topic Constant S2S IPsec VPN outages in Firewall and Security Management

Constant S2S IPsec VPN outages

Matlu — Wed, 05 Jul 2023 20:02:39 GMT

Hello, everyone.

I currently have several S2S VPNs created, some inherited from the previous administrator, and many others newly created.

We have a concern, many of these VPNs, old and new, tend to have the "recurring detail" that every so often, the VPN crashes.

I have the impression that this is due to the lack of traffic on the VPN itself.
Is this normal behavior in Checkpoint?
Is there a way to "keep the tunnel up all the time"?

In addition to this, a general query regarding Checkpoint's VPNs. Parameters such as NAT-T and DPD in CP Firewalls are disabled by default, correct?
If any of these 2 parameters are enabled, they affect ALL VPNs that have been created. ????

Greetings.

Re: Constant S2S IPsec VPN outages

PhoneBoy — Wed, 05 Jul 2023 21:47:26 GMT

Unless you've enabled Permanent Tunnels, this is expected behavior.
We use both a Tunnel Test (CP proprietary) and DPD, depending on the configuration.
I believe DPD is default for NEW installs of R81 and above and can be configured per-peer.
See: https://support.checkpoint.com/results/sk/sk108600#Scenario%204 and the doc I linked earlier.
NAT-T is a global (per gateway) setting per: https://support.checkpoint.com/results/sk/sk32664

Re: Constant S2S IPsec VPN outages

Matlu — Wed, 05 Jul 2023 22:21:05 GMT

Hello,

If my Checkpoint does not have the DPD enabled for a VPN, but the remote peer does have this parameter active, can this be the reason for the constant "intermittency" in the VPN?

Greetings.

Re: Constant S2S IPsec VPN outages

PhoneBoy — Wed, 05 Jul 2023 22:37:09 GMT

Any difference in setting between the two ends can cause this, including DPD settings.

Re: Constant S2S IPsec VPN outages

Matlu — Thu, 06 Jul 2023 00:00:32 GMT

A question,

What is the most "Feasible" alternative to validate if the VPN tunnels are up or down?

Is SmartView Monitor a viable option?

Or is the CLI the best option to validate this?

I seem to have read at some point about a SCRIPT that would inform you of the status of the tunnels.

Is this real?

Re: Constant S2S IPsec VPN outages

Timothy_Hall — Thu, 06 Jul 2023 13:48:33 GMT

Set Permanent Tunnels on the VPN Community (depending on your code version you may need to switch it to DPD mode for non-Check Point VPN peers) and then set mail/SNMP alerts to fire if the tunnel falls down but can't get back up. This page is from my Max Power book:

Re: Constant S2S IPsec VPN outages

CheckPointerXL — Tue, 18 Jul 2023 08:16:04 GMT

Hello Timothy,

so if i enable DPD do we need to set permanent tunnels ? or it is not necessary?

thanks

Re: Constant S2S IPsec VPN outages

Timothy_Hall — Wed, 19 Jul 2023 12:28:59 GMT

Usually you'd want permanent tunnels enabled when using DPD, but it looks like it is not strictly required:

https://community.checkpoint.com/t5/Security-Gateways/Enable-DPD-on-R80-20/m-p/32605

Note that by default starting in R81 if an Interoperable Device type is participating in a VPN Community and Permanent Tunnels are enabled, DPD mode will be set automatically for that VPN peer, no GUIDBedit required.