topic Re: CloudGuard (ESXi) ClusxterXL Switch IPSec VPN doesn't work in Cloud Firewall

CloudGuard (ESXi) ClusxterXL Switch IPSec VPN doesn't work

SoRee — Tue, 23 Apr 2024 02:06:22 GMT

Hello,

We deployed CloudGuard (ESXi) ClusterXL. Now 6 site connected with IPSec VPN.

When we swtiched ClusterXL some site IPsec VPN work well, but other site doesn't work.

CloudGuard ClsuterXL only has a private IP, but is in a NAT environment for IPSec VPN.

In this case, what should I check?

Re: CloudGuard (ESXi) ClusxterXL Switch IPSec VPN doesn't work

Chris_Atkinson — Tue, 23 Apr 2024 06:57:38 GMT

Which version & JHF level?

Are the remote sites also CP gateways or no, any of them DAIP?

Re: CloudGuard (ESXi) ClusxterXL Switch IPSec VPN doesn't work

SoRee — Tue, 23 Apr 2024 07:29:39 GMT

All sites are CP Gateway (R81.20 Take 53) and use static IP only.

Re: CloudGuard (ESXi) ClusxterXL Switch IPSec VPN doesn't work

emmap — Tue, 23 Apr 2024 07:44:43 GMT

Make sure your inbound NAT rule(s) are pointing to the cluster VIP and not the IP address of the primary VM. Check the logs for any connection failure messages. TCPdump to make sure the connection attempts are getting to the gateway.

Re: CloudGuard (ESXi) ClusxterXL Switch IPSec VPN doesn't work

SoRee — Tue, 23 Apr 2024 08:00:29 GMT

When I checked each cluster member, Firewall1 (normal) is try connect IPSec VPN with own IP.
But Firewall2 (abnormal) is try to connect IPSec VPN with VIP.
I guess both members should try to connect as VIP, but it doesn't work that way.