topic Re: S2S-IPSEC-Tunnel not comming up without public DNS server configured - why? in Spark Firewall (SMB)

S2S-IPSEC-Tunnel not comming up without public DNS server configured - why?

Julius_Kaiser — Mon, 16 Oct 2017 12:17:05 GMT

Hello Folks,

I have an IPSEC tunnel configured on the given platform (see below). The tunnel peer is defined by IP address, not hostname. Tunnel config is default, Check Point as remote gateway (same platform, firmware etc), perfect forward secrecy with DH Group 2, no NAT.

My problem is: The Tunnel won't come up without a public reachable DNS server configured as the primary DNS server under Device/ DNS/ "Configured DNS Servers".

Does anyone know this kind of behaviour and can provide an explanation, or is this a bug?

Thanks in advance.

Appliance:Check Point 1430 Appliance (gro-aue-fw01)

Security Management:Locally managed

Version (Firmware):R77.20.40 (990171107)

Re: S2S-IPSEC-Tunnel not comming up without public DNS server configured - why?

PhoneBoy — Mon, 16 Oct 2017 18:50:56 GMT

It's possible this is covered by a known limitation listed here: Check Point R77.20 for 600 / 700 / 1100 / 1200R / 1400 Appliance Known Limitations

Specifically:

01668937
Configuring appliances with a DNS server that does not resolve publich domain names, may cause issues in various features, including timeouts during SIC establishment, log page not being responsive, and more. Make sure to configure DNS servers that can be reached from the appliance.

Re: S2S-IPSEC-Tunnel not comming up without public DNS server configured - why?

Julius_Kaiser — Tue, 17 Oct 2017 11:19:01 GMT

Hello Dameon,

thanks for your response! I think that's it. The log page not beeing responsive is another phenomenon I noticed when no public DNS was defined.