VPN S2S between CPX 6000 and CPX 1500

[fjulianom]

Hi experts,

Today it was imposible to setup a VPN S2S between a SG 6000 and a SMB SG 1500. The SG 6000 was managed by a SMS, and the SG 1500 was a standalone deployment. I configured the meshed VPN community on SG 6000, how do I define the SG 1500 object? As a interoperable device? Check Point Host? Gateway? Or externally managed VPN Gateway? I defined it as a interoperable device, and used a shared secret, as it was a third party VPN device, is this correct? Because I didn't find an option to use their CPX certificates. The tunnel remained in Phase 1:

A strange thing is with the "vpn tu" command, I saw an unknown peer (192.168.50.1), who is this peer?

At the SMB SG 1500 I saw this log:

And the strange thing is in the SG 6000, I see traffic I made with ping tests going through the VPN tunnel, which is fine, but the tunnel remains in phase 1:

Maybe the SMB SG 1500 device is not properly configured, I never configured one of them and it has some VPN options I didn't understand (i. e. peer ID for IKEv2).

Can someone shed some light on this? Please your help.

Regards,

Julián

[fjulianom]

Hi everyone,

Still investigating. One more question. How can I know which peer initiates the tunnel? How can I force what peer initiates the tunnel?

Regards,

Julián

[RS_Daniel]

Hello,

The vpn is started when some traffic is generated from any of the peers. So if the vpn is down, no traffic at all, yo do a ping from a host behind SG6000, so SG6000 will initiate the tunnel, and vice versa.

[RS_Daniel]

Hello,

About peer 192.168.50.1, it says it is a user, so some vpn client is connected and that office mode IP address was asigned. 

You should define the object as a externally managed vpn gateway.

About the log on 1500, you can check the problem are VPN domains not maching between the peers. Make sure the configuration about encryption domains are matching both sides.

About the log on SG1600. I know it should happen but it is very common that you see encrypt logs when the vpn is not fully operational yet. You should filter logs by action:"Key Install" and X.X.X.X where that is the public ip address of the remote peer.

So your problem are encryption domains, fix them and change the remote peer object to externally managed vpn gateway.

Regards

[fjulianom]

Hi RS_Daniel,

Many thanks for your answer. I will check and let you know.

Regards,

Julián

[the_rock]

Hey mate,

You can also run vpn tu tlist -p peer_ip command to see what it shows. Did you try running ike debug at all? Is it failing on phase 1 or 2 at the moment? If its phase 2, then as @RS_Daniel , that usually indicated enc domain issue.

Andy

[fjulianom]

Hi guys,

Finally I managed to set up the tunnel between the peers. It run OK for some days, but customer called me and sayed that the tunnel is not steady and had some disconnections. What I have made is to convert this tunnel in a permanent tunnel, and now I can see it in Logs & Monitor > Tunnel & User Monitoring > Permanent Tunnels. Also in SmartLog I can see UDP 4500 logs every 40 seconds between the peers, I guess this is a kind of keepalive to make it permanent. I would like to know if my configuration is OK for permanent tunnel.

This is for CPX 6000 side:

(Not sure what's the meaning of the red dots and grey rectangules...)

An this is for CPX 1500 side:

I don't find an option in the CPX 6000 to enable DPD... in CPX 1500 is a simple click as you see in the previous image.

Thanks in advance,

Julián

[Alex-]

Permanent tunnel will use tunnel_test (UDP/18234), if you want to use DPD there are modifications to be done.

Since both systems are CP, you could select the Check Point proprietary method on the Spark side and not DPD.

It's all explained here: Tunnel Management (checkpoint.com)

I believe you can also keep the Permanent tunnel option active for all gateways in the community in your case.

[Tom_Hinoue]

Did you have a chance to test the instructions in sk109139 ? How to configure Site-to-Site VPN between Locally Managed Embedded GAIA appliance and Centrally Mana...  which is a option to use CAs for VPN between Maintrain Gaia and a locally managed SMB gateway.