topic Re: VPN TU HASH OR HEX in General Topics

VPN TU HASH OR HEX

jessica_smith — Fri, 19 Oct 2018 07:22:13 GMT

When you do VPN TU and select , say option 1

Peer 11.27.106.218 SAs:

1. IKE SA <b4ce6d95oc62e935,3f7248d932f017d3>:

2. IKE SA <f12ca4613c564c2b,09001dcf0ca41373>:

Peer 15.74.27.48 SAs:

1. IKE SA <11282929er737d23,35a68bw4431fa043>:

Question 1: What are these alpha numeric numbers for and how can I decode them? whats the pupose of these? why are they alpha numeric? is it due to security?

Question 2: Why first peer has 2 IKE SA entries and the other one has only one?

Any help would be appreciated.

Re: VPN TU HASH OR HEX

AlekseiShelepov — Fri, 19 Oct 2018 07:57:05 GMT

Could you explain what is the final goal here? What you would like to check?

SPI: the 32-bit value used to distinguish among different SAs terminating at the same destination and using the same IPsec protocol.

Each IPSec peer agrees to set up SAs consisting of policy parameters to be used during the IPSec session. The SAs are unidirectional for IPSec, so that peer 1 will offer peer 2 a policy. If peer 2 accepts this policy, it will send that policy back to peer 1. This establishes two one-way SAs between the peers. Two-way communication consists of two SAs, one for each direction.

Re: VPN TU HASH OR HEX

jessica_smith — Fri, 19 Oct 2018 11:31:49 GMT

Thanks Aleksei for your help.

To answer your question, I would like to know the phase 2 encryption domains from the cli that are being configured (local and remote encryption domain).

Re: VPN TU HASH OR HEX

_Val_ — Fri, 19 Oct 2018 12:06:39 GMT

That can be checked by enabling vpn debug and looking into ke.elg during key exchange. You cannot check that once SA is formed.

Also, answer to your original question is "neither", but Alexey has covered that already

Re: VPN TU HASH OR HEX

AlekseiShelepov — Fri, 21 Jun 2019 09:22:21 GMT

In another thread you asked for this command and there was an answer about different options of CLI commands. Do they all not work on your firewalls?

1) https://community.checkpoint.com/docs/DOC-2214-common-check-point-commands-ccc

2) Show VPN Routing on CLI

echo -e "\033[0m####################\n# VPN Routing #\n####################";fw tab -f -t vpn_routing -u 2>&1 |grep -v "+"| awk '{split($0,a,";"); print a[8]}' |sort -ng |uniq | awk '{split($0,a," "); print a[2]}' | xargs -I % sh -c 'echo -n "External Gateway: ";echo -e "\033[0;31m % \033[37m";echo -e " Routing: \033[32m";fw tab -f -t vpn_routing -u 2>&1 |grep % |awk '\''{split($0,b,";"); print b[6] b[7]}'\''| sed 's/From\://'| sed 's/To\:/-/'|sort -u ;echo -e "\033[0m" '

3) Tim Hall's comment

fw tab -t vpn_routing -u -f | awk '{ print $18 " " $19 " " $20 " " $21 " " $22 " " $23 }' | awk NF | sort -n

Re: VPN TU HASH OR HEX

jessica_smith — Fri, 19 Oct 2018 15:07:40 GMT

Hi Aleksei,

Many thanks for your reply.

I tried few of them already but they dont seem to work

[Expert@FW1-USA-A:0]# echo -e "\033[0m####################\n# VPN Routing #\n####################";fw tab -f -t vpn_routing -u 2>&1 |grep -v "+"| awk '{split($0,a,";"); print a[8]}' |sort -ng |uniq | awk '{split($0,a," "); print a[2]}' | xargs -I % sh -c 'echo -n "External Gateway: ";echo -e "\033[0;31m % \\033[37m";echo -e " Routing: \033[32m";fw tab -f -t vpn_routing -u 2>&1 |grep % |awk '\''{split($0,b,";"); print b[6] b[7]}'\''| sed 's/From\://'| sed 's/To\:/-/'|sort -u ;echo -e "\033[0m" '
####################
# VPN Routing #
####################

[Expert@FW1-USA-A:0]# fw tab -t vpn_routing -u -f | awk '{ print $18 " " $19 " " $20 " " $21 " " $22 " " $23 }' | awk NF | sort -n
fw: Warning: Can't find ::CPSB-CTNT in cp.macro. License version might be not compatible
Warning: Can't find ::CPSB-CTNT in cp.macro. License version might be not compatible
Using cptfmt
Formatting table's data - this might take a while...

Re: VPN TU HASH OR HEX

jessica_smith — Fri, 19 Oct 2018 15:09:19 GMT

Thanks