topic Re: SMS and VSX gateway communication over ipsec tunnel in Firewall and Security Management

SMS and VSX gateway communication over ipsec tunnel

an_technical — Mon, 10 Feb 2025 10:35:37 GMT

Hi All,

I am working on a deployment where SMS and VSX gateway are separated by cities and communication is over ipsec tunnel.

I commented #define ENABLE_CPD_AMON from implied_rules.def rule and created new rule in access policy to send traffic in vpn.

Will this be enough for management server to communicate with VSX gateway (connectivity from mgmt to VSX, Policy installation etc)

Thanks

Re: SMS and VSX gateway communication over ipsec tunnel

an_technical — Mon, 10 Feb 2025 14:23:02 GMT

By commenting #define ENABLE_CPD_AMON MGMT server was able to reach VSX gateway and install policy but I cannot create new interface or virtual system. I see 18191 port traffic is going as clear text. I tried to exclude #define ENABLE_CPD but it doesn't work and now policy push is failing on virtual system with TCP connectivity failure (Port 18191)

In other gateway I see traffic is dropping saying, clear text should be encrypted.

VSX should send it in through ipsec tunnel.

Re: SMS and VSX gateway communication over ipsec tunnel

PhoneBoy — Mon, 10 Feb 2025 20:00:07 GMT

In general, we do not recommend making this configuration change as you can end up in a situation where you are unable to manage your gateways due to a VPN outage.
Also, it's best to consult with TAC to ensure you are making the correct changes to implied rules.

Re: SMS and VSX gateway communication over ipsec tunnel

Duane_Toler — Tue, 11 Feb 2025 15:06:53 GMT

100% concur with PhoneBoy. I tried this myself long ago, and (amazingly) I got it working... for a short time. It eventually became very problematic and I had to undo this trick. Do not do it this way; avoid it as much as you can.

You'll need to manage the VSX directly from your remote management server, but not through a VPN or through another VS; the VS0 can protect itself.