In This Section: |
The VPN tunnel transports data securely. You can manage the types of tunnels and the number of tunnels with these features:
See the status of all VPN tunnels in SmartView Monitor. For details see Monitoring Tunnels in the R80.10 Logging and Monitoring Administration Guide.
As companies have become more dependent on VPNs for communication to other sites, uninterrupted connectivity has become more crucial than ever before. Therefore it is essential to make sure that the VPN tunnels are kept up and running. Permanent Tunnels are constantly kept active and as a result, make it easier to recognize malfunctions and connectivity problems. Administrators can monitor the two sides of a VPN tunnel and identify problems without delay.
Each VPN tunnel in the community may be set to be a Permanent Tunnel. Since Permanent Tunnels are constantly monitored, if the VPN tunnel is down, then a log, alert, or user defined action, can be issued. A VPN tunnel is monitored by periodically sending "tunnel test" packets. As long as responses to the packets are received the VPN tunnel is considered "up." If no response is received within a given time period, the VPN tunnel is considered "down." Permanent Tunnels can only be established between Check Point Security Gateways. The configuration of Permanent Tunnels takes place on the community level and:
In a Multiple Entry Point (MEP) environment, VPN tunnels that are active are rerouted from the predefined primary Security Gateway to the backup Security Gateway if the primary Security Gateway becomes unavailable. When a Permanent Tunnel is configured between Security Gateways in a MEP environment where RIM is enabled, the satellite Security Gateways see the center Security Gateways as "unified." As a result, the connection will not fail but will fail over to another center Security Gateway on a newly created permanent tunnel. For more information on MEP see Multiple Entry Point VPNs.
Check Point uses a proprietary protocol to test if VPN tunnels are active, and supports any site-to-site VPN configuration. Tunnel testing requires two Security Gateways, and uses UDP port 18234. Check Point tunnel testing protocol does not support 3rd party Security Gateways.
Once a Permanent Tunnel is no longer required, the tunnel can be shut down. Permanent Tunnels are shut down by deselecting the configuration options to make them active and re-installing the policy.
In addition to Tunnel Testing, Dead Peer Detection (DPD) is a different method to test if VPN tunnels are active. Dead Peer Detection does support 3rd party Security Gateways and supports permanent tunnels with interoperable devices based on IKEv1/IKEv2 DPD (IKEv1 DPD is based on RFC 3706). It uses IPsec traffic patterns to minimize the number of messages required to confirm the availability of a peer.
The tunnel testing mechanism is the recommended keepalive mechanism for Check Point to Check Point VPN gateways because it is based on IPsec traffic and requires an IPsec established tunnel. DPD is based on IKE encryption keys only.
DPD has two modes:
In this mode the Check Point gateway sends the IKEv1 DPD Vendor ID to peers, from which the DPD Vendor ID was received.
To enable DPD Responder Mode:
ckp_regedit -a SOFTWARE/CheckPoint/VPN1 forceSendDPDPayload -n 1
To disable DPD Responder Mode:
ckp_regedit -d SOFTWARE/CheckPoint/VPN1 forceSendDPDPayload
Note - Enable the keep_IKE_SAs property in SmartConsole to prevent a problem, where the Check Point gateway deletes IKE SAs. The DPD mechanism is based on IKE SA keys. In some situations, the Check Point gateway deletes IKE SAs and a peer, usually a 3rd Party gateway, sends DPD requests without response and concludes that the Check Point gateway is down. The peer can then delete the IKE and IPsec keys, which causes encrypted traffic from the Check Point gateway to be dropped by the remote peer.
DPD can monitor remote peers with the permanent tunnel feature. All related behavior and configurations of permanent tunnels are supported.
To configure DPD for a permanent tunnel, the permanent tunnel must be in the VPN community. After you configure the permanent tunnel, configure Permanent Tunnel mode Based on DPD. There are different possibilities for permanent tunnel mode:
Note: To use this mode for only some gateways, enable the forceSendDPDPayload
registry key on Check Point remote peers.
To enable DPD monitoring:
On each VPN gateway in the VPN community, configure the tunnel_keepalive_method property, in GuiDBedit Tool (see sk13009) or dbedit (see skI3301). This includes 3rd Party gateways. (You cannot configure different monitor mechanisms for the same gateway).
Optional Configuration
Edit the property in GuiDBedit Tool (see sk13009) > Network Objects > network_objects > <gateway Name> > VPN.
To disable this feature, set the DPD_DONT_DEL_SA environment variable to 0:
cpstop
export DPD_DONT_DEL_SA=0
cpstart
$CPDIR/tmp/.CPprofile.sh file
:DPD_DONT_DEL_SA=0 ; export DPD_DONT_DEL_SA
Note - To re-enable the feature, remove the DPD_DONT_DEL_SA environment variable.
For a VPN community, the VPN tunnel sharing configuration is set on the Tunnel Management page of the Community Properties window.
For a specific Security Gateway, the configuration is set on the VPN Advanced page of the Security Gateway properties window.
VPN Tunnel Sharing provides greater interoperability and scalability by controlling the number of VPN tunnels created between peer Security Gateways. Configuration of VPN Tunnel Sharing can be set on both the VPN community and Security Gateway object.
In case of a conflict between the tunnel properties of a VPN community and a Security Gateway object that is a member of that same community, the "stricter" setting is followed. For example, a Security Gateway that was set to One VPN Tunnel per each pair of hosts and a community that was set to One VPN Tunnel per subnet pair, would follow One VPN Tunnel per each pair of hosts.
Tunnel test is a proprietary Check Point protocol used to see if VPN tunnels are active. Tunnel testing requires two Security Gateways and uses UDP port 18234. Third party gateways do not support tunnel testing.
To configure Tunnel Management options:
In the Star Community or Meshed community object, on the Tunnel Management page, select Set Permanent Tunnels. These are the options:
To configure all tunnels as permanent, select On all tunnels in the community. Clear this option to terminate all Permanent Tunnels in the community.
To configure on all tunnels of specific Security Gateways:
The Select Gateway window is displayed.
To terminate Permanent Tunnels connected to a specific Security Gateway, highlight the Security Gateway and click Remove.
To configure on specific tunnels in the community:
The Select Permanent Tunnels window opens.
The Tunnel Properties window is displayed.
To terminate the Permanent Tunnel between these two Security Gateways, clear Set these tunnels to be permanent tunnels.
In SmartConsole:
The Global Properties window shows.
The Advanced configuration window shows.
You can configure alerts to stay updated on the status of permanent VPN tunnels.
To configure logs and alerts for VPN tunnel status:
The alerts are configured for the tunnels that are defined as permanent, based on the settings on the page.
See status of all VPN tunnels in SmartView Monitor.
To open SmartView Monitor:
For more details, see Monitoring Tunnels in the R80.10 Logging and Monitoring Administration Guide.