Testing VPN phase1 and phase2

[Dor_Marcovitch]

hey,

i think a feature request for testing those configuration can have a good value for troubleshooting.

based on the security policy for example we might need to have someone on the other side to generate traffic, something we dont have 100%.

some test command can be useful to make the GW try to establish the vpn tunnel just for those parameter 

[JozkoMrkvicka]

Simple ping from one GW to the other one will cause that VPN will try to be established with relevant VPN configuration in place on both ends.

[Dor_Marcovitch]

this should work only if the GW is in the encryption domain

[JozkoMrkvicka]

Not really, the peer IP of GW (cluster IP) to be used for VPN itself is considered as valid part of VPN.

In case of VPN performance and best practises, see:

Best Practices - VPN Performance

Relative speeds of algorithms for IPsec and SSL

ATRG: VPN Core

[Timothy_Hall]

There doesn't seem to be a way to simulate a VPN peer initiating a IKE negotiation to your Check Point firewall, at least that I can see.  Once the tunnel is up (no matter who initiated it) it is a two-way street, but in an interoperable scenario sometimes there will be a IKEv1 Phase 2 subnet/Proxy-ID negotation failure if one side initiates the tunnel, but the other side can initiate it just fine.  Not much you can really do about this except have the VPN peer try to initiate to you and see what happens.