Any interruption if I add the interesting traffic into the existing site2site tunnel

[garywu]

I would like to add the new interesting traffic into the existing IPsev VPN tunnel. However, I afraid that it will trigger service interruption, does anyone have experience on this?

The site to site VPN forms between "R75.40 Gaia Checkpoint" and "Oracle Cloud".

[Bob_Zimmerman]

IPSec VPNs are negotiated by the gateways for pairs of endpoints. An "endpoint" in this context can be a single host or a network (including the network 0.0.0.0/0, which includes all IPv4 addresses).

Traffic between existing endpoints on a new port won't change anything about the negotiation. You may need to update some rules to get the traffic to go over the VPN.

Adding a new endpoint on either side will result in new negotiations, but should not change existing negotiations. You would need to update both sides with knowledge of the new endpoint, but the negotiation parameters should be applied at the gateway level, so should not need to be changed.

The exception to this is supernetting. Check Point sometimes combines nearby endpoints into a larger network which encompasses both. This lets the firewall negotiate and track fewer keys. I have only seen this affect endpoints which are adjacent to one another as defined in the encryption domain. That is, 10.20.30.0/24 and 10.20.31.0/24 might be combined into 10.20.30.0/23, but 10.20.30.0/24 and 10.20.32.0/24 would not be combined.



Be sure to enable IKE debugging (vpn debug ikon) at least 24 hours before making VPN changes. This will let it record your existing, working negotiations. If the changes break something, you can use IKEView to see what changed.