topic Re: S2S VPN DOWN When? in General Topics

S2S VPN DOWN When?

RemoteUser — Thu, 20 Mar 2025 14:10:13 GMT

Hi All

is it possible to know exactly when a vpn went down? are we talking about an s2s vpn? is there a command that can help?

Re: S2S VPN DOWN When?

Lesley — Thu, 20 Mar 2025 14:38:35 GMT

Maybe this helps:

vpn tu tlist

But it is a difficult question, because if the tunnel is ''up'' with p1 p2 it still can be that for the user the tunnel is not working.

Or a part of the tunnel works and other part does not work (if you have more subnets in one tunnel).

You can check the firewall logs and check for logs from local enc domain towards remote and the other way around. Good indication is also to check logs from and towards remote peer IP.

Tunnel config also has p1 and p2 timers, most of the time if timer is reached new p2 or p1 is created.

In R82 you can configure VPN probes, those are hosts that you ping via the tunnel to check the status. Check it here:

https://support.checkpoint.com/results/sk/sk181994

Re: S2S VPN DOWN When?

Timothy_Hall — Thu, 20 Mar 2025 18:11:28 GMT

Unless you have Permanent Tunnels/DPD enabled it is possible for your VPN peer to go down or become unreachable, but the tunnel still looks "up" from your end, at least until the next Phase 2 re-key which could be up to 60 minutes later by default. At that point you would get an error about the tunnel being down, but it could have actually died up to 60 minutes ago.

If you have Permanent Tunnels (CP gateways) or DPD (interoperable gateways) enabled, there is a setting in the VPN Community that can fire an alert when the tunnel is detected down, which should happen within roughly 60 seconds of the failure.

Re: S2S VPN DOWN When?

the_rock — Thu, 20 Mar 2025 18:48:05 GMT

Something like what I attached, though someone from TAC gave me this while back, but they said it might not always be 100% reliable.

Andy

Re: S2S VPN DOWN When?

the_rock — Thu, 20 Mar 2025 18:54:01 GMT

You can also probably use tool called checkmk or something along those lines. I tested it in the lab last year, looked pretty reliable.

Andy