topic Re: need to reset tunnel every time when peer end primary ISP down. in Firewall and Security Management

need to reset tunnel every time when peer end primary ISP down.

surajshinde — Thu, 15 Apr 2021 10:28:22 GMT

Dear Team,

We have configure site site tunnel between check point, both ends having check point and managed by same management device.

but primary link of peer goes Down, tunnel went down and once we manually reset it start working with secondary link.

Why manual reset required each time.

Re: need to reset tunnel every time when peer end primary ISP down.

PhoneBoy — Thu, 15 Apr 2021 15:37:14 GMT

How precisely did you configure it?
ISP Redundancy in use?
What version/JHF?

Re: need to reset tunnel every time when peer end primary ISP down.

surajshinde — Sat, 17 Apr 2021 02:59:47 GMT

How precisely did you configure it==> We have cross verify both end all the Phase1 & Phase2 configuration, all re same and it is working . But issue is happen only when Peer end Primary ISP link goes down traffic not shifted towards secondary. Whereas we have configure ISP redundancy and DNS 8.8.8.8 set.
ISP Redundancy in use==> Yes two link Primary and secondary at both end like our end and peer end. and both configured with ISP redundancy.
What version/JHF==>R81 Take 23

Re: need to reset tunnel every time when peer end primary ISP down.

PhoneBoy — Sat, 17 Apr 2021 03:55:40 GMT

In the ISP Redundancy config, have you enabled “Apply settings to VPN traffic” ?

Re: need to reset tunnel every time when peer end primary ISP down.

surajshinde — Sat, 17 Apr 2021 04:05:32 GMT

Yes. "Apply Setting to VPN traffic" is enabled.

Re: need to reset tunnel every time when peer end primary ISP down.

the_rock — Sun, 18 Apr 2021 00:37:28 GMT

Also, make sure "keep ike sas" is enabled in global properties...I had seen that applicable for both cp to cp tunnels, as well as cp to 3rd party.

Re: need to reset tunnel every time when peer end primary ISP down.

Simply_sachin — Sun, 18 Apr 2021 10:22:52 GMT

but on this mangement server mutilple site to site VPNs are working perfectly..For only one specific Site2site only problem..

if i enable keep ike sas,it will not impact other site to site.

Re: need to reset tunnel every time when peer end primary ISP down.

the_rock — Sun, 18 Apr 2021 12:37:59 GMT

I had never seen it impact other sites...can you try delete and recreate that site?

Re: need to reset tunnel every time when peer end primary ISP down.

PhoneBoy — Sun, 18 Apr 2021 15:38:25 GMT

Probably a good idea to involve the TAC on this.