topic Re: Site-to-site VPN using ikev2 and double shared secret in Firewall and Security Management

Site-to-site VPN using ikev2 and double shared secret

Caio — Fri, 21 Aug 2020 00:42:13 GMT

Hi everyone,

I'm just wondering how to configure a site-to-site VPN using IKE version 2 and a local and remote shared secret. Does anynone know if this feature is supported by CheckPoint? I'm using a Model 12600 running on R77.20. Thank you.

Re: Site-to-site VPN using ikev2 and double shared secret

PhoneBoy — Fri, 21 Aug 2020 01:39:32 GMT

First of all, R77.20 has been End of Support for quite a while.
Second, the whole point of a "shared secret" is that both sides use the same secret.
There isn't support for two shared secrets.

Re: Site-to-site VPN using ikev2 and double shared secret

Caio — Fri, 21 Aug 2020 17:07:45 GMT

Thanks for your reply, @PhoneBoy . I know that my security Gateway should be updated, maybe to R88.30. But my doubt still remains: when you say that two shared secrets are not supported, ypu mean by Check Point implementaion, right? I'm saying that because i have a Fortigate too and this is possible on it. I have generated a key on my side and the other part generated another one. We exchange the keys and both keys are used in configuration, mine as a local and their as a remote shared secret.

Re: Site-to-site VPN using ikev2 and double shared secret

PhoneBoy — Fri, 21 Aug 2020 17:36:21 GMT

That’s what I’m saying: there isn’t a way to configure two shared secrets on the Check Point side.
Which begs the question: how is effectively two shared secrets better than one?
You basically have to share both, right?