Azure VPN Gateway
An Azure service that enables the connection of on-premises networks to Azure through site-to-site virtual private networks.
1,559 questions
S2S VPN Azure <-> CheckPoint
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(131.20000000000002, 94%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EP%3C/text%3E%3C/svg%3E)
Philippo98
0
Reputation points
We have already implemented a S2S VPN connection between Azure and CheckPoint VPN gateway. So we have used following config:
eg: 169.254.0.1 = VIP 169.254.0.2 = FW A 169.254.0.3 = FW B 169.254.0.4 Azure gateway
So now we have a request for a second S2S VPN connection between Azure and on prem Checkpoint. The downloaded config from Azure looks like this:
int tunnel 11
ip address 169.254.0.1 255.255.255.252
tunnel mode ipsec ipv4
ip tcp adjust-mss 1350
So where can I change the 169.254.x.x network in Azure? What IPs for the virtual tunnel interfaces can be used? can I use 169.254.1.0/29 instead? I can´t find a setting in Azure to define this? BGP is not used....
{count} votes
-
KapilAnanth-MSFT 47,046 Reputation points Microsoft Employee2024-08-01T06:44:56.1266667+00:00 Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.
I am afraid I did not understand your environment.
- The IP range you specified seems to be APIPA ranges
- And in Azure,
- APIPA is only used when you enable BGP (but your verbatim says BGP is not used)
- APIPA ranges allowed in Azure is 169.254.21.0 to 169.254.22.255
Assuming you have BGP enabled,
- APIPA Addresses are for the VPN Gateway itself
- Not for individual connections.
- You should be able to see the APIPA range in the VPN Gateway's panel instead of the connection
Hope this helps
Cheers,
Kapil
-
Philippo98 0 Reputation points
2024-08-01T06:51:46.6866667+00:00 @KapilAnanth-MSFT yes BGP is disabled (using static routes). here are some examples from the Azure config:
! [3] BGP parameters - Azure VPN gateway
!
! > Azure virtual network
! + Enable BGP: False
! + Azure BGP ASN: VNG_ASN
! > On-premises network / LNG
! + On premises BGP ASN: LNG_ASN
! + On premises BGP IP: LNG_BGPIP
int tunnel 11
ip address 169.254.0.1 255.255.255.252
tunnel mode ipsec ipv4
so now there is another S2S Azure connection from the CheckPoint VPN gateway, which range can is use for the tunnel interfaces? and where can I change them in the Azure portal? because I can´t use 169.254.0.1 twice. Thx
-
KapilAnanth-MSFT 47,046 Reputation points Microsoft Employee
2024-08-01T08:41:51.23+00:00 This configuration is specific to the vendor rather than the Azure side.
As next steps, I would suggest you to reach out to the 3rd party vendor's support or their forums and
- make sure they support connecting to multiple VPN gateways
- and if they do, what's the expected configuration.
With that said,
- From the doc VPN devices and IPsec/IKE parameters for S2S, I see the configuration guide for checkpoint is redirecting here
- I also found some docs which may come in handy
Thanks,
Kapil
Sign in to comment
Sign in to answer