Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
obsidian11
Contributor

Site to site VPN drops with Dynamic DNS

Greetings,

I'm wondering what can cause this issue, I have 2 appliances (locally managed) from Check Point 700 Appliance family (730 & 790). On both of them, there is DDNS feature enabled (because those two are DAIP gateways - don't have static WAN IP), provider is no-ip.com and domains *.ddns.net successfully point to proper dynamic IPs.

When my friends and I try to establish site to site vpn between those peers, when we put IP addresses (dynamic ones) everything seems fine. However, when we put host names instead of those IPs, tunnel won't go up.

Has anyone run into the same problem?

P.S. Other settings are default ones (authentication: pre-shared secret; encryption: default etc.)

0 Kudos
4 Replies
G_W_Albrecht
Legend Legend
Legend

0 Kudos
obsidian11
Contributor

Honestly I didn't try this certificate based configuration (as I said, all other gateways are configured via pre-shared key for s2s vpn), but what I did after reading those 2 articles/guides was reinitializing certificates and now I have 2 scenarios..

There is always green checkmark (tunnels are up), but..

When I put hostname for the first gateway, and dynamic IP for the second gateway everything works fine.

However, if I put hostnames for both gateways, there is still green checkmark (signalizing that tunnel is up), but it's not working..

Any ideas why this happens? I mean configurations are almost same as other gateways from same appliances family.

0 Kudos
G_W_Albrecht
Legend Legend
Legend

Could be a NAT-T issue, see sk167116: In locally managed appliances, the parameter "vpn_force_nat_t" does not force NAT-T if the remote site is configured using a hostname. Refer to sk162472 for more information. 

CCSE / CCTE / CTPS / CCME / CCSM Elite / SMB Specialist
0 Kudos
obsidian11
Contributor

Thanks mate, I will take a look at those SKs and provide more information.

P.S. When I type

[Expert@appliance]# fw ctl get int vpn_force_nat_t
vpn_force_nat_t = 0

it's disabled on every appliance.

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events