topic Re: connection persistence in General Topics

connection persistence

Luis_Miguel_Mig — Thu, 27 Jun 2024 16:00:20 GMT

Is there a consensus recommendation about connection persistence? Keep all connections or rematch connections?
Even though the default value is rematch connections it seems like the recommendation is keep all connections.

Any thought?

https://support.checkpoint.com/results/sk/sk103598

Re: connection persistence

the_rock — Thu, 27 Jun 2024 16:26:26 GMT

I ALWAYS do keep connections. Believe it or not, I had few instances before where VPN tunnel had intermittent issues and that setting was what fixed it. Ironically enough, once with TAC on the phone, I suggested that, everyone was super sceptical, but once it worked, TAC person was also somewhat surprised.

I actually discovered it ages ago totally by coincidence after being on the phone for 8 hours lol

Andy

Re: connection persistence

Henrik_Noerr1 — Thu, 27 Jun 2024 18:28:47 GMT

We have 'keep connections' on +400 Virtual Systems - We found that scheduled IPS updates broke various connections, with no easy possibility to troubleshoot..

Re: connection persistence

Alex- — Thu, 27 Jun 2024 19:04:06 GMT

We mostly enable it now with all cloud-based services and whatnot which can break when recomputed at policy installation.

Some services, like VOIP through the gateways, especially mandate to activate this mode: https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_VoIP_AdminGuide/Topics-VOIPG/208026.htm?tocpath=Configuring%20VoIP%20for%20Check%20Point%20Security%20Gateways%7C_____1

Re: connection persistence

Lesley — Thu, 27 Jun 2024 20:11:53 GMT

I think there is no good or wrong on this setting.

Maybe one option is more friendly for connections and connectivity and the other option you could consider more 'secure'.

I am a 'Keep all connections' kinda guy.