vpn debug

Handles these VPN connections:

• All connections from non-IKE Remote Access clients (SSL Network Extender, Capsule VPN)

• Multi-Portal traffic (SSL / TLS) to a Security Gateway Dedicated Check Point server that runs Check Point software to inspect traffic and enforce Security Policies for connected network resources.

The VPN daemon on a Security Gateway listens on these ports:

• Tunnel Test: 18234 (UDP)

• L2TP: 1701 (UDP)

• Check Point RDP: 259 (UDP)

• Session infrastructure manager: 9996 (TCP)

The "vpnd" daemon is a child of the FWD daemon (see the $FWDIR/conf/fwauthd.conf file on a Security Gateway).

Introduced in the R81.10 version.

Handles these VPN connections:

• All connections from IKE Remote Access clients (for example, Endpoint clients)

• All IKE Site-to-Site connections from peer Security Gateways

• Large Scale VPN (LSV) connections

• Connections from SmartLSM ROBO gateways

Listens on these ports on a Security Gateway:

• IKE: 30500 - 30563 (UDP)

• IKE NAT-T: 34500 - 34563 (UDP)

• Tunnel Test: 48234 - 48297 (UDP)

• Check Point RDP: 30259 - 30322 (UDP)

• L2TP: 31701 - 31764 (UDP)

CLI Syntax to control the IKE daemon "iked":

vpn iked {status | enable | disable | calc <Peer IP address>}

Starting in R81.20, there can be a maximum of 64 instances of the "iked" daemon that are calculated based on this formula:

Number of IKED instances = (Number of CoreXL Firewall Instances) / (Value of Kernel Parameter 'ike_num_instances_per_daemon')

Note - You can configure different values for the kernel parameter 'ike_num_instances_per_daemon'.

Introduced in the R81.10 version.

Responsible for the Client Communication Channel (CCC) protocol, while:

• IKE for the same clients runs in the IKE daemon "iked"

• The TLS layer of the CCC protocol for the same clients runs in the VPN daemon "vpnd"

CLI Syntax to control the CCC daemon "cccd":

vpn cccd {status | enable | disable}

The "cccd" daemon is a child of the FWD daemon (see the $FWDIR/conf/fwauthd.conf file on a Security Gateway).

Step	Instructions
1	Connect to the command line on the Security Gateway / each Cluster Member Security Gateway that is part of a cluster..
2	Log in to the Expert mode.
3	Examine the current status: vpn iked status Possible outputs: vpn: 'iked' is enabled Means the IKE daemon iked is enabled (new mode available in R81.10 and higher). This is the default. There is nothing else to do. Stop this procedure. vpn: 'iked' is disabled Means the IKE daemon iked is disabled (legacy mode as works in R81 and lower). Proceed to the next step.
4	Enable the IKE daemon: vpn iked enable Important: This command makes the required changes in the $FWDIR/boot/modules/fwkern.conf file. This command fetches the local policy (this may disconnect your SSH session). This change survives reboot.