Site to site VPN - Not using ID_IPV4_ADDR as IKE ID

[Michael_Horne]

Hello All,

Is it possible on a Checkpoint Security Gateway to use something else besides an IP address is the IKE ID?

We are partnering with a 3rd Party that use a Sonic Firewall. For there configuration options it is select the IKE ID for Phase 1 as IP address, but also a domain or and email address format.

Under the Link Selection options, all we have is various options that can be used to determine what IP Address to select as the IKE ID.

There are reasons to do with failover between two Site to Site VPN tunnels, that cause us to now want to use the local public IP address. Each IPsec connection from our sites to the partner should use the same IKE ID, for the failover to be automatic on their end.

Regards,

Michael

[PhoneBoy · Accepted solution]

You can use FQDN.
See option 2 here: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

[Michael_Horne]

Thank you very much for the information. I forgot this SK exists! 

Since we are setting environment variables, this would affect all VPN tunnels on the security gateway, correct?

Many thanks,

Michael

[MartinTzvetanov]

When I was on a Checkpoint training the instructor said it's possible to use fqdn and ip based s2s vpn and you have to ask the support how to do it. This was 5 years ago and I don't remember if there is an sk how to do it by your own, so open a case and ask the support.

[PhoneBoy]

Believe so, yes.