topic Re: IPSEC VPN in Firewall and Security Management

IPSEC VPN

SkipperNavy — Mon, 14 Dec 2020 11:56:02 GMT

Hello,

I just configured an ipsec vpn with a 3rd party Firewall.

Ike phase 1 is OK.

in logs, i see dropped paquets between the Mgmt interface of my local GW and the remote public ip of 3rd party.

Can Someone advice me on this case.

Re: IPSEC VPN

PhoneBoy — Mon, 14 Dec 2020 17:02:49 GMT

You can start here for debugging.

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk34467&partition=Advanced&product=IPSec

Re: IPSEC VPN

SkipperNavy — Tue, 15 Dec 2020 07:30:48 GMT

Thank you,

I tried all of this , but i can't figure out the problem.

Is it normal to see drops between the Mgmt ip of the gateway and the peer ip?

Re: IPSEC VPN

PhoneBoy — Tue, 15 Dec 2020 14:12:23 GMT

You haven't described your precise configuration, which makes it difficult to know if you've configured something incorrectly.
What do you have Link Selection configured to use in this case?

Re: IPSEC VPN

Benedikt_Weissl — Tue, 15 Dec 2020 14:24:01 GMT

Phase 2 issues might be caused by different encryption/hash algorithms on one side, but since phase 1 is working I think the encryption domains are wrong. Can you post your settings and an excerpt from the vpn log?

Re: IPSEC VPN

Vincent_Bacher — Tue, 15 Dec 2020 15:09:12 GMT

"dropped paquets between the Mgmt interface of my local GW"

Mgmt Interface?
Link selection config issue?
Routing?
🤔
Drop reason from log would be helpful. 😏

Re: IPSEC VPN

SkipperNavy — Tue, 15 Dec 2020 20:56:09 GMT

i have not modified the Link selection.

I am facing problems with my cluster, it is not stable.

Thank you to all.

Re: IPSEC VPN

PhoneBoy — Tue, 15 Dec 2020 22:33:06 GMT

There can be many reasons a VPN doesn't work.
We would need to know a LOT more about the underlying configuration and the precise errors you're seeing.
Output of some of the debugs might be helpful as well.

If you're not comfortable sharing on a public community (which I totally understand), I highly recommend opening a case with our TAC.

Re: IPSEC VPN

Vincent_Bacher — Wed, 16 Dec 2020 08:28:43 GMT

All Screenshots and log entries or debug outputs are easy to anonymize 🙂