DAIP Gateways unavailable problem

[starmen2000]

Hi mates,

I have issue with DAIP Gateway. Smart console does not show the gateway as online or up, but when I try to view the status of DAIP with rs_db_tool command, then I can see the dynamic IP. But the problem is, SMS is trying to get connection with GW per port 18192 and no success. I do not know how to troubleshoot in that case?

[the_rock]

To help us out, do you have simple network diagram how you are connection all this? It would definitely make things bit easier...just put something together in MS paint, its fine. Is this regular S2S VPN tunnel?

Cheers,

Andy

[starmen2000]

Hi,

I just uploaded the topology below. s2s vpn looks down now. And last log from gw nodes are from 2 days ago. 

[the_rock]

You may need to do simple vpm commands to figure out why this is the case:

vpn tu tlist

vpn tu tlist -p peer_ip

vpn debug trunc

vpn debug ikeon

-generate some traffic

vpn debug ikeoff

Then look at ike.elg, as well as vpnd.elg* files in $FWDIR/log dir on the gateway

You can also run tcpdump -enni any host peer_ip and proto 50

Replace peer_ip with an actual IP address

Cheers,

Andy

[starmen2000]

But I did not get it. It is about the connection between mgmt_srv and gw with dynamic IP. Why do I need to troubleshoot the s2s vpn connection between central and satellite peers?

[the_rock]

Maybe I misunderstood. What is exact issue here? Vpn tunnel down or gateway state??

[starmen2000]

On the Smart Console DAIP Gateway looks that connection lost with the Gw. So that Gw can not fetch the policy from SMS. Similar issue on that link.   https://community.checkpoint.com/t5/Management/DAIP-gateways-with-quot-Not-available-quot-or-quot-Lo...  Last log from the gw was 2 days ago. 

[G_W_Albrecht]

This is another issue - in the provided link, policy pull is successfull. Consult CP TAC to get this resolved asap !