{"id":1671,"date":"2022-08-23T23:00:00","date_gmt":"2022-08-23T22:00:00","guid":{"rendered":"https:\/\/www.balajibandi.com\/?p=1671"},"modified":"2022-08-30T11:26:53","modified_gmt":"2022-08-30T10:26:53","slug":"site-to-site-vpn-phase2-issue-between-fortinet-and-checkpoint-r80-10","status":"publish","type":"post","link":"https:\/\/www.balajibandi.com\/?p=1671","title":{"rendered":"Site to Site VPN Phase2 issue Between Fortinet and Checkpoint R80.10"},"content":{"rendered":"\n

I was working one of the site to site VPN config.<\/p>\n\n\n\n

Most cases Checkpoint have some teethering issue with other vendor when we deploy VPN between CP and otehr vendors.<\/p>\n\n\n\n

I have come across some of this issue – in common practice Checkpoint side we use bunch of allowed IP’s in the encryption domain.<\/p>\n\n\n\n

in this case Fortinet coming with only set of ip address in the intresting traffic x.x.x.x\/15, which is not matching with Checkpoint.<\/p>\n\n\n\n

Phase1 come up as expected.<\/p>\n\n\n\n

\"\"
But Phase 2 Failed with below message as rejected.<\/figcaption><\/figure>\n\n\n\n
\"\"
here is troubleshooting tips (before we need to check the Logs, that taking Long time to identify the issue)<\/figcaption><\/figure>\n\n\n\n

Now checkpoint release ikeview tool<\/a> :<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Fortinet boxes are quite picky about what Proxy-IDs\/subnets they will accept in an IKE Phase 2 proposal sent by a Check Point.<\/p>\n\n\n\n

Steps :<\/p>\n\n\n\n

Initiate debug of VPND daemon on Check Point Security Gateway from the CLI:<\/p>\n\n\n\n

You need to get on to expert mode.<\/p>\n\n\n\n

To enable IKE debug mode, run in Expert mode on Security Gateway:
#vpn debug ikeon<\/em><\/strong><\/p>\n\n\n\n

To stop IKE debugging, run in Expert mode on Security Gateway:
#vpn debug ikeoff<\/em><\/strong><\/p>\n\n\n\n

Note:<\/strong> Enabling IKE debug mode has no resource impact on the Security Gateway. Check Point recommends disabling IKE debug mode when not in use, due to hard-drive space consideration.<\/p>\n\n\n\n

Logs will be stored in :<\/p>\n\n\n\n

$FWDIR\/log\/ike.elg<\/em> or $FWDIR\/log\/ikev2.xmll<\/em> or $FWDIR\/log<\/em>\/legacy_ikev2.xmll<\/p>\n\n\n\n

I have downloaded all 3 files locally and analysed with ikevtool.<\/p>\n\n\n\n

The logs show the issue as below :<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

before R80, we need to edit the user.def file to achieve this, but R80.10 onwards you can attached directly to VPN config specific IP address space.<\/p>\n\n\n\n

Instead of broad domain, i have matched x.x.x.x\/15, that fix the issue.<\/p>\n\n\n\n

Phase 1 and Phase 2 comeup as expected.<\/p>\n\n\n\n

Same Like cisco Forum, Checkpoint forum also very helpful to resolve the issue, and ikevtool(required permission to download) but good tool.<\/p>\n\n\n\n

Happy Labbbing…!!!!<\/p>\n","protected":false},"excerpt":{"rendered":"

I was working one of the site to site VPN config. Most cases Checkpoint have some teethering issue with other vendor when we deploy VPN between CP and otehr vendors. I have come across some of this issue – in common practice Checkpoint side we use bunch of allowed IP’s in the encryption domain. in […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1671","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/posts\/1671","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1671"}],"version-history":[{"count":3,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/posts\/1671\/revisions"}],"predecessor-version":[{"id":1702,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/posts\/1671\/revisions\/1702"}],"wp:attachment":[{"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1671"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1671"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1671"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}