Check Point VPN-1 NG

Gateway-to-Gateway IPsec-VPN with BinTec routers

Contents

• Get IPsec License From BinTec
• Install latest available IPsec firmware on a BinTec router
  
• Install and check IPsec license on a BinTec router
  
• Support matrix of IKE/IPsec encryption and integrity methods between BinTec router and Check Point VPN-1
  
• Debugging on a BinTec router
• Debugging on a Check Point VPN-1 NG
  

Follow-ups

• Example for a setup using pre-shared secrets in IKE authentication
• Example for a setup using public/private keys (certificates) in IKE authentication

Get IPsec license from BinTec

• License Serial Number (included in IPsec software package)
  
• PIN code (included in IPsec software package)
• Hardware Serial Number (from your device)
  

• Device related key (needed later for activiation)
• URLs to the IPsec enabled system software for downloading
  

Install latest available IPsec firmware on a BinTec router

Retrieve current version of running firmware

• Always working method
  

x1200:> swversion
biboAdmSWVersion( ro):  "V.6.3 Rev. 4 (Patch 8) IPSec V. 2.1.1 from 2003/10/02 00:00:00"

• Since release 6.3 this can be retrieved in a second way, too
  

x1200:> show rev
Logik    :      V.2.1
Bootmon  :      V.6.1.2
Boss     :      V.6.3 Rev. 4 (Patch 8) IPSec V. 2.1.1 from 2003/10/02 00:00:00

Install and check IPsec license

• License Serial Number (included in IPsec software package)
• Device related Key (from registration process above)

1. Login via serial console or telnet
2. Start setup tool
3. Goto Licenses menu
4. Select Add
5. Fill-in Serialnumber (included in IPsec software package)
6. Fill-in Key (from registration process above)
7. Select Save

X1200 Setup Tool                                    BinTec Access Networks GmbH
[LICENSE]: Licenses                                                       x1200
_______________________________________________________________________________

   Available Licenses:
     IP (builtin), IPSEC, CAPI


   Software License ID: X1B*******

   Serialnumber        Used for                  Description      State
   default             Software                  easy licensing   ok
   X1BIPS******        Software                  IPSEC            ok

     ADD                 DELETE              EXIT
_______________________________________________________________________________

Non-IPsec related configuration of a BinTec router

Support matrix of IKE/IPsec encryption and integrity methods between BinTec router and Check Point VPN-1.

IKE encryption methods

IKE integrity methods

IKE authentication methods

IKE Diffie-Hellman Groups and Perfect Forward Secrecy

Payload encryption methods

Payload integrity and compression methods

Debugging on a BinTec router

Packet sniffing

Examples

x1200:> trace -i en3-0

x1200:> trace -i -d 00:A0:F9:**:**:** -o -s 00:A0:F9:**:**:** en3-0

IKE

• Show global IPsec settings

x1200:> ipsecglobals
...
ipsecGlobMaxSysLogLevel( rw):                  err
...

• Enable logging of priority debug and more
  

x1200:> ipsecGlobMaxSysLogLevel=debug
ipsecGlobMaxSysLogLevel( rw):        debug

• Enable logging of IKE, values from 1..12 are possible, according to BinTec support, 3..6 are useful
  

x1200:> ipsecGlobContIkeLoggingLevel=6
00: ipsecGlobContIkeLoggingLevel( rw):        6

Debugging on a Check Point VPN-1 NG

Packet sniffing

IKE

• Enable IKE debug log
  

# vpn debug ikeon

• Inspect the (new generated) IKE log file for hints and information what's going on
  

# tail -f /opt/CPfw1-50-04/log/ike.elg