- CheckMates
- :
- Products
- :
- Quantum
- :
- SMB Gateways (Spark)
- :
- S2S-IPSEC-Tunnel not comming up without public DNS...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page
Are you a member of CheckMates?
×- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
S2S-IPSEC-Tunnel not comming up without public DNS server configured - why?
Hello Folks,
I have an IPSEC tunnel configured on the given platform (see below). The tunnel peer is defined by IP address, not hostname. Tunnel config is default, Check Point as remote gateway (same platform, firmware etc), perfect forward secrecy with DH Group 2, no NAT.
My problem is: The Tunnel won't come up without a public reachable DNS server configured as the primary DNS server under Device/ DNS/ "Configured DNS Servers".
Does anyone know this kind of behaviour and can provide an explanation, or is this a bug?
Thanks in advance.
Accepted Solutions
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It's possible this is covered by a known limitation listed here: Check Point R77.20 for 600 / 700 / 1100 / 1200R / 1400 Appliance Known Limitations
Specifically:
01668937 Configuring appliances with a DNS server that does not resolve publich domain names, may cause issues in various features, including timeouts during SIC establishment, log page not being responsive, and more. Make sure to configure DNS servers that can be reached from the appliance.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It's possible this is covered by a known limitation listed here: Check Point R77.20 for 600 / 700 / 1100 / 1200R / 1400 Appliance Known Limitations
Specifically:
01668937 Configuring appliances with a DNS server that does not resolve publich domain names, may cause issues in various features, including timeouts during SIC establishment, log page not being responsive, and more. Make sure to configure DNS servers that can be reached from the appliance.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello Dameon,
thanks for your response! I think that's it. The log page not beeing responsive is another phenomenon I noticed when no public DNS was defined.