Understanding the Cyber Attack on the University of Sydney: Lessons for Australian Businesses Estimated reading time: 7 minutes Recent cyber attack on the University of Sydney highlights vulnerabilities in educational institutions. Universities are prime targets for cybercriminals due to valuable data. Victims of data breaches face significant long-term consequences. Robust [...]
Estimated reading time: 6 minutes
Establishing a secure site-to-site VPN connection between a branch office and cloud services hosted in Azure is a crucial task for many Australian businesses. This article documents our journey deploying such a connection using Check Point Quantum Spark firewalls managed by Smart-1 Cloud. We will share our experiences, the challenges we faced, and the practical solutions we discovered along the way.
The primary challenge lay in enabling users on the 10.10.10.0/24 network to access Azure services through the VPN tunnel terminating on FW-SECONDARY.
┌─────────────────────┐
│ Azure VNet │
│ 10.20.20.0/24 │
│ │
│ ┌──────────────┐ │
│ │ VPN Gateway │ │
│ │ 203.0.113.50 │ │
│ └──────────────┘ │
│ │ │
│ ┌──────────────┐ │
│ │ App Server │ │
│ │ 10.20.20.10 │ │
│ └──────────────┘ │
└─────────────────────┘
║
═══ VPN Tunnel (IKEv2) ═══
║
┌────────┴────────┐
│ FW-SECONDARY │
│ 198.51.100.25 │ ← VPN terminates here (has public IP)
│ (ISP WAN) │
└────────┬────────┘
│ 192.168.254.2
Inter-Site Link
│ 192.168.254.1
┌────────┴────────┐
│ FW-PRIMARY │
│ (No public IP) │ ← Users connect here
└────────┬────────┘
│ 10.10.10.254
┌────────┴────────┐
│ User Workstation│
│ 10.10.10.100 │
└─────────────────┘
To establish the Azure infrastructure, we utilised Terraform, allowing us to automate the deployment effectively:
# Local Network Gateway representing the branch office
resource "azurerm_local_network_gateway" "branch" {
name = "lng-branch-office"
location = "eastus"
resource_group_name = azurerm_resource_group.networking.name
gateway_address = "198.51.100.25" # FW-SECONDARY public IP
address_space = [
"10.10.10.0/24", # User network
"10.10.20.0/24", # Additional networks
]
}
# VPN Connection
resource "azurerm_virtual_network_gateway_connection" "branch" {
name = "vpn-branch-connection"
location = "eastus"
resource_group_name = azurerm_resource_group.networking.name
type = "IPsec"
virtual_network_gateway_id = azurerm_virtual_network_gateway.hub.id
local_network_gateway_id = azurerm_local_network_gateway.branch.id
shared_key = var.vpn_psk
connection_mode = "Default"
use_policy_based_traffic_selectors = true
ipsec_policy {
dh_group = "DHGroup14"
ike_encryption = "AES256"
ike_integrity = "SHA256"
ipsec_encryption = "AES256"
ipsec_integrity = "SHA256"
pfs_group = "PFS2048"
sa_lifetime = 27000
}
# Traffic selector for policy-based VPN
traffic_selector_policy {
local_address_cidrs = ["10.20.20.0/24"]
remote_address_cidrs = ["10.10.10.0/24"]
}
}
Configuring the settings in Smart Console included crucial steps:
After initial setup, we ran our first connectivity test from a user workstation, only to receive timeouts when attempting to ping the application server (10.20.20.10). Yet, the Azure VPN status indicated “Connected”.
Our troubleshooting journey began on FW-SECONDARY, where we confirmed:
However, a crucial issue materialised: the ESP packets were sourced from 100.64.50.150 (management tunnel IP) instead of 198.51.100.25 (the actual public IP). This misconfiguration led to Azure silently dropping the packets due to its local network gateway setup.
Check Point Quantum Spark firewalls, when managed by Smart-1 Cloud, exhibit a default behaviour where they utilise the management tunnel for outbound traffic, leading to invisible failures unless corrected.
To fix this:
Following this change, flow verification revealed successful bidirectional data transfer.
The deployment of a site-to-site VPN between Azure and a Check Point-managed branch office presented both challenges and learning opportunities. The importance of configuring the VPN link selection and understanding packet flow cannot be overstated. For Australian businesses venturing into similar architecture, it’s vital to consider these key takeaways to streamline implementation and avoid potential pitfalls.
If your organisation is looking to strengthen its cybersecurity posture with effective and efficient solutions, Summit Cyber Group offers a range of managed security services that can assist. From vulnerability management to end-to-end security automation, we are committed to helping businesses navigate the complexities of cybersecurity.
Contact us today at Summit Cyber Group to discuss how we can enhance your organisation’s cybersecurity maturity and help you deploy robust solutions like our documented Azure site-to-site VPN setup. Visit our website at Summit Cyber Group for more insights.
A site-to-site VPN connects two or more networks securely over the internet, allowing for communication between devices on different networks as if they were on the same local network.
Check Point Quantum Spark uses advanced encryption and security protocols to safeguard data transfer over the VPN, ensuring that communications are secure from unauthorized access.
A Network Security Group (NSG) acts as a virtual firewall to control inbound and outbound traffic to Azure resources, shaping security policies that help protect applications and data.
Securing Generative AI Systems: A Layered Approach to Mitigate Unique Risks Estimated reading time: 7 minutes Understanding unique risks: Generative AI systems face specific threats such as deepfakes and privacy ...
