topic Re: Traditional Mode Configuration in checkpoint VPN in Firewall and Security Management

Traditional Mode Configuration in checkpoint VPN

trimalshriram19 — Mon, 21 Oct 2024 14:34:40 GMT

Hi ,

I need to do below changes on the Traditional Mode Configuration in checkpoint VPN .

Phase 1 and 2 Algorithm

DPD Action

DPD Delay

DPS timeout

Can anyone suggest , how we can do those changes as I am in R81.20 version

Re: Traditional Mode Configuration in checkpoint VPN

G_W_Albrecht — Mon, 21 Oct 2024 15:04:38 GMT

Afaik, since R77.30 you are no more able to create or edit Traditional Mode Policies, In https://support.checkpoint.com/results/sk/sk171035 you can read details. I would suggest to contact CP TAC as this is a very special case...

Re: Traditional Mode Configuration in checkpoint VPN

PhoneBoy — Mon, 21 Oct 2024 21:24:42 GMT

What precise reason do you still use Traditional Mode VPN?
DPD support was added in R77.10, which is well after Traditional Mode VPN were formally deprecated in the NGX (R60) release.
What you're asking for, I suspect, is not possible.

Re: Traditional Mode Configuration in checkpoint VPN

trimalshriram19 — Tue, 22 Oct 2024 10:16:14 GMT

Hi Phone,

Thanks for the reply.

We are having old VPN is in place and now vendor came us to do few changes at VPN end for more security.

Thanks

Re: Traditional Mode Configuration in checkpoint VPN

G_W_Albrecht — Tue, 22 Oct 2024 14:05:25 GMT

I would suggest to contact CP TAC to review the situation and provide an easy solution here!

Re: Traditional Mode Configuration in checkpoint VPN

the_rock — Tue, 22 Oct 2024 14:19:11 GMT

I agree with @G_W_Albrecht , just call TAC and see what can be done to fix this.

Andy

Re: Traditional Mode Configuration in checkpoint VPN

_Val_ — Tue, 22 Oct 2024 14:29:16 GMT

I don't see how TAC can help someone to move forward from a non-supported tech. It looks more like a PS project. However, I would suggest re-hauling the VPN solution and moving to supported features. There is not much justification for using Traditional VPN at all.

Re: Traditional Mode Configuration in checkpoint VPN

the_rock — Tue, 22 Oct 2024 14:40:40 GMT

I would say that sk Guenther provided is a good start. I just ran it in my lab and Im sure it can help.

Andy

https://support.checkpoint.com/results/sk/sk171035

Command from the lab:

[Expert@CP-MANAGEMENT:0]# mgmt_cli show package name "R81.20-CP-LAB-POLICY"

Re: Traditional Mode Configuration in checkpoint VPN

PhoneBoy — Tue, 22 Oct 2024 17:05:28 GMT

The main reasons come customers were still using Traditional Mode VPN have been solved:

Multiple encryption algorithms per community (you can override for specific peers in the community)
Exclude specific traffic from VPN (supported from at least R77.30)
Allow granular encryption domain per community (added in R80.40)

Traditional Mode VPN also isn't accelerated with SecureXL, if I recall correctly (thus worse performance).
So, yeah, there really isn't a reason to run Traditional Mode VPN anymore.

Re: Traditional Mode Configuration in checkpoint VPN

G_W_Albrecht — Wed, 23 Oct 2024 10:22:08 GMT

There could be a possible workaround like tweaking Trad VPN Config using dbedit that is only known to TAC...

Re: Traditional Mode Configuration in checkpoint VPN

the_rock — Wed, 23 Oct 2024 11:01:36 GMT

Good point...