Example Network

The documentation is written to build a solution for KPalmer, Inc. KPalmer, Inc. is located in sunny Location-A. ELI, a business partner that works closely with KPalmer, Inc. is located several thousand miles away at Location-B. KPI and ELI are two separate companies who happen to use the same VoIP phone system. KPI and ELI both use Check Point.

The documentation, config files, and shell scripts are written based on the ficticious KPalmer, Inc.

Externally Managed Check Point Gateways

Subnet	Description
172.17.10.0/23	Location-A
172.17.20.0/23	Location-B

SOHO VPN Routers

Subnet	Description
192.168.224.0	soho-user-a.dyndns.info
192.168.225.0	soho-user-b.dyndns.info
192.168.226.0	soho-user-c.dyndns.info
192.168.227.0	soho-user-d.dyndns.info
192.168.228.0	soho-user-e.dyndns.info
192.168.229.0	soho-user-f.dyndns.info
192.168.230.0	soho-user-g.dyndns.info
192.168.231.0	soho-user-h.dyndns.info
192.168.232.0	soho-user-i.dyndns.info
192.168.233.0	soho-user-j.dyndns.info
192.168.234.0	soho-user-k.dyndns.info
192.168.235.0	soho-user-l.dyndns.info
192.168.236.0	soho-user-m.dyndns.info
192.168.237.0	soho-user-n.dyndns.info
192.168.238.0	soho-user-o.dyndns.info
192.168.239.0	soho-user-p.dyndns.info
192.168.240.0	soho-user-q.dyndns.info
192.168.241.0	soho-user-r.dyndns.info
192.168.242.0	soho-user-s.dyndns.info
192.168.243.0	soho-user-t.dyndns.info
192.168.244.0	soho-user-u.dyndns.info
192.168.245.0	soho-user-v.dyndns.info
192.168.246.0	soho-user-w.dyndns.info
192.168.247.0	soho-user-x.dyndns.info
192.168.248.0	soho-user-y.dyndns.info
192.168.249.0	soho-user-z.dyndns.info
192.168.250.0	soho-user-aa.dyndns.info
192.168.251.0	soho-user-ba.dyndns.info
192.168.252.0	soho-user-ca.dyndns.info
192.168.253.0	soho-user-da.dyndns.info
192.168.254.0	soho-user-ea.dyndns.info
192.168.255.0	soho-user-fa.dyndns.info

192.168.224/19

Figure 1: Check Point VPN Gateways

Location-A Web Server 12.10.20.6
Location-A DNS Server 172.17.10.10
Location-A VoIP Call Manager 172.168.10.19
Location-B Web Server 12.11.22.6
Location-B DNS Server 172.17.20.10
Location-B VoIP Call Manager 172.17.20.19

• SOHO VPN Routers download CRL's from the web server.
• SOHO VPN Routers can optionally download the current date and time (within 5 minutes) from the web server in case rdate fails.

Naming Conventions

The routers are built in sets of two. One WRT54GL (or another model) is configured as a VPN Gateway. A second WRT54GL is configured as a QoS router. The next section will explain creating the directory structure for the templates. One directory set will be created (or more to keep a version history) for templates. Additional directory sets will be created for each SOHO VPN Router pair.

VPN Router	Router A	soho-user-a.dyndns.info
QoS Router	Router B	soho-user-b.dyndns.info