topic Re: Disable all VPN tunnels command R80.30 gw in General Topics

Disable all VPN tunnels command R80.30 gw

AntonMakarychev — Fri, 01 Nov 2019 08:14:39 GMT

Hello everyone,

I need a cli command for Check Point Gateway R80.30 to disable all VPN tunnels. I want to use it in my script to disable and enable them.

I found vpn drv on|off command, but in the latest take of R80.30, I think they changed it - Usage: vpn drv stat | reset

Re: Disable all VPN tunnels command R80.30 gw

_Val_ — Fri, 01 Nov 2019 08:26:16 GMT

What is the purpose? Force tunnel re-negotiations?

Re: Disable all VPN tunnels command R80.30 gw

AntonMakarychev — Fri, 01 Nov 2019 08:40:29 GMT

No, the purpose is to disable them completely due to unforseen circumstrances. And to enable them back after the situation become normal.

Re: Disable all VPN tunnels command R80.30 gw

_Val_ — Fri, 01 Nov 2019 10:04:09 GMT

vpn drp on|off is not availabe on R80.x due to infrastructure changes. The driver is being loaded during GW boot and cannot be unloaded.

The best option would be to kick your GW in question out of VPN community or disable VPN on the GW object and reinstall policy.

Still, what would be "unforeseen" circumstances in your case is a mystery to me.

Re: Disable all VPN tunnels command R80.30 gw

cezar_varlan1 — Thu, 01 Jul 2021 05:37:31 GMT

Unforseen circumstances would be that the gateway persistently and incapabliy connects to VPN and then becomes unreacheable from the Management in order to change anything. Even with iLO access you cannot disable VPN so you are stuck with diasbling the physical port...

Re: Disable all VPN tunnels command R80.30 gw

Duane_Toler — Thu, 01 Jul 2021 15:08:07 GMT

You could add a reject route for the VPN peer, perhaps:

route add -host <peer> reject

route del -host <peer> reject

You'll still need to kill the tunnel to be sure it's removed from SecureXL:

"vpn shell tunnels delete IKE all"

or: "vpn shell tunnels delete IKE peer <peer IP>" if you want per peer

You can get clever with "vpn shell tunnels show IKE all" and then your delete command.

Re: Disable all VPN tunnels command R80.30 gw

cezar_varlan1 — Sat, 14 Mar 2026 08:42:17 GMT

Never knew reject routes exist, that's a good idea!