Question about VPN S2S Permanent Tunnel

[RemoteUser]

Hi Mates,
Simple question here:
Is the permanent tunnel feature for a site-to-site VPN is enabled via GuiDBEdit, or am I missing something?

[the_rock]

Hey brother,

No need, just enable it via tunnel management in community settings in smart console.

[RemoteUser]

But I remembered that sometimes I saw it done in GuiDBEdit as well. Under what circumstances should this be done?

[the_rock]

I believe ever since R80.30 or R80.40, its enabled automatically in guidbedit once you set it as permanent tunnel.

[RemoteUser]

ok thank you brother, i'll double check also with TAC

[the_rock]

Sure thing, though Im fairly positive thats the case.

[Tal_Paz-Fridman]

And you can obviously also use the relevant Management API commands:

https://sc1.checkpoint.com/documents/latest/APIs/index.html?#cli/add-vpn-community-meshed~v2.1%20

https://sc1.checkpoint.com/documents/latest/APIs/index.html?#cli/set-vpn-community-star~v2.1%20 

[PhoneBoy]

In R81, DPD became the default (i.e. not something you have to enable with guidbedit), as mentioned in Scenario 5 here: https://support.checkpoint.com/results/sk/sk108600 
Not sure if this applies if the management was upgraded from a pre-R81 release or not.

In any case, you still have to enable "Permanent Tunnels" in the relevant VPN community.

[RemoteUser]

Reading the admin guide here: https://sc1.checkpoint.com/documents/R82.10/WebAdminGuides/EN/CP_R82.10_SitetoSiteVPN_AdminGuide/Con...

It appears that a Permanent Tunnel can only be established when both peers in the site-to-site VPN are Check Point gateways.

In cases where the peer is a non–Check Point gateway, it is necessary to enable PDP (Permanent Tunnel via DPD). From what I understand, this configuration seems to require enabling it through GuiDBEdit.

Insight from the guide:

Permanent Tunnels can only be established between Check Point Security Gateways.
Dead Peer Detection (DPD) is a different method to test if VPN tunnels are active. Dead Peer Detection does support third-party Security Gateways and supports permanent tunnels with interoperable devices based on IKEv1/IKEv2 DPD (IKEv1 DPD is based on RFC 3706).

To enable DPD monitoring:

On each VPN gateway in the VPN community, configure the tunnel_keepalive_method property, in Database Tool (GuiDBEdit Tool) or dbedit (see skI3301). This includes third-party gateways. (You cannot configure different monitor mechanisms for the same gateway).

In Database Tool (GuiDBEdit Tool), go to Network Objects > network_objects > <Name of Security Gateways object> > VPN.

For the Value, select a permanent tunnel mode.

Save all the changes.

Install the Access Control Policy.

[the_rock]

Its true thats what it says, but in reality, it works fine with any other vendor and no need to change anything in guidbedit once you enable permanent tunnel setting.

[RemoteUser]

Hey, bro,
So why does the administrative guide mention it? I don't get it.

[Gil_Frantsus]

Hello,

We have updated the Site-to-Site VPN Admin Guide, removed the GuiDBedit instructions and added a note: 

 Starting in R81.20, when you create the interoperable device object for the 3rd Party VPN gateway, DPD is automatically set as the permanent tunnel method.

Thank you for your feedback.

[RemoteUser]

Hi @Gil_Frantsus thank you!

[PhoneBoy]

Sounds like an area where the documentation might need to be updated.
Tagging @Sergei_Shir