Deactivate site-to-site VPN Tunnel

[Christoph]

Hello,

I was wondering, is there a simple way to deactivate a S2S tunnel without breaking it. Like a switch enabled/disabled for the other gateway or community object?

As I believe there is no such thing, I wanted to ask what would be the best way to "deactivate", aka breaking it, so that a person who is not proficient with the product, can "enable" it quickly, if needed.

Cheers

Christoph

[PhoneBoy]

The easiest way to do it is to remove the relevant gateways from the relevant VPN communities and push policy.

[Christoph]

If I remove the gateway, don't I lose the secrect? So if I want to re-enable the tunnel, the PSK has to be set anew, with all the bells and whistles attached.

[PhoneBoy]

I was thinking to remove the local gateway from the relevant encryption domain, not the remote one.
Shared secrets for external peers are defined in the relevant VPN Community.

[Christoph]

The MyIntranet community is a meshed one. If you configure a star community and add an external GW, you can set the PSK for the peer.

If you remove the external GW from the community, the peer in the shared secret section will vanish. If you re-add the exernal gateway the PSK is gone.

[PhoneBoy]

Try removing your local gateway (not the remote one) from the community. 

[JozkoMrkvicka]

You can try to use SAM rules from SmartView Monitor to block desired communication. 

Rule n.1:

Source: Any

Destination: affected VPN S2S peer IP

Service: Any

Rule n.2:

Source: affected VPN S2S peer IP

Destination: Any

Service: Any

These 2 rules should block all communication to/from affected VPN peer IP. If you need to allow it, simply remove SAM rules or set the time when the traffic should be enabled again.

[PhoneBoy]

That might be safest insofar as it doesn't touch the VPN configuration otherwise.
Finding/removing this (or a fwaccel dos rule) does require some knowledge about how to do it, since it won't be obvious from SmartConsole this will be necessary.

[the_rock]

Personally, I never heard of such a thing with any vendor actually. As Phoneboy said, you could delete the gateway from the community itself without removing the community, then simply disable the rule for that VPN.

Andy