topic Re: R80.40 JHF 120 - S2S VPN issue in Firewall and Security Management

R80.40 JHF 120 - S2S VPN issue

Juan_ — Fri, 06 Aug 2021 14:30:01 GMT

Hey Lads,

A customer installed JHF 120 this morning and many S2S vpns didn't come up.

Solved it by reverting to JHF 118.

Am about to raise to TAC for them to have a look at the debugs but wanted to just give the heads up to the community.

Juan

Re: R80.40 JHF 120 - S2S VPN issue

Garrett_DirSec — Fri, 06 Aug 2021 21:49:48 GMT

Please provide updates on your investigations. would be good to understand.

There are a ZILLION fixes in JFA take #119.

reference: R80.40 Jumbo

Re: R80.40 JHF 120 - S2S VPN issue

Ruan_Kotze — Sat, 07 Aug 2021 07:36:22 GMT

We had exactly the same issue at a customer site. All S2S tunnels failed with "local interface spoofing". Had to revert back to T118.

Ironically, TAC had us install this take troubleshoot an issue with a single S2S that wouldn't come up.

Re: R80.40 JHF 120 - S2S VPN issue

Ilya_Yusupov — Sun, 08 Aug 2021 06:17:14 GMT

@Juan_ ,

can you please share more info about which tunnels exactly are impacted?

I'm interesting to understand the encryption suite of those tunnels and Ike version.

Thanks,

Ilya

Re: R80.40 JHF 120 - S2S VPN issue

genisis__ — Sun, 08 Aug 2021 09:34:03 GMT

Could this issue be with T119 rather then T120? According to the official list only two things have been added since T119 (If you believe that). I did also find it strange that T119 did not go into GA and T120 in ongoing.

Above said, I have installed T119 on a gateway with a S2S VPN and we have had no reported issues.

Re: R80.40 JHF 120 - S2S VPN issue

Kim_Moberg — Sun, 08 Aug 2021 13:22:57 GMT

Would be interesting to hear if the condition are related to:

- CP2CP tunnels

- CP2 3rd party like Cisco

- IKEv1 or IKEv2

- Remote peer behind NAT?

thanks

Re: R80.40 JHF 120 - S2S VPN issue

the_rock — Sun, 08 Aug 2021 13:50:18 GMT

wow...thats unfortunate, but glad it was solved. It would be good to find out what is causing this with take 120.

Re: R80.40 JHF 120 - S2S VPN issue

Juan_ — Mon, 09 Aug 2021 15:44:43 GMT

Yeah, the one with the VPN fixes is 119, but 120 went GA. That's why i mentioned 120.

Re: R80.40 JHF 120 - S2S VPN issue

Juan_ — Mon, 09 Aug 2021 15:53:29 GMT

Hi Ilya,

One tunnel is ikev2 using:

P1: aes2 sha2 group 20

P2:aes2 sha2 group20

Other 2 that we documented failing are ikev1:

P1:3des md5 group2

P2: 3des md5

More info:

Remote peers are of different vendors, one of them Palo Alto. Not aware of the others
Cluster is behind a fortigate that NATs the CPs IP.
- Link selection is not configured
  - It's just "main ip address" which is a private
One of the VPNs on JHF_118 goes over ESP, the other 2 over 4500
- Didn't check it on JHF_120, we reverted quickly.

By responses of others doesn't seem to be so widespread though there seem to be a couple of issues. I can send you the SR number if you want.

Juan

Re: R80.40 JHF 120 - S2S VPN issue

Kim_Moberg — Mon, 09 Aug 2021 16:12:53 GMT

Hi Juancho

When running tcpdump do you see ESP packets intiated udp/500 and reply on udp/4500? or is it both ways sending udp/500 or udp/4500? should be the later.

For example

tcpdump -penni any host x.x.x.x

x’s representative public ip of remote peer.

thanks

Re: R80.40 JHF 120 - S2S VPN issue

smoraneng — Wed, 11 Aug 2021 16:08:08 GMT

Hey all, I'm not sure this 100% relative, but we're seeing something else with ike v2 s2s vpn's that's different in 120 vs other versions. GW general properties is set to a private IP, link selection is set to public IP. In versions under 120, the peer side sees the General Properties IP, in 120, phase 2 is seeing the public IP.

Re: R80.40 JHF 120 - S2S VPN issue

RS_Daniel — Wed, 11 Aug 2021 16:15:20 GMT

Hello,

Just wanted to share that we had problem with only one S2S vpn after installing JHA Take 120. In our case the vpn is completely down (checked with vpn tu options 3 and 4) and smartview monitor. However, the gateway is keeping and old SPI (seen with vpn tu tlis) and is trying to encrypt the traffic with that SPI. As this SPI is incorrect the peer rejects our traffic which is normal. The problem is the checkpoint gateway not deleting that SPI, tried to remove the gateway from the community but did not work, SPI is not deleted. Working with TAC to see how to fix this on Jumbo 120 as we waited months for a fix included on Take 119.

Regards

Re: R80.40 JHF 120 - S2S VPN issue

the_rock — Wed, 11 Aug 2021 16:23:58 GMT

Hm, thats interesting...I know R&D told me before not to worry what it shows in SV monitor, as that could be misleading as far as vpn tunnel status and I do agree, as thats my experience as well, so vpn tu is way more reliable and more correct. So you are saying only 1 tunnel is broken...is it with cloud provider, cp to cp or cp to 3rd part, just wondering?

Re: R80.40 JHF 120 - S2S VPN issue

the_rock — Wed, 11 Aug 2021 16:25:29 GMT

Well, technically, lots of customer would have it that way and thats perfectly fine, as VPN would look for whats configured in link selection, so whatever is set there, would be what is taking as main public IP...what option do you have configured in that tab?

Re: R80.40 JHF 120 - S2S VPN issue

smoraneng — Wed, 11 Aug 2021 16:45:42 GMT

So with no configuration change on the gw other than applying HF 120 The general properties is set to the 10 ip, the link selection is set to public IP.

Re: R80.40 JHF 120 - S2S VPN issue

the_rock — Wed, 11 Aug 2021 16:47:42 GMT

Then Im really not sure...seems like take 120 problem, I would say.

Re: R80.40 JHF 120 - S2S VPN issue

Wolfgang — Wed, 11 Aug 2021 18:30:47 GMT

Can someone please provide SR number or anything else regarding this issue?

Reading about this issue here stops us for going to take 120. We need 120 to solve some other problems but failing S2S tunnels is the more complicating problem.

Wolfgang

Re: R80.40 JHF 120 - S2S VPN issue

Brandon_Pace — Wed, 11 Aug 2021 18:13:53 GMT

If after upgrade, the IP presented for the ID payload is the Link Selection address, then note that an issue was fixed and the peer's configuration should be updated to match the expected (link selection) IP. (There was an issue in IKEv2 where we would use the main IP instead of the link selection IP)

In the jumbo sk in Take 119 there is this note regarding that fixed issue:

"Invalid ID information” message may be displayed when peer is 3rd party and Link selection is overridden.

Re: R80.40 JHF 120 - S2S VPN issue

idants — Wed, 11 Aug 2021 19:09:13 GMT

Hi all,

I am Idan Tsarfati, IPsec VPN R&D group manager.

Regarding the problem in take 120:

We changed a behavior which related to narrowing feature.

In case where CP GW connected with a 3rd party peer and there is a mismatch with the encryption domain configuration the tunnel might stop transfer traffic.

Until this take, the narrowing feature fixed a situation where we have universal tunnel in CP side and 'tunnel per subnet' in the 3rd party side.

In order to make it work, the misconfiguration should be fixed - a SK will be published tomorrow on how to recognize it.

Basically if you see **narrowing** in vpn tu tlist in the relevant tunnel, this is the case.

I am not familiar with any other issue in this take - the known issue is relevant only where the environment has a configuration issue and it should not widely happen. I am familiar with only 2 cases.

I know about many customers who use take 120 (or 119 which is identical) and it works very well.

The take include many fixes and solved many issues.

Re: R80.40 JHF 120 - S2S VPN issue

Garrett_DirSec — Wed, 11 Aug 2021 19:10:11 GMT

hello @idants -- thanks for the background and details. very helpful.