topic Re: Always-On VPN through a Checkpoint FW only one VPN session working in Firewall and Security Management

Always-On VPN through a Checkpoint FW only one VPN session working

ham2065 — Wed, 31 Aug 2022 07:35:32 GMT

I have a setup with Microsoft Always on VPN AOVPN running through a Checkpoint R80.40 Cluster and terminated on a Microsoft RRAS server.

I have allowed inbound traffic on ports UDP 500 and 4500 and created manual static NATs translating the external IP to the RRAS server in both directions.

The AOVPN works for 1 vpn client but when a second client tries to connect they get a generic network connection error.

We have a similar setup at another data centre running through an ASA cluster and AOVPN is working as expected i.e. multiple AOVPN simultaneously.

Is this due to a Nat Traversal issue?

Any help here would be appreciated.

Re: Always-On VPN through a Checkpoint FW only one VPN session working

Chris_Atkinson — Wed, 31 Aug 2022 08:18:18 GMT

Are the multiple clients connecting from behind the same remote source address or different?

For the static NAT are you using an interface address of the Gateway or an IP specifically allocated for NAT?

Reminds me of some fun had with PPTP many years ago...

Re: Always-On VPN through a Checkpoint FW only one VPN session working

ham2065 — Wed, 31 Aug 2022 22:24:49 GMT

Hi Chris

The clients are on the internet with individual IPs. The Static NAT external IP is dedicated just for AOVPN and is not the FW External Interface.

There is a similar posting on the forum here Solved: Always-On VPN through a Checkpoint FW - Check Point CheckMates

But we have it working but for only one client.