Site to site tunnels CP <-> other vendors. Possible to see overview?

[Lesley]

Hi everyone,

I think most of us have seen the news regarding the Fortinet vulnerabilities. Regarding this topic I got a very specific question from a customer. They asked if it possible to see what vendor is running on the other side of a site to site VPN tunnel. Many VPN tunnels are running on this CP gateway so maybe it possible to see it somehow. I suspect it is not possible, but maybe there are some creative ideas. Also nice to discuss this topic here.

The only way I can think of is that sometimes a VPN debug shows info. For example Check Point shows up in a debug:

Vendor ID Payload

Next Payload: NONE
Reserved: 0
Length: 00 2c (44)

VID Data:

VIDData:
-
Product: Check Point VPN-1
Version: NG with Application Intelligence R55 or above

[Gojira · Accepted solution]

Maybe run a VPN debug and then look for the "Vendor ID" payload in the IKE exchange as defined in:

https://www.rfc-editor.org/rfc/rfc2408.html#page-43

Check for one you know its fortigate and see if it matches others.

not sure it's documented what ID each vendor has or if the value is carved in stone or might change depending on the version for example.

Here are some IDs:
https://svn.nmap.org/nmap/nselib/data/ike-fingerprints.lua

[the_rock]

I believe as @Gojira had said, only debug might show you the info, otherwise, I doubt it. I know Danny Jung wrote some amazing scripts about vpn tunnels overview, will test them later to see if it gives any additional info.

Best,

Andy

[the_rock · Accepted solution]

Just ran below and it showed the vendor.

Andy

https://community.checkpoint.com/t5/Scripts/One-liner-to-show-VPN-S2S-tunnels-on-gateway/m-p/150205#...

[Lesley]

Hi Any,

Also checked but I get the following:

FROM <=> TO STATE VPN_COMMUNITY PEER_IP SOURCE_IP LINK_PRIORITY PROB_STATE PEER_TYPE VPN_TYPE
=============================================================================================================================================================
FW-NAME <=> gw-3party UP vpn-NAME REMOTE_IP LOCAL_IP Primary ? Regular Regular

How does your output look like? Had to remove some sensitive info above. 

Don't see a vendor ID?

Running R81.20 take 41

Lesley

[the_rock]

Hey Lesley,

I dont see field for vendor ID, but name is definitely there.

An(d) y 🙂

[Lesley]

Hi Andy,

You did the same!! 🙂 🙂 

Hey Lesey,

I dont see field for vendor ID, but name is definitely there.

---

My output is maybe different, to bad. I will proceed with the debug and collect the ID's.

Thanks again for the tips!

[the_rock]

I did, but I swear, it was NOT on purpose lol...I corrected it as soon as I noticed my mistake. I learned making sure peoples' names are spelled and pronounced correctly as sign of respect.

Best,

Andy