topic Re: IPSec VPN between CP1430 e CP3200 Drops randomly in General Topics

IPSec VPN between CP1430 e CP3200 Drops randomly

Luigi_Vezzoso1 — Thu, 30 Aug 2018 08:30:38 GMT

Hi Mates,

I have a lot of issue with a complex architecture composed by a couple of gateways CP3200 (in a clusterXL configuration) connected via VPN to many CP1430 (#40) remote gateway CP1430. Other notes: the remote gateway are behind layer-3 NAT device. the provider router NAT all necessary ports to the gateway external IP. In addition the remote gateways have two ISP connection.

The remote gateway are defined into the management as external managed gateway (they are managed from the Local WebUI)

The VPNs are fine and we can establish correctly the tunnels but we face with randomically tunnel dustruption and not always the tunnels comes up automatically in short time...

How can we debug this random disruption?
We already configure the permanent tunnels and tunnel test
what parameter/variable can cause the service disruption?

Best Regards##

Re: IPSec VPN between CP1430 e CP3200 Drops randomly

Danny — Thu, 30 Aug 2018 08:51:31 GMT

How to debug VPN issues on Security Gateway 80 / 600 / 700 / 1100 / 1200R / 1400 appliances

How to run complete VPN debug on Security Gateway to troubleshoot VPN issues?

How to generate a valid VPN debug, IKE debug and FW Monitor

Debugging Site-to-Site VPN

Are you using R80.10 with the included Multi-Core VPN hotfix?

Are you using HA or LS ClusterXL mode?

Why did you decide to locally manage the 1400 appliances?

Are you using certificate based VPN or pre-shared key?

Which 1400 firmware are you using?

Does the external IP address of the NAT gateway change or is is static?

How are the 1400 appliances configured in SmartDashboard (Dynamic IP or static)?

I general what you experience is very typical for SMB appliances behind NAT devices trying to mimic permanent functionalities as if they were enterprise firewalls, which they are not. Try to get the external IP address onto the 1400's WAN interfaces and you'll experience much better VPN stabilities.

Re: IPSec VPN between CP1430 e CP3200 Drops randomly

G_W_Albrecht — Thu, 30 Aug 2018 09:29:50 GMT

Managing the 1430 remote gateways locally weakens them a lot, so to speak - this is not a good decision, and buying 730s instead would have also been half the price...

Re: IPSec VPN between CP1430 e CP3200 Drops randomly

Jerry — Thu, 30 Aug 2018 11:59:20 GMT

touch $FWDIR/conf/masters

vi $FWDIR/conf/masters

[Policy]
SMS1 (in case there are 2?)
SMS2

[Log]
LOG1 (Log server or SMS IP?)

LOG2

[Alert]
SMS1 etc.

[Backup]
SMS1 etc

cat $FWDIR/conf/masters

chattr +i $FWDIR/conf/masters
or chattr -i $FWDIR/conf/masters

have you got that set on your Remote Gateway(s) ?

Re: IPSec VPN between CP1430 e CP3200 Drops randomly

Luigi_Vezzoso1 — Thu, 30 Aug 2018 13:18:36 GMT

Hi,

we still use the R77.30 on the HQ and R77.20.80 (990172392) on the remote Site
the remote sites are standalone appliances!! Only the HQ is in ClusterXL
we are using Local Management on remote sites because we had some issue managing them centrally from their external public IPs.
the VPN are made using pre-shared key
external router IPs are static
in the SmartDashboard the 1400 appliances are configured in as static with multiple internet links

Best regards

Re: IPSec VPN between CP1430 e CP3200 Drops randomly

Luigi_Vezzoso1 — Thu, 30 Aug 2018 13:20:16 GMT

Hi,

why are you saying that using local management weak them a lot? can you elaborate a bit more?

Best Regards

Re: IPSec VPN between CP1430 e CP3200 Drops randomly

Luigi_Vezzoso1 — Thu, 30 Aug 2018 13:21:00 GMT

Hi,

I thint those setting are used only for Central Managed gateways. Isn't it?

Re: IPSec VPN between CP1430 e CP3200 Drops randomly

Jerry — Thu, 30 Aug 2018 13:35:08 GMT

correct sorry if I misleaded you yes you’re right

Re: IPSec VPN between CP1430 e CP3200 Drops randomly

G_W_Albrecht — Thu, 30 Aug 2018 13:53:02 GMT

Yes - you have a lot of them, some examples:

- very limited rulebase (compared to Dashboard)

- no granular IPS comfiguration is possible (same is true of other TP config details)

- no 'bypass' or 'whitelist' rules for https inspection

- no Inbound HTTPS Inspection

- no MEP is possible

- limitations on the number of S2S tunnels

And yes, you pay double the price for the same features...

Re: IPSec VPN between CP1430 e CP3200 Drops randomly

Luigi_Vezzoso1 — Thu, 30 Aug 2018 15:12:20 GMT

tks.

Re: IPSec VPN between CP1430 e CP3200 Drops randomly

G_W_Albrecht — Fri, 31 Aug 2018 07:42:46 GMT

Are the remote GWs at least logging to the central SMS ? Then you could see logs that point to the reason of the issue. Debugs are difficult if the issue only appears randomly and can not be replicated in a short time span.

Re: IPSec VPN between CP1430 e CP3200 Drops randomly

G_W_Albrecht — Mon, 03 Sep 2018 11:00:23 GMT

Another fact is that 14x0 SMBs managed by a CP SMS are using two processor cores, but if managed locally, only one core is used.

Re: IPSec VPN between CP1430 e CP3200 Drops randomly

Luigi_Vezzoso1 — Mon, 03 Sep 2018 12:08:58 GMT

Other usefull information.... on the IKE Debug I found:

Vendor ID Payload

Next Payload: NONE
Reserved: 0
Length: 00 14 (20)

VID Data:
40 48 b7 d5 6e bc e8 85 25 e7 de 7f 00 d6 c2
d3

Vendor: FRAGMENTATION

anyone know what is this message?

tks

Re: IPSec VPN between CP1430 e CP3200 Drops randomly

Luigi_Vezzoso1 — Thu, 06 Sep 2018 12:50:19 GMT

Just to be sure:

how I should define the external managed object on the smartdashboard? Should I put the PublicIP or the private (WAN) IP on the "General" field of the object?

Ho the tunneltest is impacted by the object definition?

Re: IPSec VPN between CP1430 e CP3200 Drops randomly

Luigi_Vezzoso1 — Thu, 06 Sep 2018 12:58:13 GMT

? why the management mode has impact on the core usage? Where I can find those kind of information/limitation on checkpoint documentation?

Re: IPSec VPN between CP1430 e CP3200 Drops randomly

G_W_Albrecht — Thu, 06 Sep 2018 13:17:38 GMT

This can all be found in Check Point 1100/1200R/1400 Appliances Centrally Managed Administration Guide R77.20.80.

Re: IPSec VPN between CP1430 e CP3200 Drops randomly

G_W_Albrecht — Thu, 06 Sep 2018 13:18:05 GMT

Sorry, no idea.

Re: IPSec VPN between CP1430 e CP3200 Drops randomly

Luigi_Vezzoso1 — Thu, 06 Sep 2018 13:22:05 GMT

I have configured them Locally Managed..... and I configure them on smart dashboard as external managed checkpoint gateways....

Re: IPSec VPN between CP1430 e CP3200 Drops randomly

G_W_Albrecht — Thu, 06 Sep 2018 13:50:22 GMT

Sorry, but i can not understand that - paying for a centrally managed device and using it as a crippled locally managed one...

Some of the differences managed/unmanaged are listed in sk105380 Check Point R77.20.xx for 600 / 700 / 1100 / 1200R / 1400 Appliance Features and Known Limitations.

Re: IPSec VPN between CP1430 e CP3200 Drops randomly

MartinZ — Wed, 01 Jul 2020 15:46:30 GMT

@Luigi_Vezzoso1we are seeing the same issue. Did you ever resolve this?