Objectives
The simulator ticks each one as soon as the network meets it.
On GW1 and GW2: turn on the IPsec VPN blade, with VPN domain LAN1 on GW1 and LAN2 on GW2.
Add meshed community SITES with GW1 and GW2.
Add a rule at the top: source any, destination any, service any, VPN SITES, Accept, Track Log. A community doesn’t allow traffic by itself.
Publish, and install the policy on both gateways: each needs its half.
PC1 reaches 192.168.2.10, and vpn tu tlist on GW1 shows the tunnel up.
Before you start
A rule with a community in its VPN column matches only traffic between that community’s domains. Try installing on GW1 alone first: the ping’s reason tells you GW2 has no policy with this community. Encryption defaults to AES-256, SHA-256 and group 14.
Concept
A VPN community, not a tunnel
Each gateway has a VPN domain, the network behind it. A community says which gateways talk: meshed links every pair, and star links satellites to centers. Traffic between two domains in a community gets encrypted, and a rule with the community in its VPN column allows it. Hide NAT breaks this unless it is disabled inside the community, because a hidden address no longer matches its domain.
Concept
Change, publish, install
A Check Point-style manager has three steps. A change is private in your session. Publish moves it into the manager’s database. Install Policy verifies it and sends it to a gateway. The gateway runs what was installed, so three places can disagree.
