Go to Firewall > Virtual IP > IP Pool and select Create New.

Using the FortiGate unit IP Pool feature, you can replace the user's source IP address with the address 192.168.197.168 that is acceptable to the Checkpoint appliance. The Checkpoint appliance allows remote VPN peers to connect only from IP address 192.168.197.168.

Go to Firewall > Address and select Create New.Įnter 'LocalLAN' for the network behind the FortiGate unitĮnter 'Site2_net' for the network behind the Checkpoint applianceĮnter '192.168.100.0 255.255.255.0' for LocalLANĮnter '10.185.111.0 255.255.255.0' for Site2_net.

'LocalLAN' is the network at the FortiGate unit end and 'Site2_net' is the network behind the Checkpoint appliance. To configure using the CLI: config vpn ipsec phase2-interface edit 'toSite2_p2' set dhgrp 1 set keepalive enable set phase1name 'toSite2' set proposal 3des-md5 set replay enable set src-addr-type ip set dst-subnet 10.185.111.0 255.255.255.0 set src-start-ip 192.168.197.168 endĬreate firewall addresses for the private networks at either end of the VPN.

Go to VPN > IPSec > Auto-Key and select Phase 2.Ī name for the VPN Phase 2 configuration: toSite2_p2.

The destination is the private network behind the Checkpoint appliance. The Checkpoint VPN accepts VPN connections from only one address: 192.168.197.168. To configure using the CLI: config vpn ipsec phase1-interface edit 'toSite2' set interface 'port2' set dpd enable set nattraversal enable set dhgrp 2 set proposal des-md5 set keylife 86400 set remote-gw set psksecret ENC XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX end

Select Advanced and enter the following:.

Same preshared key configured on the Checkpoint appliance The interface that connects to the remote VPN: port2 The public IP address of the Checkpoint appliance

Go to VPN > IPSec > Auto-Key and select Phase.

To configure using the Web-based Manager:

The virtual IPSec interface is created on the physical interface that connects to the Internet. The FortiGate unit must be in NAT mode.įirst configure the IPSec VPN phase 1.

FortiGate unit with FortiOS v3.0 firmware.Users on the Checkpoint network can have access to a server on the private network behind the FortiGate unit. Users on the network behind the FortiGate unit can communicate with any host on the Checkpoint-protected network. The configuration uses an interface-based VPN, a new feature in FortiOS v3.0. This article describes how to configure an IPSec VPN on a FortiGate unit to work with a Checkpoint NGX firewall VPN.

Checkpoint vpn client