Gateway appliances reliance on management server

[Mike-H]

Hello, 

We have a number of 1450's and 1570's connected in a site to site VPN to our primary co-lo VSX firewalls. These are also connected to an MDSM. Should the MDSM become unavailable for a period of time (+12 hours) we find that the 1450's and 1570's will fail to rekey thus taking down their VPN connection, which is less than ideal. 

Is this 'by design'/'unavoidable' or is there something we can do to prevent the gateways from dropping should the management server experience issues? 

Thanks

Mike

[the_rock]

I believe it used to be 24 hours, but might be different now. Is there anything you can do to prevent that? personally, I cant think of anything, because it relies on mgmt server for that sort of communication.

Andy

[Timothy_Hall · Accepted solution]

The VPN is going down because certificates are used for IKE Phase 1 authentication; when a rekey occurs the CRL must be retrieved from the SMS/MDS to ensure the certificate has not been revoked.  There is a cache for the CRL on the gateways that will help if the SMS/MDS is down for a short period, but if it is down long enough the cached CRL entries will expire and the VPN breaks at the next rekey.

You can extend the CRL cache timeout or even disable the CRL checking completely as described here:

https://community.checkpoint.com/t5/SMB-Gateways-Spark/How-does-SMB-gateway-CRL-fetching-work/m-p/19...

[Mike-H]

Thank you, that makes sense. We will look to increase the CRL timeout. 

Much appreciated. 🙂