topic Re: VPN to CheckPoint unstable, showing multiple IKE and IPSEC SA's for one policy in Firewall and Security Management

VPN to CheckPoint unstable, showing multiple IKE and IPSEC SA's for one policy

guiausechi — Fri, 24 Sep 2021 12:54:20 GMT

Hello,

someone had this problem.

I have one VPN between Check Point R80.40 and Aruba..

The symptoms are .. duplicate IKE phase 1 in the Checkpoint and some times VPN goes down.

Re: VPN to CheckPoint unstable, showing multiple IKE and IPSEC SA's for one policy

PhoneBoy — Sat, 25 Sep 2021 01:03:57 GMT

Duplicate IKE Phase 1 isn't exactly a problem depending on the precise configuration.
In any case, you'd probably need to debug the issue further: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk34467&partition=Advanced&product=IPSec

Re: VPN to CheckPoint unstable, showing multiple IKE and IPSEC SA's for one policy

the_rock — Sat, 25 Sep 2021 11:58:36 GMT

Never really set up tunnel between CP and Aruba personally, but can ask one of my colleagues who is really good with Aruba to see if there are any known settings/issues to be aware off. Did the tunnel ever work right or you had problem since the beginning? As @PhoneBoy said, debugging this is a really good idea on CP side.

This is what I usually do, super easy process...on CP fw, rune below commands from expert mode:

vpn debug trunc

vpn degug ikeon

generate some traffic

vpn debug ikeoff

Get vpnd.elg file, as well as ike,elg from %FWDIR/log

Use ikeview utility (free to download off google) to examine ike.elg file and look for the entry for Aruba public IP in there and see whats happening. Also, vpnd.elg can give some insights as well.

Re: VPN to CheckPoint unstable, showing multiple IKE and IPSEC SA's for one policy

prakash7 — Sat, 11 Mar 2023 04:26:44 GMT

We are facing IPsec vpn tunnel unstable issue its down and up automatically every half a hour (don't make any changes on firewall)happening checkpoint to Prisma cloud tunnel

till now we don't find anything what is the issue

Re: VPN to CheckPoint unstable, showing multiple IKE and IPSEC SA's for one policy

PhoneBoy — Sat, 11 Mar 2023 04:38:03 GMT

You'll need to debug it: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk180488
See also scenario 4 and 6 in: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk108600

Tunnel going up/down like that is likely a mismatch between the various timer settings.

Re: VPN to CheckPoint unstable, showing multiple IKE and IPSEC SA's for one policy

Matt_Killeen — Fri, 16 Jun 2023 12:22:52 GMT

Error 404 on link

Re: VPN to CheckPoint unstable, showing multiple IKE and IPSEC SA's for one policy

G_W_Albrecht — Fri, 16 Jun 2023 12:40:48 GMT

That sk is not available anymore - try the following and the included links:

https://support.checkpoint.com/results/sk/sk40114

Re: VPN to CheckPoint unstable, showing multiple IKE and IPSEC SA's for one policy

Matlu — Fri, 16 Jun 2023 14:49:55 GMT

Hello, my friend.

The file that should be obtained after the debugging you suggest, for the IKEv2, what would it be?

I understand that it is not the same as the one in this post, right?

Regards

Re: VPN to CheckPoint unstable, showing multiple IKE and IPSEC SA's for one policy

the_rock — Fri, 16 Jun 2023 14:53:45 GMT

Ola bro,

Just do below from expert:

cd $FWDIR/log & ls -lh *ike

It will show you all ike files, including ikev2

Andy

Re: VPN to CheckPoint unstable, showing multiple IKE and IPSEC SA's for one policy

Matlu — Fri, 16 Jun 2023 15:09:01 GMT

Hi, Andy.

Is this "file" the one to be read, in the IKEView?

File -> ikev2.xmll

Does this file "show" you both Phase1 and Phase2, or only Phase1?

Cheers.

Re: VPN to CheckPoint unstable, showing multiple IKE and IPSEC SA's for one policy

the_rock — Fri, 16 Jun 2023 15:38:30 GMT

I believe phase2 only, but could be mistaken.

Andy

Re: VPN to CheckPoint unstable, showing multiple IKE and IPSEC SA's for one policy

Bob_Zimmerman — Fri, 16 Jun 2023 18:05:07 GMT

IKEv2 doesn't have quite the same phase 1 > phase 2 structure IKEv1 has. ikev2.xmll has all of the IKEv2 negotiation information.

Re: VPN to CheckPoint unstable, showing multiple IKE and IPSEC SA's for one policy

Matlu — Fri, 16 Jun 2023 18:14:56 GMT

Hello,

The file -> ikev2.xmll has the same content as the file "legacy_ikev2.xmll", at least for Troubleshooting????

I can use any of the 2 without any problem?

Greetings.

Re: VPN to CheckPoint unstable, showing multiple IKE and IPSEC SA's for one policy

PhoneBoy — Fri, 16 Jun 2023 21:10:47 GMT

The SK that replaces the one I linked to previously is: https://support.checkpoint.com/results/sk/sk180488

Re: VPN to CheckPoint unstable, showing multiple IKE and IPSEC SA's for one policy

just13pro — Sat, 17 Jun 2023 13:53:47 GMT

I believe they are different, legacy_ike2.xmll is phase 1 for IKEv2.

You can use IKEView to open the file search the SK for the IKEView software.

Re: VPN to CheckPoint unstable, showing multiple IKE and IPSEC SA's for one policy

the_rock — Sat, 17 Jun 2023 17:35:55 GMT

Thats sounds right.

Re: VPN to CheckPoint unstable, showing multiple IKE and IPSEC SA's for one policy

genisis__ — Sun, 18 Jun 2023 15:35:15 GMT

Not sure this relates, but could this be related to IKEv2 narrowing?

If you do a 'vpn tu tlist' it should show the tunnels; your looking for the wording 'narrow' or 'eclipsed'.

See: https://support.checkpoint.com/results/sk/sk166417

Re: VPN to CheckPoint unstable, showing multiple IKE and IPSEC SA's for one policy

CheckPointerXL — Wed, 19 Jul 2023 14:13:48 GMT

Hi all,

i'm experience the same problem on R81.10 T79 with third-party peers:

not all traffic inside vpn is affected

Moreover, i have this drops:

Moreover, i tried to clean tunnel information by vpn tu but the command is so bad, information continues to be shown in vpn tu tlist, and i suspect that still they are there traffic is affected
i tried to clean some tables, meta_sas, local_meta_sas, ikesa_out_spi, but no way on how to delete a single entry

Re: VPN to CheckPoint unstable, showing multiple IKE and IPSEC SA's for one policy

the_rock — Wed, 19 Jul 2023 14:12:05 GMT

Is it all 3rd party peers or just random ones? Can you give an example...any logs, screenshot?

Cheers,

Andy

Re: VPN to CheckPoint unstable, showing multiple IKE and IPSEC SA's for one policy

CheckPointerXL — Wed, 19 Jul 2023 14:14:59 GMT

just updated the post, sorry lost some information after the publish