[VPN] [AWS - Azure] Gateway does not recieve ACK from client

Sylvain — Fri, 19 Feb 2021 17:59:48 GMT

Local Gateway : Checkpoint R80.40

Peer Gateway : AWS or Azure

Hello,

We have a strange issue on some VPN tunnels.

- The VPN tunnel is UP.

- netcat tests are OK ( nc -v <ip_dst> <port> ).

- Applicatif tests are KO BECAUSE our gateway does not recieve the ACK of the threeway handshake from the client, but recieves the data packets. The gateway allows these packets, but they are droped on an internal Firewall, which sends a RST to both side (client and server).

- The partner assures that from his side, the client answers to the SYN ACK, by sending the ACK, but nothing arrive on our Gateway.

- The streams are entering streams (means that it is the partner who initiate the communication).

I've tried the "zdebug" and the "fw monitor" commands but i dont see those ACK arriving to our Gateway.

If someone has encountred this issue before and can help us to go trough...

P.S. : I've shared in attached file the captured communication on our Gateway (the RST is sent by an internal

Many thanks 🙂

Re: [VPN] [AWS - Azure] Gateway does not recieve ACK from client

PhoneBoy — Sun, 21 Feb 2021 18:50:03 GMT

Sounds like the ACK is getting dropped along the way and the partner needs to debug hop-by-hop what's going on.

Re: [VPN] [AWS - Azure] Gateway does not recieve ACK from client

Sylvain — Mon, 22 Feb 2021 08:41:00 GMT

Hello, Thank you for your fast answer.

What's strange, is that on our nominal gateway (in version R80.20) we don't have this isssue and the VPN tunnel works properly.

topic Re: [VPN] [AWS - Azure] Gateway does not recieve ACK from client in Firewall and Security Management

[VPN] [AWS - Azure] Gateway does not recieve ACK from client

Re: [VPN] [AWS - Azure] Gateway does not recieve ACK from client

Re: [VPN] [AWS - Azure] Gateway does not recieve ACK from client