topic Re: IPSEC Site to Site VPN Encryption domain update in Firewall and Security Management

IPSEC Site to Site VPN Encryption domain update

JASPAL_SINGH — Fri, 21 Aug 2020 15:45:42 GMT

Hi All,

I have updated the Encryption domain for exiting Site to Site IPSEC VPN. Tunnel is up and active.

Communication is not ok to the IP that is added recently. Policy is installed.

In zdebug error is coming like " encryption failed".

I doubt we need to reset the tunnel but I did not reset the tunnel yet.

My query is like do we need to reset the tunnel after we update the existing encryption domain ?

Thank & Regards,

Jaspal Singh

PhoneBoy — Fri, 21 Aug 2020 17:37:34 GMT

It can depending on how precisely the encryption domain was changed and your precise configuration.

Maarten_Sjouw — Fri, 21 Aug 2020 18:07:38 GMT

Like what @PhoneBoy said, it is depending on the configuration:

Is it a Check Point to Check Point tunnel between 2 gateways manged by the same management server?
- What is the setting for the tunnel, per host/network/gateway pair?
- Permanent tunnel settings?
Is it a Check Point to other brand FW or externallyu manged CP?
- Has the topology on the other side also been updated?
- Tunnel settings?

Just to mention some questions.