topic Re: IPSEC site to site VPN fails after R80.20 upgrade in Firewall and Security Management

IPSEC site to site VPN fails after R80.20 upgrade

Scott_Paisley — Sat, 01 Jun 2019 11:07:23 GMT

We have a large number of IPSEC VPN tunnels between our R77.30 gateway clusters.

Yesterday we upgraded one of the remote clusters to R80.20. After the upgrade the tunnel was still working fine, until we pushed policy to the R77.30 cluster late last night.

Now the tunnel will not stay up. If I push the R80.20 cluster it comes up briefly, then fails again.

The error message is

Auth exchange: Sending notification to peer: Authentication failed MyAuthMethod: Certificates

I have support ticket open, but is there something simple and obvious I am missing?

Thanks

Re: IPSEC site to site VPN fails after R80.20 upgrade

Maarten_Sjouw — Sun, 02 Jun 2019 11:51:50 GMT

Do make sure to push the policy on the R77.30 again. We have seen many times during a R77.30 to R77.30 migration, a couple of years ago, that when we had VPN's we needed to at least push twice to those gateways to make sure the tunnels came back.

Re: IPSEC site to site VPN fails after R80.20 upgrade

Scott_Paisley — Sun, 02 Jun 2019 12:23:32 GMT

Thanks

I removed the R80.20 gateway from the VPN, pushed to both gateways, added it back in and pushed again, and now the tunnel is up.

Checkpoint recommendation is to renew the cert, but each of our gateways is involved in multiple VPNs, so we will end up pushing to the whole estate eventually.

Re: IPSEC site to site VPN fails after R80.20 upgrade

OL — Sun, 08 Dec 2019 14:55:28 GMT

@Scott_Paisley did you find the root cause of this? Could it have been that after upgrade that PFS was turned off?

I just saw similar behaviour going from R80.10 to R80.30. Im pretty sure I had PFS enabled before upgrade. It was disabled after upgrade I think. I reenabled, and it looks more stable.

Re: IPSEC site to site VPN fails after R80.20 upgrade

Scott_Paisley — Mon, 09 Dec 2019 08:59:48 GMT

it turned out to be an unrelated issue. The Remote gateways were not able to reach the management server to check the validity of the certs. Once that was resolved the tunnels came up

Re: IPSEC site to site VPN fails after R80.20 upgrade

CrociStrike030 — Thu, 04 Dec 2025 14:16:21 GMT

I know this post is a little bit old, but this worked for me. Thanks!