Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Lesley
Advisor
Jump to solution

Site to site tunnels CP <-> other vendors. Possible to see overview?

Hi everyone,

I think most of us have seen the news regarding the Fortinet vulnerabilities. Regarding this topic I got a very specific question from a customer. They asked if it possible to see what vendor is running on the other side of a site to site VPN tunnel. Many VPN tunnels are running on this CP gateway so maybe it possible to see it somehow. I suspect it is not possible, but maybe there are some creative ideas. Also nice to discuss this topic here.

The only way I can think of is that sometimes a VPN debug shows info. For example Check Point shows up in a debug:

Vendor ID Payload

Next Payload: NONE
Reserved: 0
Length: 00 2c (44)

VID Data:

VIDData:
-
Product: Check Point VPN-1
Version: NG with Application Intelligence R55 or above


-------
If you like this post please give a thumbs up(kudo)! 🙂
0 Kudos
2 Solutions

Accepted Solutions
Gojira
Collaborator
Collaborator

Maybe run a VPN debug and then look for the "Vendor ID" payload in the IKE exchange as defined in:

https://www.rfc-editor.org/rfc/rfc2408.html#page-43

Check for one you know its fortigate and see if it matches others.

not sure it's documented what ID each vendor has or if the value is carved in stone or might change depending on the version for example.

Here are some IDs:
https://svn.nmap.org/nmap/nselib/data/ike-fingerprints.lua

View solution in original post

0 Kudos
the_rock
Legend
Legend
0 Kudos
7 Replies
Gojira
Collaborator
Collaborator

Maybe run a VPN debug and then look for the "Vendor ID" payload in the IKE exchange as defined in:

https://www.rfc-editor.org/rfc/rfc2408.html#page-43

Check for one you know its fortigate and see if it matches others.

not sure it's documented what ID each vendor has or if the value is carved in stone or might change depending on the version for example.

Here are some IDs:
https://svn.nmap.org/nmap/nselib/data/ike-fingerprints.lua

0 Kudos
the_rock
Legend
Legend

I believe as @Gojira had said, only debug might show you the info, otherwise, I doubt it. I know Danny Jung wrote some amazing scripts about vpn tunnels overview, will test them later to see if it gives any additional info.

Best,

Andy

0 Kudos
the_rock
Legend
Legend
0 Kudos
Lesley
Advisor

Hi Any,

Also checked but I get the following:

FROM <=> TO STATE VPN_COMMUNITY PEER_IP SOURCE_IP LINK_PRIORITY PROB_STATE PEER_TYPE VPN_TYPE
=============================================================================================================================================================
FW-NAME <=> gw-3party UP vpn-NAME REMOTE_IP LOCAL_IP Primary ? Regular Regular

 

How does your output look like? Had to remove some sensitive info above. 

Don't see a vendor ID?

Running R81.20 take 41

 

Lesley

-------
If you like this post please give a thumbs up(kudo)! 🙂
0 Kudos
the_rock
Legend
Legend

Hey Lesley,

I dont see field for vendor ID, but name is definitely there.

An(d) y 🙂

0 Kudos
Lesley
Advisor

Hi Andy,

You did the same!! 🙂 🙂 

Hey Lesey,

I dont see field for vendor ID, but name is definitely there.

 

---

My output is maybe different, to bad. I will proceed with the debug and collect the ID's.

Thanks again for the tips!

-------
If you like this post please give a thumbs up(kudo)! 🙂
0 Kudos
the_rock
Legend
Legend

I did, but I swear, it was NOT on purpose lol...I corrected it as soon as I noticed my mistake. I learned making sure peoples' names are spelled and pronounced correctly as sign of respect.

Best,

Andy

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    Tue 23 Apr 2024 @ 11:00 AM (EDT)

    East US: What's New in R82

    Thu 25 Apr 2024 @ 11:00 AM (SGT)

    APAC: CPX 2024 Recap

    Tue 30 Apr 2024 @ 03:00 PM (CDT)

    EMEA: CPX 2024 Recap

    Thu 02 May 2024 @ 11:00 AM (SGT)

    APAC: What's new in R82

    Tue 23 Apr 2024 @ 11:00 AM (EDT)

    East US: What's New in R82

    Thu 25 Apr 2024 @ 11:00 AM (SGT)

    APAC: CPX 2024 Recap

    Tue 30 Apr 2024 @ 03:00 PM (CDT)

    EMEA: CPX 2024 Recap

    Thu 02 May 2024 @ 11:00 AM (SGT)

    APAC: What's new in R82
    CheckMates Events