topic Re: Gateway appliances reliance on management server in Firewall and Security Management

Gateway appliances reliance on management server

Mike-H — Fri, 26 Apr 2024 08:33:18 GMT

Hello,

We have a number of 1450's and 1570's connected in a site to site VPN to our primary co-lo VSX firewalls. These are also connected to an MDSM. Should the MDSM become unavailable for a period of time (+12 hours) we find that the 1450's and 1570's will fail to rekey thus taking down their VPN connection, which is less than ideal.

Is this 'by design'/'unavoidable' or is there something we can do to prevent the gateways from dropping should the management server experience issues?

Thanks

Mike

Re: Gateway appliances reliance on management server

the_rock — Fri, 26 Apr 2024 12:26:50 GMT

I believe it used to be 24 hours, but might be different now. Is there anything you can do to prevent that? personally, I cant think of anything, because it relies on mgmt server for that sort of communication.

Andy

Re: Gateway appliances reliance on management server

Timothy_Hall — Fri, 26 Apr 2024 12:32:19 GMT

The VPN is going down because certificates are used for IKE Phase 1 authentication; when a rekey occurs the CRL must be retrieved from the SMS/MDS to ensure the certificate has not been revoked. There is a cache for the CRL on the gateways that will help if the SMS/MDS is down for a short period, but if it is down long enough the cached CRL entries will expire and the VPN breaks at the next rekey.

You can extend the CRL cache timeout or even disable the CRL checking completely as described here:

https://community.checkpoint.com/t5/SMB-Gateways-Spark/How-does-SMB-gateway-CRL-fetching-work/m-p/198172/highlight/true#M9798

Re: Gateway appliances reliance on management server

Mike-H — Fri, 26 Apr 2024 13:06:27 GMT

Thank you, that makes sense. We will look to increase the CRL timeout.

Much appreciated. 🙂