Integration of Check Point VPN-1®/Firewall-1® and FreeBSD IPsec
Prev |  | Next

# 3 Firewall-1 VPN Rule Configuration

Next, create a Firewall-1 rule enabling encryption between the FreeBSD GW and the Firewall-1 protected network. In this rule, the network services permitted through the VPN must be defined.

    Source            | Destination        | Service      | Action  | Track
    ------------------------------------------------------------------------
    FreeBSD GW        | FW-1 Protected Net | VPN services | Encrypt | Long
    FW-1 Protected Net| FreeBSD GW         |              |         |

“VPN services” are any services (i.e. `telnet`, SSH, NTP, etc.) which remote hosts are permitted to access through the VPN. Use caution when permitting services; hosts connecting through a VPN still represent a potential security risk. Encrypting the traffic between the two networks offers little protection if a host on either side of the tunnel has been compromised.

Once the rule specifying data encryption between the FreeBSD GW and the Firewall-1 protected network has been configured, review the “Action Encrypt” settings.

    Encryption Schemes Defined:     IKE ---> Edit
    Transform:                      Encryption + Data Integrity (ESP)
    Encryption Algorithm:           3DES
    Data Integrity:                 MD5
    Allowed Peer Gateway:           Any or Firewall Object
    Use Perfect Forward Secrecy:    Checked

The use of Perfect Forward Secrecy (PFS) is optional. Enabling PFS will add another layer of encryption security, but does come at the cost of increased CPU overhead. If PFS is not used, uncheck the box above and comment out the `pfs_group 1` line in the `racoon.conf` file on FreeBSD GW. An example `racoon.conf` file is provided later in this document.

Prev | Home | Next
Firewall-1 Network Object Configuration |  | FreeBSD VPN Policy Configuration