VPN behavior question: Break-before-make / Make-before-break

[ReinhardS]

Hi,

a customer asks how check point handles this behavior that you can configure with cisco or strongwan:

Break-before-make

This is the default behavior of the IKE daemon when reauthenticating an IKEv2 SA. It means that all IKE_SAs and CHILD SAs are torn down before recreating them. This will cause some interruptions during which no IPsec SAs are installed. If trap policies are used it could also trigger unnecessary acquires and hence duplicate IPsec SAs during that downtime. To prevent plaintext traffic from leaving the host appropriate firewall rules or drop policies may be used.

Make-before-break

This method first creates duplicates of the IKE SAs and all CHILD SAs overlapping with the existing ones and then deletes the old ones. This avoids interruptions but requires that both peers can handle overlapping SAs (e.g. in regards to virtual IPs, duplicate policies or updown scripts). It is supported for IKEv2 since version 5.3.0 but is disabled by default and may be enabled by explicitly setting

Any information available on that?

thanks

reinhard

[PhoneBoy · Accepted solution]

This SK suggests we are using Break Before Make: https://support.checkpoint.com/results/sk/sk171756 

[the_rock]

Thats superb question...I had guy dealing with Cisco ask that once when we were with escalation guy from CP trying to fix CP-Cisco VPN and what @PhoneBoy said was indeed the right assesment. Esc. guy gave that exact same sk.

Have an awesome weekend!