topic Re: Post-Encrypt traffic is not visible in Fw monitor. Other end FW is not receiving traffic sent by in Firewall and Security Management

Post-Encrypt traffic is not visible in Fw monitor. Other end FW is not receiving traffic sent by me

Krishna — Mon, 17 Jun 2019 15:58:30 GMT

Below are the logs collected from the primary gateway of my firewall. In "O" the source IP is getting NATed to the NAT IP and then pre-encrypt is shown and not receiving the POST-encrpt packet.The other end firewall is not observing any traffic.

[vs_0][fw_2] eth1:i[60]: 10.140.96.6 -> 10.232.144.14 (TCP) len=60 id=42611
TCP: 40768 -> 515 .S.... seq=24587d9c ack=00000000
[vs_0][fw_2] eth1:I[60]: 10.140.96.6 -> 10.232.144.14 (TCP) len=60 id=42611
TCP: 40768 -> 515 .S.... seq=24587d9c ack=00000000
[vs_0][fw_2] eth0:o[60]: 10.140.96.6 -> 10.232.144.14 (TCP) len=60 id=42611
TCP: 40768 -> 515 .S.... seq=24587d9c ack=00000000
[vs_0][fw_2] eth0:O[60]: 10.40.112.6 -> 10.232.144.14 (TCP) len=60 id=42611
TCP: 40768 -> 515 .S.... seq=24587d9c ack=00000000
[vs_0][fw_2] eth0:e[60]: 10.40.112.6 -> 10.232.144.14 (TCP) len=60 id=42611
TCP: 40768 -> 515 .S.... seq=24587d9c ack=00000000

Re: Post-Encrypt traffic is not visible in Fw monitor. Other end FW is not receiving traffic sent by

PhoneBoy — Tue, 18 Jun 2019 04:37:12 GMT

Have you done any fw ctl debug by chance?
You might also add -p all to your fw monitor CLI.
Some fw ctl debug: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk98799

Re: Post-Encrypt traffic is not visible in Fw monitor. Other end FW is not receiving traffic sent by

Maarten_Sjouw — Tue, 18 Jun 2019 06:33:32 GMT

Really sounds like the tunnel is down, have you checked with vpn tu
Is anything showing (is it logged?) in the logs?

Re: Post-Encrypt traffic is not visible in Fw monitor. Other end FW is not receiving traffic sent by

Krishna — Mon, 15 Jul 2019 09:59:29 GMT

The issue is interlinked with another issue(link below) and once that is resolved, this got resolved automatically.

https://community.checkpoint.com/t5/CloudGuard-IaaS/The-NAT-issue-on-CP-firewall-deployed-in-the-Azure/m-p/56013#M1233