Security Gateway IKEv2 issue

[Ihenock1011]

Hi All,

We have a Checkpoint R81.10 security gateway acting as a site-to-site VPN gateway. We are experiencing issues with IKEv2: although the tunnel is up, the encryption domains are unable to communicate. However, when we change the IKE version from IKEv2 to IKEv1 under the encryption parameters, the end hosts start to communicate via ping or telnet. What could be the issue?

Thanks

[Lesley]

In general IKEv2 is more ''strict'' , could be many reasons why it does not work.

First step would for be to check what the current jumbo take is of fw (cpinfo -y all)

If recent Jumbo is installed check firewall logs for errors related to this vpn.

Final step vpn debug

[Ihenock1011]

Dear @Lesley JHF 139, as I said no error the tunnel shows UP the problem is endpoints cannot able to communicate.

[Lesley]

Logs should give a tip, search for:

source: local ip, dst: remote IP (so from encryption domain IP to other side)

source: remote ip, dst: local IP (from local internal IP to remote encryption domain IP)

source: remote peer ip (of the other firewall)

destination: remote peer ip (of the other firewall)

Is there NAT or NAT-T in between? What vendor is on other side?

Give this one also a try:

https://support.checkpoint.com/results/sk/sk157473

[JozkoMrkvicka]

If you switch back to IKEv2, do you see "narrow" or "eclipsed" words in output from command "vpn tu tlist" for problematic VPN peer ?

If so, it might indicate that content of traffic selectors (encryption domains) is not 100% the same between CP and other VPN peer.

IKEv2 should better work if NAT-T is enabled.

It is also important to select correct setting on CP side related to "One VPN pair for gateway/subet/host"

[Ihenock1011]

The issue happens not only with one tunnel; it happens all the time with different site to site tunnels. I prefer using CheckMates over creating a TAC case with Check Point. I haven't seen a vendor take three days to respond to a direct premium customer.

[Lesley]

Sounds more like a you problem then a Check Point problem. You get many tips here and we get very limited reply back. If you behave the same way in TAC tickets then I understand why it takes long to reply. Maybe you should invest a bit more time to follow the feedback you get. 

[Ihenock1011]

I got a lot of tips here; that's why I prefer CheckMates over TAC support engineers. Since it is a production environment, I have to wait for the issue to happen again to check the commands. That is why I didn't reply to you earlier about the commands you sent. Thanks for your usual and unwavering support.