Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Mike-H
Explorer
Jump to solution

Gateway appliances reliance on management server

Hello, 

We have a number of 1450's and 1570's connected in a site to site VPN to our primary co-lo VSX firewalls. These are also connected to an MDSM. Should the MDSM become unavailable for a period of time (+12 hours) we find that the 1450's and 1570's will fail to rekey thus taking down their VPN connection, which is less than ideal. 

Is this 'by design'/'unavoidable' or is there something we can do to prevent the gateways from dropping should the management server experience issues? 

Thanks

Mike

0 Kudos
1 Solution

Accepted Solutions
Timothy_Hall
Legend Legend
Legend

The VPN is going down because certificates are used for IKE Phase 1 authentication; when a rekey occurs the CRL must be retrieved from the SMS/MDS to ensure the certificate has not been revoked.  There is a cache for the CRL on the gateways that will help if the SMS/MDS is down for a short period, but if it is down long enough the cached CRL entries will expire and the VPN breaks at the next rekey.

You can extend the CRL cache timeout or even disable the CRL checking completely as described here:

https://community.checkpoint.com/t5/SMB-Gateways-Spark/How-does-SMB-gateway-CRL-fetching-work/m-p/19...

 

Gateway Performance Optimization R81.20 Course
now available at maxpowerfirewalls.com

View solution in original post

(1)
3 Replies
the_rock
Legend
Legend

I believe it used to be 24 hours, but might be different now. Is there anything you can do to prevent that? personally, I cant think of anything, because it relies on mgmt server for that sort of communication.

Andy

0 Kudos
Timothy_Hall
Legend Legend
Legend

The VPN is going down because certificates are used for IKE Phase 1 authentication; when a rekey occurs the CRL must be retrieved from the SMS/MDS to ensure the certificate has not been revoked.  There is a cache for the CRL on the gateways that will help if the SMS/MDS is down for a short period, but if it is down long enough the cached CRL entries will expire and the VPN breaks at the next rekey.

You can extend the CRL cache timeout or even disable the CRL checking completely as described here:

https://community.checkpoint.com/t5/SMB-Gateways-Spark/How-does-SMB-gateway-CRL-fetching-work/m-p/19...

 

Gateway Performance Optimization R81.20 Course
now available at maxpowerfirewalls.com
(1)
Mike-H
Explorer

Thank you, that makes sense. We will look to increase the CRL timeout. 

Much appreciated. 🙂 

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events