topic Re: One-liner to show VPN S2S tunnels on gateway in Scripts

One-liner to show VPN S2S tunnels on gateway

Danny — Wed, 18 Jan 2023 20:40:48 GMT

🏆 Tool of the Year 2022
✔️ Works on all VPN gateway types
👉 Available as SmartConsole extension

One-liner (Bash) to show IPsec VPN site-to-site tunnels on Check Point security gateways.
In expert mode run:

echo;_vpn=1;if [[ -f /bin/enabled_blades ]];then if [[ `enabled_blades|tr 'A-Z' 'a-z'` != *'vpn'* ]];then _vpn=0;fi;elif [[ -f /opt/fw1/conf/active_blades.txt ]];then if [[ `grep VPN-S2S /opt/fw1/conf/active_blades.txt|awk '{print $NF}'` != '1' ]];then _vpn=0;fi;elif [[ -f /opt/fw1/conf/blades.json ]];then if [[ `jq '.data[]|select(.name=="VPN-S2S")|.enabled' /opt/fw1/conf/blades.json` != '1' ]];then _vpn=0;fi;fi;if [[ $_vpn == 1 ]];then _ha=0;if [[ `$CPDIR/bin/cpprod_util FwIsHighAvail` -eq '1' ]];then _ha=1;if [[ `cphaprob stat|grep $local$|tr 'A-Z' 'a-z'` == *'active'* ]];then _ha=0;fi;fi;if [[ $_ha == 0 ]];then if [[ -f /bin/timeout ]];then _stat=`timeout 5 stattest gettable 1.3.6.1.4.1.2620.1.9002.1 2 3 4 1 7 8 9 10 11`;else _stat=`stattest gettable 1.3.6.1.4.1.2620.1.9002.1 2 3 4 1 7 8 9 10 11`;fi;echo "$_stat"|tr ',' ' '|awk '{gsub(/$.*$/,"",$2)}1'|awk '{gsub("132","Initialized",$2)}1'|awk '{gsub("131","Down",$2)}1'|awk '{gsub("130","Phase_1",$2)}1'|awk '{gsub("129","Idle",$2)}1'|awk '{gsub("4","Destroyed",$2)}1'|awk '{gsub("3","UP",$2)}1'|awk '{gsub("0","Primary",$6)}1'|awk '{gsub("1","Backup",$6)}1'|awk '{gsub("2","On-demand",$6)}1'|awk '{gsub("0","?",$7)}1'|awk '{gsub("1","Alive",$7)}1'|awk '{gsub("2","!",$7)}1'|awk '{gsub("1","Regular",$8)}1'|awk '{gsub("2","DAIP",$8)}1'|awk '{gsub("3","ROBO",$8)}1'|awk '{gsub("4","LSV",$8)}1'|awk '{gsub("1","Regular",$9)}1'|awk '{gsub("2","Permanent",$9)}1'|sort|sed "s/^/$(hostname) <=> /"|sed '1 i\( , , , , , , , , , , )'|sed '1 i\FROM <=> TO STATE VPN_COMMUNITY PEER_IP SOURCE_IP LINK_PRIORITY PROB_STATE PEER_TYPE VPN_TYPE'|if [[ -f /bin/column ]];then column -t|sed "s/\bUP\b/\x1b[1;32m&\x1b[m/g;s/\bDown\b\|\bDestroyed\b/\x1b[1;31m&\x1b[m/g;s/\bBackup\b\|\bAlive\b\|\bInitialized\b\|\bPhase_1\b/\x1b[1;36m&\x1b[m/g"|sed '/^(.*)$/ s/./=/g'|sed '$a+'|sed '2h;$x'|sed "s/^/ /";echo -e "\033[1;2m Reset VPN tunnel to peer : vpn tu del PEER_IP\n Show VPN tunnel details : vpn tu tlist -p PEER_IP\033[m";else cat|sed '/^(.*)$/ s/./=/g';fi;else echo -e "\033[1;31mNot an active HA member.\033[m";fi;else echo -e "\033[1;31mNot a VPN gateway.\033[m";fi;unset _vpn _ha _stat;echo

Integrated with our ccc script.
To show the VPN topology see here.
To list VPN user tunnels see here.

Re: One-liner to show VPN S2S tunnels on gateway

the_rock — Mon, 06 Jun 2022 00:53:40 GMT

Will try it tomorrow and provide feedback ; - )

Re: One-liner to show VPN S2S tunnels on gateway

the_rock — Mon, 06 Jun 2022 13:10:34 GMT

Very good, works well!

Re: One-liner to show VPN S2S tunnels on gateway

Dennis_M — Tue, 07 Jun 2022 07:05:59 GMT

Finally. Have been waiting so long for a much simpler method to check the VPN tunnels and here it is.

Works great, thanks! 🙂

Re: One-liner to show VPN S2S tunnels on gateway

ptuttle_2 — Tue, 07 Jun 2022 17:00:56 GMT

This AWESOME !!! Thanks Very Much. Works Great. I clicked Kudos 50 + times but only went up one -😊

-pat

Re: One-liner to show VPN S2S tunnels on gateway

Joshua — Thu, 09 Jun 2022 14:48:34 GMT

This is very useful. A great addition to the power house that is the ccc-script. Just wow!

Re: One-liner to show VPN S2S tunnels on gateway

mombro — Mon, 13 Jun 2022 09:10:11 GMT

Great! Looking forward to the smart console extension 🙂

Re: One-liner to show VPN S2S tunnels on gateway

Friedrich_Taatz — Tue, 14 Jun 2022 09:14:38 GMT

Awesome!

Re: One-liner to show VPN S2S tunnels on gateway

Ziegelsambach — Wed, 15 Jun 2022 11:40:57 GMT

Good Job ^^

Re: One-liner to show VPN S2S tunnels on gateway

danjue — Thu, 16 Jun 2022 07:55:20 GMT

Thanks!

Re: One-liner to show VPN S2S tunnels on gateway

Thomas_Eichelbu — Thu, 16 Jun 2022 09:21:29 GMT

Wow holy cow ... cool stuff!!!

cannot believe we had to wait since 1993 for such a cool CLI command for a nice overview of vpn tunnels!
Awesome stuff!

Re: One-liner to show VPN S2S tunnels on gateway

jannag — Mon, 20 Jun 2022 08:30:33 GMT

Awesome Job!

Re: One-liner to show VPN S2S tunnels on gateway

Yannic_Schmitt — Mon, 27 Jun 2022 08:53:40 GMT

Awesome tool, works great!

Thank you for your contribution to the community. 😀

Re: One-liner to show VPN S2S tunnels on gateway

Marcus_E — Tue, 28 Jun 2022 06:58:25 GMT

Works like a charm. Thank you for sharing! 😊

Re: One-liner to show VPN S2S tunnels on gateway

OliverBayerlein — Thu, 29 Sep 2022 07:09:41 GMT

Very usefull, thanks!

Re: One-liner to show VPN S2S tunnels on gateway

Danny — Fri, 30 Sep 2022 11:54:35 GMT

@OliverBayerlein: Thx for your kind words and the DAIP fix.

Re: One-liner to show VPN S2S tunnels on gateway

DanielJavier — Wed, 20 Sep 2023 23:18:25 GMT

In VSX mode what modification should be made?

Re: One-liner to show VPN S2S tunnels on gateway

Danny — Fri, 22 Sep 2023 13:10:13 GMT

Switch to your specific vsenv first and adjust the paths of the script according to your environment.

Re: One-liner to show VPN S2S tunnels on gateway

Dario_Perez — Sun, 24 Aug 2025 03:46:57 GMT

Hi this is limited up to 100 VPN, do we have a roadmap to support more VPN?

thanks in advance

Re: One-liner to show VPN S2S tunnels on gateway

Danny — Sun, 24 Aug 2025 18:45:01 GMT

@Dario_Perez : As you are a Check Point employee, it would be nice if you could ask this internally and share the result with us.