- Products
- Learn
- Local User Groups
- Partners
-
More
Celebrate the New Year
With CheckMates!
Value of Security
Vendor Self-Awareness
Join Us for CPX 360
23-24 February 2021
Important certificate update to CloudGuard Controller, CME,
and Azure HA Security Gateways
How to Remediate Endpoint & VPN
Issues (in versions E81.10 or earlier)
Mobile Security
Buyer's Guide Out Now
Important! R80 and R80.10
End Of Support around the corner (May 2021)
When you do VPN TU and select , say option 1
Peer 11.27.106.218 SAs:
1. IKE SA <b4ce6d95oc62e935,3f7248d932f017d3>:
2. IKE SA <f12ca4613c564c2b,09001dcf0ca41373>:
Peer 15.74.27.48 SAs:
1. IKE SA <11282929er737d23,35a68bw4431fa043>:
Question 1: What are these alpha numeric numbers for and how can I decode them? whats the pupose of these? why are they alpha numeric? is it due to security?
Question 2: Why first peer has 2 IKE SA entries and the other one has only one?
Any help would be appreciated.
Could you explain what is the final goal here? What you would like to check?
1.
SPI: the 32-bit value used to distinguish among different SAs terminating at the same destination and using the same IPsec protocol.
2.
Each IPSec peer agrees to set up SAs consisting of policy parameters to be used during the IPSec session. The SAs are unidirectional for IPSec, so that peer 1 will offer peer 2 a policy. If peer 2 accepts this policy, it will send that policy back to peer 1. This establishes two one-way SAs between the peers. Two-way communication consists of two SAs, one for each direction.
Could you explain what is the final goal here? What you would like to check?
1.
SPI: the 32-bit value used to distinguish among different SAs terminating at the same destination and using the same IPsec protocol.
2.
Each IPSec peer agrees to set up SAs consisting of policy parameters to be used during the IPSec session. The SAs are unidirectional for IPSec, so that peer 1 will offer peer 2 a policy. If peer 2 accepts this policy, it will send that policy back to peer 1. This establishes two one-way SAs between the peers. Two-way communication consists of two SAs, one for each direction.
Thanks Aleksei for your help.
To answer your question, I would like to know the phase 2 encryption domains from the cli that are being configured (local and remote encryption domain).
That can be checked by enabling vpn debug and looking into ke.elg during key exchange. You cannot check that once SA is formed.
Also, answer to your original question is "neither", but Alexey has covered that already
Thanks
In another thread you asked for this command and there was an answer about different options of CLI commands. Do they all not work on your firewalls?
1) https://community.checkpoint.com/docs/DOC-2214-common-check-point-commands-ccc
fw tab -f -t vpn_routing -u 2>&1 | grep Peer: | cut -d ';' -f8 | cut -c 8- | sort -ng | uniq | xargs -I % sh -c 'echo; tput sgr0; echo -n VPN Gateway: ; tput setaf 1; echo -e %; tput sgr0; echo -e Routing: ; tput setaf 2; fw tab -f -t vpn_routing -u 2>&1 | grep % | grep -o 'From.*Peer' | cut -c 6- | rev | cut -c 7- | rev' | sed 's/; To:/ -/g'; tput sgr0
echo -e "\033[0m####################\n# VPN Routing #\n####################";fw tab -f -t vpn_routing -u 2>&1 |grep -v "+"| awk '{split($0,a,";"); print a[8]}' |sort -ng |uniq | awk '{split($0,a," "); print a[2]}' | xargs -I % sh -c 'echo -n "External Gateway: ";echo -e "\033[0;31m % \033[37m";echo -e " Routing: \033[32m";fw tab -f -t vpn_routing -u 2>&1 |grep % |awk '\''{split($0,b,";"); print b[6] b[7]}'\''| sed 's/From\://'| sed 's/To\:/-/'|sort -u ;echo -e "\033[0m" '
fw tab -t vpn_routing -u -f | awk '{ print $18 " " $19 " " $20 " " $21 " " $22 " " $23 }' | awk NF | sort -n
Hi Aleksei,
Many thanks for your reply.
I tried few of them already but they dont seem to work
[Expert@FW1-USA-A:0]# echo -e "\033[0m####################\n# VPN Routing #\n####################";fw tab -f -t vpn_routing -u 2>&1 |grep -v "+"| awk '{split($0,a,";"); print a[8]}' |sort -ng |uniq | awk '{split($0,a," "); print a[2]}' | xargs -I % sh -c 'echo -n "External Gateway: ";echo -e "\033[0;31m % \\033[37m";echo -e " Routing: \033[32m";fw tab -f -t vpn_routing -u 2>&1 |grep % |awk '\''{split($0,b,";"); print b[6] b[7]}'\''| sed 's/From\://'| sed 's/To\:/-/'|sort -u ;echo -e "\033[0m" '
####################
# VPN Routing #
####################
[Expert@FW1-USA-A:0]# fw tab -t vpn_routing -u -f | awk '{ print $18 " " $19 " " $20 " " $21 " " $22 " " $23 }' | awk NF | sort -n
fw: Warning: Can't find ::CPSB-CTNT in cp.macro. License version might be not compatible
Warning: Can't find ::CPSB-CTNT in cp.macro. License version might be not compatible
Using cptfmt
Formatting table's data - this might take a while...
About CheckMates
Learn Check Point
Advanced Learning
WELCOME TO THE FUTURE OF CYBER SECURITY