topic Re: Permanent Tunnel with inter-operable Device in General Topics

Permanent Tunnel with inter-operable Device

amith_rao — Fri, 14 Dec 2018 13:21:18 GMT

There is a requirement to Establish a Permanent Tunnel between CheckPoint and Interoperable device(AWS). To do so does the configuration only involve enabling DPD from Guidbedit or also it is required to enable the "permanent tunnel" option in the VPN community?

Thanks in Advance.

Re: Permanent Tunnel with inter-operable Device

G_W_Albrecht — Fri, 14 Dec 2018 13:43:46 GMT

Here is very good explanation: sk108600: VPN Site-to-Site with 3rd party

An alternative would be to send packets from client at Site behind CP GW to another client behind peer GW in a regular intervall.

Re: Permanent Tunnel with inter-operable Device

amith_rao — Fri, 14 Dec 2018 14:02:29 GMT

Thanks for the info, Gunther.

The Problem here is the peer end ( AWS) uses a permanent tunnel with DPD which cannot be changed. Hence it is required to enable the same at CheckPoint end.

I have referred the mentioned SK and also the VPN admin guide but still, I feel that it is clearly not stated whether to enable both the Permanent tunnel option from the VPN community and DPD or just the DPD from Guidbedit.

I tested this in the lab between to Check Point device enabling both Permanent tunnel option and changing the tunnel testing to DPD.

Observation: In spite of disabling the default "tunnel testing" feature which works on port 18234 I can still see traffic exchanged with these ports as shown below.