VPN behavior question: Break-before-make / Make-before-break

ReinhardS — Thu, 20 Apr 2023 08:47:43 GMT

Hi,

a customer asks how check point handles this behavior that you can configure with cisco or strongwan:

Break-before-make

This is the default behavior of the IKE daemon when reauthenticating an IKEv2 SA. It means that all IKE_SAs and CHILD SAs are torn down before recreating them. This will cause some interruptions during which no IPsec SAs are installed. If trap policies are used it could also trigger unnecessary acquires and hence duplicate IPsec SAs during that downtime. To prevent plaintext traffic from leaving the host appropriate firewall rules or drop policies may be used.

Make-before-break

This method first creates duplicates of the IKE SAs and all CHILD SAs overlapping with the existing ones and then deletes the old ones. This avoids interruptions but requires that both peers can handle overlapping SAs (e.g. in regards to virtual IPs, duplicate policies or updown scripts). It is supported for IKEv2 since version 5.3.0 but is disabled by default and may be enabled by explicitly setting

Any information available on that?

thanks

reinhard

Re: VPN behavior question: Break-before-make / Make-before-break

PhoneBoy — Fri, 21 Apr 2023 20:07:31 GMT

This SK suggests we are using Break Before Make: https://support.checkpoint.com/results/sk/sk171756

Re: VPN behavior question: Break-before-make / Make-before-break

the_rock — Fri, 21 Apr 2023 20:28:00 GMT

Thats superb question...I had guy dealing with Cisco ask that once when we were with escalation guy from CP trying to fix CP-Cisco VPN and what @PhoneBoy said was indeed the right assesment. Esc. guy gave that exact same sk.

Have an awesome weekend!

topic Re: VPN behavior question: Break-before-make / Make-before-break in Firewall and Security Management

VPN behavior question: Break-before-make / Make-before-break

Re: VPN behavior question: Break-before-make / Make-before-break

Re: VPN behavior question: Break-before-make / Make-before-break