topic How to start and confirm a IPSEC VPN Site-to-Site negotiation from Check Point Gateways? in Firewall and Security Management https://community.checkpoint.com/t5/Firewall-and-Security-Management/How-to-start-and-confirm-a-IPSEC-VPN-Site-to-Site-negotiation/m-p/189803#M34979 <P>Dear friends,</P> <P>I apologize for the basic question, but I couldn't find this information clearly in the VPN Guide.</P> <P>How can I force a Check Point gateway to initiate a site-to-site VPN tunnel negotiation?</P> <P>How can I verify that it is the Check Point gateway that is initiating the negotiation and attempting to establish the tunnel?</P> <P>Any tips on useful commands for this situation or any SK that addresses this?</P> <P>Thank you in advance for your help!</P> Thu, 17 Aug 2023 18:01:03 GMT Bernardes 2023-08-17T18:01:03Z How to start and confirm a IPSEC VPN Site-to-Site negotiation from Check Point Gateways? https://community.checkpoint.com/t5/Firewall-and-Security-Management/How-to-start-and-confirm-a-IPSEC-VPN-Site-to-Site-negotiation/m-p/189803#M34979 <P>Dear friends,</P> <P>I apologize for the basic question, but I couldn't find this information clearly in the VPN Guide.</P> <P>How can I force a Check Point gateway to initiate a site-to-site VPN tunnel negotiation?</P> <P>How can I verify that it is the Check Point gateway that is initiating the negotiation and attempting to establish the tunnel?</P> <P>Any tips on useful commands for this situation or any SK that addresses this?</P> <P>Thank you in advance for your help!</P> Thu, 17 Aug 2023 18:01:03 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/How-to-start-and-confirm-a-IPSEC-VPN-Site-to-Site-negotiation/m-p/189803#M34979 Bernardes 2023-08-17T18:01:03Z Re: How to start and confirm a IPSEC VPN Site-to-Site negotiation from Check Point Gateways? https://community.checkpoint.com/t5/Firewall-and-Security-Management/How-to-start-and-confirm-a-IPSEC-VPN-Site-to-Site-negotiation/m-p/189804#M34980 <P>This is typically started by initiating traffic that should go through the VPN (e.g. initiate a ping that should traverse the VPN).<BR />You should see log entries in SmartView that confirm the VPN was started.<BR />You can use vpn tu on the command line to see what tunnels are started.<BR />For more advanced debugging, see:&nbsp;<A href="https://support.checkpoint.com/results/sk/sk180488" target="_blank">https://support.checkpoint.com/results/sk/sk180488</A></P> Thu, 17 Aug 2023 18:30:03 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/How-to-start-and-confirm-a-IPSEC-VPN-Site-to-Site-negotiation/m-p/189804#M34980 PhoneBoy 2023-08-17T18:30:03Z Re: How to start and confirm a IPSEC VPN Site-to-Site negotiation from Check Point Gateways? https://community.checkpoint.com/t5/Firewall-and-Security-Management/How-to-start-and-confirm-a-IPSEC-VPN-Site-to-Site-negotiation/m-p/189805#M34981 <P>As&nbsp;<a href="https://community.checkpoint.com/t5/user/viewprofilepage/user-id/7">@PhoneBoy</a>&nbsp;said, vpn tu is good, also, if you have monitoring blade enabled, you can check in SV monitor, as well as with vpn tu tlist -p external_peer_ip command.</P> <P>Example, say ex peer IP is 1.2.3.4, you can run vpn tu tlist -p 1.2.3.4</P> <P>Andy</P> Thu, 17 Aug 2023 18:31:39 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/How-to-start-and-confirm-a-IPSEC-VPN-Site-to-Site-negotiation/m-p/189805#M34981 the_rock 2023-08-17T18:31:39Z Re: How to start and confirm a IPSEC VPN Site-to-Site negotiation from Check Point Gateways? https://community.checkpoint.com/t5/Firewall-and-Security-Management/How-to-start-and-confirm-a-IPSEC-VPN-Site-to-Site-negotiation/m-p/189814#M34982 <P>Hello friends <a href="https://community.checkpoint.com/t5/user/viewprofilepage/user-id/7">@PhoneBoy</a>&nbsp; <a href="https://community.checkpoint.com/t5/user/viewprofilepage/user-id/38213">@the_rock</a>&nbsp;! Thank you for the response!</P> <P>But in this case, the 'vpn tu tlist -p &lt;IP_peer&gt;' command will show me information only if the tunnel is already established, correct?</P> <P>I am dealing with a scenario where the tunnel is not established, and I would like to know if just by sending a ping that should go through the tunnel, will the Check Point attempt to initiate the negotiation to establish the tunnel if it's down?</P> Thu, 17 Aug 2023 21:27:43 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/How-to-start-and-confirm-a-IPSEC-VPN-Site-to-Site-negotiation/m-p/189814#M34982 Bernardes 2023-08-17T21:27:43Z Re: How to start and confirm a IPSEC VPN Site-to-Site negotiation from Check Point Gateways? https://community.checkpoint.com/t5/Firewall-and-Security-Management/How-to-start-and-confirm-a-IPSEC-VPN-Site-to-Site-negotiation/m-p/189817#M34985 <P>Well, if connection is supposed to be encrypted, then it will go through the tunnel.</P> Thu, 17 Aug 2023 22:10:30 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/How-to-start-and-confirm-a-IPSEC-VPN-Site-to-Site-negotiation/m-p/189817#M34985 the_rock 2023-08-17T22:10:30Z