Integration of Check Point VPN-1®/Firewall-1® and FreeBSD IPsec

$FreeBSD: doc/en_US.ISO8859-1/articles/checkpoint/article.sgml,v 1.23 2006/02/20 20:57:13 jcamou Exp $

This document explains how to configure a VPN tunnel between FreeBSD and Check Point's VPN-1®/ Firewall-1®. Other documents provide similar information, but do not contain instructions specific to VPN-1/Firewall-1 and its integration with FreeBSD. These documents are listed at the conclusion of this paper for further reference.

1 Prerequisites

The following is a diagram of the machines and networks referenced in this document.

The FreeBSD gateway GW serves as a firewall and NAT device for “internal nets.”

The FreeBSD kernel must be compiled to support IPsec. Use the following kernel options to enable IPsec support in your kernel:

options         IPSEC
options         IPSEC_ESP
options         IPSEC_DEBUG

For instructions on building a custom kernel, refer to the FreeBSD handbook. Please note that IP protocol 50 (ESP) and UDP port 500 must be open between the Firewall-1 host and the FreeBSD GW.

Also, racoon must be installed to support key exchange. Racoon is part of the FreeBSD ports collection in security/racoon. The racoon configuration file will be covered later in this document.

This, and other documents, can be downloaded from

For questions about FreeBSD, read the documentation before contacting <>.
For questions about this documentation, e-mail <>.