> Source: [sk176387](https://support.checkpoint.com/results/sk/sk176387)

# sk176387 - How to configure VPN Aggressive Mode in Locally Managed Spark Firewall

| Property | Value |
|----------|-------|
| Solution ID | sk176387 |
| Date Created | 2021-11-17 |
| Last Modified | 2022-07-12 |
| Technical Level | General |
| Products | Spark Firewall (Locally Managed) |
| Versions | R81.10.X |
| Platform | 1570R, 1500, 1600, 1800 |

## Solution

### Scenario 1- Configuring Aggressive Mode where the peer is a 3rd party DAIP using a NAT Device

Some vendors support a different NAT-Discovery payload(0x14) in which negotiation may fail.

A kernel flag was added to support this scenario on Check Point appliances.

**To enable the flag:**

Execute: `fw ctl set int vpn_aggressive_old_nat_d_id 1`

### Scenario 2 - Configuring Aggressive Mode where the peer is a 3rd party using DPD as a permanent tunnel(sends keep alive messages)

**To allow the gateway to reply to keep alive messages**:

**For R80.20.XX:**

In the VPN Site to Site **Advanced** tab, enable DPD **Responder mode**

![](https://sc1.checkpoint.com/sc/SolutionsStatics/NEW_SK_NOID1637148238771/2021-11-17 13_48_54-Window202111171349221.png)

**For R81.10.XX**

Responder mode is always enabled. No action needed.

### Scenario 3 - Configuring Aggressive Mode where the peer is a 3rd party

The gateway identification method must be aligned with the peer. The default is IPV4_ADDRESS.

**To set the peer identification as FQDN:**

On site configuration under the **Advanced** tab , select the option **Enable VPN access by peer identifier**.

**To set the gateway identification as FQDN:**

Select **Initiate VPN tunnel using this gateway's identifier**.

![](https://sc1.checkpoint.com/sc/SolutionsStatics/NEW_SK_NOID1637148238771/2021-11-17 13_50_06-Window202111171353082.png)

### Scenario 4 - Configuring Aggressive Mode Diffie-Hellman group choice

The group choice is configured in the **Advanced** tab instead of the **Encryption** tab.

You can only select a single group choice as the generated key is sent through packets 1,2 instead of 3,4 in MM, so negotiation over group is not possible.

Note - When using one of these Encryption Suites :

* VPN-A

* VPN-B

* VPN_Suite_B_GCM_128

* VPN_Suite_B_GCM_256

The aggressive mode DH group should be the same (can be seen in the **Encryption** tab).

![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk176387/2021-11-30 16_48_45-Gateway-ID-56A35A62 - VPN Sites - Quantum Spark VNF202111301649401.png)

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content