vpn debug

Background

Starting in R81.10, separate daemons handle different VPN connections:

• The VPN daemon vpnd.

  Handles these VPN connections:

  • Site-to-Site connections from peer Security Gateways with a Statically Assigned IP address

  • All connections from non-IPsec Remote Access clients (SSL Network Extender)

  • Multi-Portal traffic

  The VPN daemon on a Security Gateway Dedicated Check Point server that runs Check Point software to inspect traffic and enforce Security Policies for connected network resources. listens on these ports:

  • IKE: 500 (UDP)

  • IKE NAT-T: 4500 (UDP)

  • Tunnel Test: 18234 (UDP)

  • L2TP: 1701 (UDP)

  • Reliable Data Protocol (RDP): 259 (UDP)

  • Session infrastructure manager: 9996 (TCP)

  This process is a child of the FWD process (see the $FWDIR/conf/fwauthd.conf file on a Security Gateway).

• The IKE daemon iked (introduced in R81.10).

  Handles these VPN connections:

  • All connections from IKE Remote Access clients clients (for example, Endpoint clients)

  • Site-to-Site connections from peer Security Gateways with a Dynamically Assigned IP address (DAIP)

  • Large Scale VPN (LSV) connections

  • Connections from SmartLSM ROBO gateways

  Listens on these ports on a Security Gateway:

  • IKE: 30500 - 30563 (UDP)

  • IKE NAT-T: 34500 - 34563 (UDP)

  • Tunnel Test: 48234 - 48297 (UDP)

  • Reliable Data Protocol (RDP): 30259 - 30322 (UDP)

  • L2TP: 31701 - 31764 (UDP)

  CLI Syntax: vpn iked

  Starting in R81.20, there can be a maximum of 64 instances of the iked daemon that are calculated based on this formula:

  Number of IKED instances = (Number of CoreXL Firewall Instances) / (Value of Kernel Parameter 'ike_num_instances_per_daemon')

  Note - You can configure different values for the kernel parameter 'ike_num_instances_per_daemon'.

• The CCC daemon cccd (introduced in R81.10).

  Responsible for the Circuit Cross-Connect (CCC) protocol, while:

  • IKE for the same clients runs in the IKE daemon iked

  • CCC TLS for the same clients runs in the VPN daemon vpnd

  CLI Syntax: vpn cccd

  This process is a child of the FWD process (see the $FWDIR/conf/fwauthd.conf file on a Security Gateway).

Procedure

Step	Instructions
1	Connect to the command line on the Security Gateway / each Cluster Member Security Gateway that is part of a cluster..
2	Log in to the Expert mode.
3	Examine the current status: vpn iked status Possible outputs: vpn: 'iked' is enabled Means the IKE daemon iked is enabled (new mode in R81.10 and higher). This is the default. Proceed to the next step. vpn: 'iked' is disabled Means the IKE daemon iked is disabled (legacy mode as in R81 and lower). There is nothing to do.
4	Disable the IKE daemon: vpn iked disable Important This command makes the required changes in the $FWDIR/boot/modules/fwkern.conf file. This command installs the local policy, which can disconnect your SSH session. This change survives reboot.

To enable the IKE daemon iked after you disable it, run this command:

vpn iked enable

Important This command makes the required changes in the $FWDIR/boot/modules/fwkern.conf file. This command installs the local policy, which can disconnect your SSH session. This change survives reboot.

Procedure

Step	Instructions
1	Connect to the command line on the Security Gateway / each Cluster Two or more Security Gateways that work together in a redundant configuration - High Availability, or Load Sharing. Member.
2	Log in to the Expert mode.
3	Examine the current status: vpn cccd status Possible outputs: vpn: 'cccd' is enabled Means the CCC daemon cccd is enabled (new mode in R81.10 and higher). This is the default. Proceed to the next step. vpn: 'cccd' is disabled Means the CCC daemon cccd is disabled (legacy mode as in R81 and lower). There is nothing to do.
4	Disable the CCC daemon: vpn cccd disable Important This command makes the required changes in the $FWDIR/boot/modules/fwkern.conf file. This command installs the local policy, which can disconnect your SSH session. This change survives reboot.

To enable the CCC daemon cccd after you disable it, run this command:

vpn cccd enable

Important This command makes the required changes in the $FWDIR/boot/modules/fwkern.conf file. This command installs the local policy, which can disconnect your SSH session. This change survives reboot.

Description

This "vpn debug" command instructs the VPN daemon vpnd to write debug messages to these log files:

Debugging of the VPN daemon vpnd is based on Debug Topics and Debug Levels:

• A Debug Topic is a specific area, on which to perform debugging.

  For example, if the Debug Topic is LDAP, all traffic between the VPN daemon and the LDAP server is written to the log file.

  Check Point Support provides the specific Debug Topics when needed.

• Debug Levels range from 1 (least informative) to 5 (most informative - write all debug messages).

For more information, see sk180488.

In addition, see ike debug.

Syntax

Return Values

• 0 (zero) for success

• any other value for failure A hardware or software problem that causes a Security Gateway to be unable to serve as a Cluster Member (for example, one of cluster interface has failed, or one of the monitored daemon has crashed). Cluster Member that suffered from a failure is declared as failed, and its state is changed to Down (a physical interface is considered Down only if all configured VLANs on that physical interface are Down). (typically, -1 or 1)