topic Re: QS 1530 Appliance IPSec test failing all the time in Spark Firewall (SMB)

QS 1530 Appliance IPSec test failing all the time

TecniSupp — Thu, 23 May 2024 11:50:27 GMT

Hello,

I'm having this strange issue. I have an IPSec tunnel working ok, all the encrypted domains of this VPN are able to communicate.

But what is strange is that when I try to test the tunnel it always fails...

I've attached a screenshot of it.

Only one site is using Checkpoint.

Re: QS 1530 Appliance IPSec test failing all the time

Chris_Atkinson — Thu, 23 May 2024 13:47:19 GMT

To help correlate with any potential known issues could you please confirm the firmware version/build?

Re: QS 1530 Appliance IPSec test failing all the time

TecniSupp — Thu, 23 May 2024 14:20:36 GMT

I've installed the latest firmware yesterday.

R81.10.10 (996002906)

It looks like the firewall is testing the tunnel with a route that it isn't from the IPSec tunnel.

Re: QS 1530 Appliance IPSec test failing all the time

TecniSupp — Thu, 23 May 2024 14:27:05 GMT

Updated yesterday to last firmware.

R81.10.10 (996002906)

Re: QS 1530 Appliance IPSec test failing all the time

G_W_Albrecht — Thu, 23 May 2024 14:46:50 GMT

Is the tunnel initiated from the peer GW ? There are configurations that only work this way, and here the tunnel test will fail as the peer must initiate the VPN...

Re: QS 1530 Appliance IPSec test failing all the time

TecniSupp — Thu, 23 May 2024 14:49:29 GMT

No, it starts from the Checkpoint.

I also have a router 1st and the checkpoint next, so my checkpoint is in NAT.

Re: QS 1530 Appliance IPSec test failing all the time

TecniSupp — Fri, 24 May 2024 14:09:31 GMT

So it needs to be initiated by the peer for the tunnel test to work? It doesn't make sense to me.

The test must be using ping to check the connection. One thing that I've noticed was that even the ping tool won't ping the other side. Also when I try to configure a DC on the checkpoint it also won't let me finish the configuration, it fails with communication error.

Checkpoint must be using an IP that is not in the local encryption domain and that is why it fails, this is my guess.