topic Re: Cannot ping remote VPN gateway in General Topics

Cannot ping remote VPN gateway

Brianpiraty_Ale — Wed, 22 Aug 2018 19:01:09 GMT

The IPsec tunnel works fine. but could not ping the remote VPN gateway, what could be the problem

Danny — Wed, 22 Aug 2018 19:41:32 GMT

The issue could be

the remote VPN gateway requires a rule that permits echo requests (ping) from your VPN gateway
your VPN gateway requires a rile that permits echo requests (ping) to the remote VPN gateway
the external IP addresses of both VPN gateways are only part of the VPN encryption domain of one VPN gateway
the external IP addresses of both VPN gateway have not been excluded from the VPN encryption domain

Gomboragchaa — Thu, 23 Aug 2018 00:56:22 GMT

I had same issue. Our monitoring tool send ping to remote gateway always.

1. Activate ICMP Requests from Global properties.

If still same:

edit $FWDIR/lib/crypt.def file

- find #ifndef NON_VPN_TRAFFIC_RULES

add belowed config
#ifndef IPV6_FLAVOR
#define NON_VPN_TRAFFIC_RULES (dst=remote_peer_gateway_IP)
#else

#define NON_VPN_TRAFFIC_RULES 0
#endif
#endif

#endif /* __crypt_def__ */

Then install policy. After you will get direct access to remote gateway...

LostBoY — Tue, 10 Oct 2023 04:54:29 GMT

How can i exclude external ip addresses of bith gateways from encryption domain ?

PhoneBoy — Tue, 10 Oct 2023 20:42:47 GMT

Upgrade to R81.20, it's actually a checkbox in the relevant Gateway objects.
In earlier releases, see scenario 3 in: https://support.checkpoint.com/results/sk/sk108600