topic Re: VPN between Checkpoint domains seens as down in Firewall and Security Management

VPN between Checkpoint domains seens as down

Ilovecheckpoint — Thu, 23 May 2024 14:46:54 GMT

Hello,

In our organisation we have more Checkpoint domains.

Communication between domains is done via domain based vpn.

All vpn are seen as up, but one is showed as down (all time I check it) on SmartView Monitor, instead all the others are seen as up.

This vpn is up and running.

I have noticed, tunnel_test last time received was yesterday and it is only from gatewaysite1 to gatewaysite2

and never on the other direction.

I would like to see it correctly up.

Re: VPN between Checkpoint domains seens as down

the_rock — Thu, 23 May 2024 17:57:20 GMT

We need more info. Did you do basic vpn debug? tcpdump? fw monitor? what does vpn tu tlist show?

Andy

Re: VPN between Checkpoint domains seens as down

Ilovecheckpoint — Mon, 27 May 2024 14:48:30 GMT

Hello,

On gatewaysite1, vpn tu tlist shows all vpn tunnels by subnet as ipsec. None of the vpn is showed as connected, but all other tunnels are seen up On Smartview Monitor (they are all CheckPoint gateways).On gatewaysite2, vpn tu tlist shows all vpn tunnels by subnet as ipsec connected. On Smartview Monitor, on permanent tunnel it shows as connected, but only on tunnels by gateways or tunnels by community. On permanent tunnels is empty.

Re: VPN between Checkpoint domains seens as down

Lesley — Mon, 27 May 2024 18:41:12 GMT

So tunnel is working but shows as down in SmartView monitor? If it is Check Point to Check Point you have to use permanent tunnels and working tunnel test. If it is Check Point towards different device (non CP) it will be DPD.

Any difference with other tunnels? All run IKEv1 or v2? Allowed tunnel test port on both sides?