Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
StackCap43382
Contributor

How to configure S2S VPN Responder Only?

Jump to solution

Hi All,

Have a bit of a strange issue I'm hoping someone has an answer for.

Basically we have a situation where there is a 3rd party NAT device breaking VPN connectivity to a peer.

If the peer initiates the tunnel then the VPN comes up

If our side attempts it then it all goes wrong.

There is 0% chance of any config changes to the remote peer side so we are stuck with this.

There are also other VPNS terminating on our Check Points.

A fudge-fix is to stop our side attempting to bring up the tunnel and respond only but I cant find any articles how to do this on a Check Point.

 

Can anyone point me to a relevant article?

Is Responder Mode supported on a Check Point?

Is if it is it global or can it be peer-limited?

 

Cheers

 

 

 

1 Solution

Accepted Solutions
StackCap43382
Contributor

Hi All,

DAIP object is the answer:

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

By configuring the 3rd party as a DIAP we force the Check Point to responder mode only. 

View solution in original post

5 Replies
Jose_Manuel_Gar
Participant

Hello,

There is an sk that works with DAIP SMB devices. It's SK101911. Not sure if it works with 3rd party peers but you can try.

 

Best regards

PhoneBoy
Admin
Admin
  • IKE Initiation Prevention - By default, when a valid IKE SA is not available, a DPD request message triggers a new IKE negotiation. To prevent this behavior, set the property dpd_allowed_to_init_ike to false.

    Edit the property in GuiDBedit Tool (see sk13009) > Network Objects > network_objects > <gateway Name> > VPN.

Juancho
Contributor

Hi Dameon,

Regarding S2S Responder Only.  Would it be an option to increase P1 lifetime just on ckp side?

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

According to this sk at least.

All my engineer life i've tried to match both values on both ends but it seems now to be a value only valid locally?

Or maybe is it just for IkeV2 implementations?

 

 

 

Azure also states:

https://docs.microsoft.com/en-us/azure/vpn-gateway/ipsec-ike-policy-howto

"The SA lifetimes are local specifications only, do not need to match."

0 Kudos
PhoneBoy
Admin
Admin

I would say: try it and report back.
Yes, historically we've suggested that VPN parameters should match, and in some cases they need to.

0 Kudos
StackCap43382
Contributor

Hi All,

DAIP object is the answer:

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

By configuring the 3rd party as a DIAP we force the Check Point to responder mode only. 

View solution in original post