SMB host based (dynamic) IKEv2 S2S - Global Identifier bug

John_Fleming — Fri, 08 Nov 2019 16:01:55 GMT

Dear Abby,

In trouble shooting a hostname to hostname site to site vpn on a self manged 730, I found a typical strange checkpoint vpn issue. If the remote starts the connection the tunnel comes up fine. If the local 730 start the tunnel we get phase II failure. I checked and double checked the networks via ikeview (geez when can i stop using this?) and compared working to not working. What I found was the checkpoint would accept its name as listed in the global identified of the s2s config, but when the checkpoint initiates the tunnel it would advertise its name as its external IP address. I tried the override global identifier option with the correct name as well. Made no difference. Firewall is still ignoring this setting at sticking the external IP address as the identifier.

I don't have a support contract on this firewall but we have 3 CP1550s on the way so we'll check it out again then.

BTW this is a 730 running - R77.20.86 - Build 855

Re: SMB host based (dynamic) IKEv2 S2S - Global Identifier bug

PhoneBoy — Tue, 12 Nov 2019 20:56:57 GMT

This is most likely a bug that TAC would have to investigate.
Maybe updating to the latest firmware version would help also?

topic Re: SMB host based (dynamic) IKEv2 S2S - Global Identifier bug in Spark Firewall (SMB)

SMB host based (dynamic) IKEv2 S2S - Global Identifier bug

Re: SMB host based (dynamic) IKEv2 S2S - Global Identifier bug