- Products
- Learn
- Local User Groups
- Partners
- More
CheckMates Fifth Birthday
Celebrate with Us!
days
hours
minutes
seconds
Join the CHECKMATES Everywhere Competition
Submit your picture to win!
Check Point Proactive support
Free trial available for 90 Days!
As YOU DESERVE THE BEST SECURITY
Upgrade to our latest GA Jumbo
The 2022 MITRE Engenuity ATT&CK®
Evaluations Results Are In!
Now Available: SmartAwareness Security Training
Training Built to Educate and Engage
MITRE ATT&CK
Inside Check Point products!
CheckFlix!
All Videos In One Space
Commands | Descriptions |
---|---|
vpn tu | VPN utility, allows you to rekey vpn |
vpn ipafile_check ipassignment.conf detail | Verifies the ipassignment.conf file |
dtps lic | show desktop policy license status |
cpstat -f all polsrv | show status of the dtps |
vpn shell | Start the VPN shell |
vpn shell /tunnels/delete/IKE/peer/[peer ip] | delete IKE SA |
vpn shell /tunnels/delete/IPsec/peer/[peer ip] | delete Phase 2 SA |
vpn shell /show/tunnels/ike/peer/[peer ip] | show IKE SA |
vpn shell /show/tunnels/ipsec/peer/[peer ip] | show Phase 2 SA |
vpn shell show interface detailed [VTI name] | show VTI detail |
vpn debug ikeon|ikeoff | Debug IKE into $FWDIR/log/ike.elg. Analyze ike.elg with the IKEView tool |
vpn debug on|off | Debug VPN into $FWDIR/log/vpnd.elg. Analyze vpnd.elg with the IKEView tool |
vpn debug trunc | Truncate and stamp logs, enable IKE & VPN debug |
vpn drv stat | Show status of VPN-1 kernel module |
vpn overlap_encdom | Show, if any, overlapping VPN domains |
vpn macutil <user> | Show MAC for Secure Remote user <user> |
vpn ver [-k] | Check VPN-1 major and minor version as well as build number and latest hotfix. Use -k for kernal version |
Nice summary. Speaking about debug commands procedure is written in more SK articles. At least good one for start is the sk33327 - How to generate a valid VPN debug, IKE debug and FW Monitor
Good commands and lastly IKE Info Viewer is the best tool to troubleshoot VPN.
So looking at the information on the "IKEView Tool" in sk30994, it seems it can only display information captured in a debug. Is there a way to see in realtime the remaining key lifetimes on Phase1 and Phase2 SAs, or other details such as Phase2 SA local and remote identities? This could easily be done on ASA, but I can't seem to find it on Check Point gateways.
Same Question!
About CheckMates
Learn Check Point
Advanced Learning
YOU DESERVE THE BEST SECURITY