an IPSEC connection with your Check Point firewall, refer to the Check Point support site here: or consult the Check Point support team for assistance.

The instructions here are provided as a snapshot of content that is no longer included with the Web Security Service Help Centre. This article details the steps to configure a Check Point firewall to establish an IPSEC connection with the Web Security Service.

Checkpoint endpoint security vpn configuration