CheckPoint Skyline for S2S monitoring against 3rd party sites

[Thomola]

Hello,

we are attempting to deploy a Skyline monitoring tool with the Grafana/Prometheus deployment. The default dashboards - e.g. Single Device / Devices overview works well, everything loads with data and such. Where we hit a bump is a monitoring of S2S VPNs, where we have encountered multiple different cases:

1.  Both tunnels are under our management server
2. One side is under our management server, one is against third party firewall - and traffic goes both ways
3. One side is under our management server, one is against third party firewall - and traffic goes only one way

Where we struggle is setting up probing against third parties, does not matter if its (Spoofed) ICMP or HTTPs. It seems more like SPI/SA monitoring then tunnel monitoring. It also seems like different values will be loaded depending if the community is set up as one tunnel per gateway / subnet / host.

I have searched far and wide for the answers but to no avail.

Do we need to setup a probe for each combination of subnet <-> subnet / host <-> host? Would it be better to change the tunnel configuration to Gateway <-> Gateway?

Does the probe need to have a status UP to report data? In some cases we have a probe shown as down but we see decrypted/encrypted traffic.

Does the third side need to allow ICMP/HTTP(s) probing for us to match the correct SPI/SA, as we have dozens to hundred S2S VPNs, this would take a significant chunk of time for negotiations with the 3rd party sides.

Thank you

EDIT: Moving question to the VPN section for more attention.

[Vincent_Bacher · Accepted solution]

Hi,

Without going into the actual question just yet, as I don’t do much VPN probing myself: I suggest you don’t post this question in the Skyline section, as the topic doesn’t get enough attention there. In my opinion, this is purely a VPN-related issue. Skyline would then only display the probe values if necessary.