topic Re: S2S VPN tunnel in General Topics

S2S VPN tunnel

babicmilan — Mon, 02 Oct 2023 09:14:02 GMT

How to find for S2S VPN tunnel for defined date, time when tunnel is created, time when is down in logs?

For example, I want to find in logs when S2S VPN tunnel is created on 29.09.2023. for peer 81.93.73.155?

Is it enough to find IKE logs for peer 81.93.73.155 on date 29.09.2023.?

Best regards

Re: S2S VPN tunnel

G_W_Albrecht — Mon, 02 Oct 2023 08:10:30 GMT

Look for Key Install Events - you should see at least one Key Install for Quick Mode and one for Main Mode complete. Also tunnel down is a Key Install log.

Re: S2S VPN tunnel

babicmilan — Mon, 02 Oct 2023 09:12:11 GMT

29 Sep 23, 9:09:49 AM Informational Exchange Received Notification from Peer: Responder Lifetime(phase1)

29 Sep 23, 9:29:16 AM Informational Exchange Received Notification from Peer: Responder Lifetime(phase1)
29 Sep 23, 9:29:16 AM Quick Mode Received Notification from Peer: invalid id information
29 Sep 23, 9:29:16 AM Informational Exchange Received Delete IKE-SA from Peer: 81.93.73.155; Cookies: 6288df3d467a54f9-24dc01cea79c573e

29 Sep 23, 9:32:28 AM Informational Exchange Received Notification from Peer: Responder Lifetime(phase1)
29 Sep 23, 9:32:28 AM Quick Mode Received Notification from Peer: invalid id information
29 Sep 23, 9:32:28 AM Informational Exchange Received Delete IKE-SA from Peer: 81.93.73.155; Cookies: cfee3d114ade6c26-7164d994f8d95749

29 Sep 23, 9:35:17 AM Quick Mode Received Notification from Peer: invalid id information
29 Sep 23, 9:35:17 AM Informational Exchange Received Delete IKE-SA from Peer: 81.93.73.155; Cookies: 5fa2520d840b9d04-82eb57ebb5e31265

29 Sep 23, 9:43:41 AM Informational Exchange Received Notification from Peer: Responder Lifetime(phase1)
29 Sep 23, 9:43:41 AM Quick Mode Received Notification from Peer: invalid id information
29 Sep 23, 9:43:41 AM Informational Exchange Received Delete IKE-SA from Peer: 81.93.73.155; Cookies: 5e3d5c7ac2ec55a4-ed9a9498f5bf9339

29 Sep 23, 9:45:13 AM Informational Exchange Received Notification from Peer: Responder Lifetime(phase1)

Re: S2S VPN tunnel

babicmilan — Mon, 02 Oct 2023 09:18:32 GMT

Hello, I send to you logs on 29 Sep 23 for peer 81.93.73.155 between 6-11 AM

Please let me know on which time S2S VPN tunnel is created and when is down?

Re: S2S VPN tunnel

G_W_Albrecht — Mon, 02 Oct 2023 09:19:32 GMT

So what ? You did not write that VPN does not work, look at https://support.checkpoint.com/results/sk/sk108600

Re: S2S VPN tunnel

G_W_Albrecht — Mon, 02 Oct 2023 10:25:36 GMT

Please explain what you want to achieve - and why i should analyze your logs without cause ?

Re: S2S VPN tunnel

babicmilan — Mon, 02 Oct 2023 12:03:57 GMT

Hello, regarding this logs, I want to know when S2S tunnel was up and when was down.

Is it possible to know this information based on "Key Install" logs.

Best regards.

Re: S2S VPN tunnel

G_W_Albrecht — Mon, 02 Oct 2023 12:47:57 GMT

Easy - it was down starting somewhere before 29 Sep 23, 9:29:16 until before 29 Sep 23, 9:45:13.

Re: S2S VPN tunnel

PhoneBoy — Mon, 02 Oct 2023 13:35:33 GMT

The Key Install logs are a good indication of when the tunnel came up.
Tunnels "exist" so long as there is traffic flowing through them and/or the various IPsec timers do not expire.
Short of some sort of debugging mode, I don't believe we log anything that might be interpreted as a "tunnel down" event.

Re: S2S VPN tunnel

the_rock — Mon, 02 Oct 2023 13:46:56 GMT

See...unfortunately, CP does not have an easy way of telling such info, unlike some other fw vendors, so what @G_W_Albrecht gave you is probably your best bet.

You can verify with TAC to see if they have better method, but personally, I never heard of any.

Andy

Re: S2S VPN tunnel

G_W_Albrecht — Tue, 03 Oct 2023 06:59:46 GMT

I found customers using ping from one peer network node to another to monitor this 8)

Re: S2S VPN tunnel

the_rock — Tue, 03 Oct 2023 11:52:29 GMT

I would NOT call such a method a monitoring tool 🤣🤣🤣

Andy

Re: S2S VPN tunnel

G_W_Albrecht — Tue, 03 Oct 2023 13:34:05 GMT

Maybe not - but it does

- try to keep the tunnel up all the time

- logs when the tunnel goes down

- logs when the tunnel came up again

Re: S2S VPN tunnel

the_rock — Tue, 03 Oct 2023 16:21:38 GMT

I guess thats the best method in this case lol

Andy