topic Re: Problem with site Certificate Based VPNs in Firewall and Security Management

Problem with site Certificate Based VPNs

Agust — Wed, 28 May 2025 18:52:56 GMT

We currently utilize certificate based VPNs between our main cluster and Fortinet and Starlink appliances.
These devices are installed on moving devices.

We see that the VPNs are established but after a while they go down and we were in logs the different types of errors:

"Main mode local machine configured not to responde to unknow IP address and or not included in the remoteaccess community"

"VPN failed to resolve gateway IP address"

We analyzed the SK related to these issues but we understand that they do not apply to this case.

We were also surprised to see inconsistencies in the IPs we had in the established tunnels when we consulted them through the VPN tu tlist command.

Does anyone have any suggestion of what we could analyze?

Re: Problem with site Certificate Based VPNs

the_rock — Wed, 28 May 2025 19:16:25 GMT

What is the sk?

Re: Problem with site Certificate Based VPNs

Agust — Wed, 28 May 2025 19:30:48 GMT

The SK are sk132332, sk119301 and sk117713 but none of them apply to our case

Re: Problem with site Certificate Based VPNs

PhoneBoy — Wed, 28 May 2025 20:29:03 GMT

I assume these "moving devices" are Dynamic IP.
Are the necessary interoperable objects defined as such?

One issue with DAIP VPN endpoints is that we don't know what IP address they're coming from.
In the case of a Check Point-managed gateway, most likely there is a persistent connection with management that we can use to determine the remote IP to use.
In the case of interoperable objects, we don't have such a mechanism and can only use traffic initiated from the remote VPN to learn about the IP in use.

I assume the errors occur when the IP association "times out" due to inactivity.
The fix for this is likely to have something periodically generate traffic through the VPN tunnel to keep it (and the IP association) active.
We have a mechanism called network probe to do this periodically starting in R82.
If on an earlier release, some other host will need to periodically generate traffic.

Re: Problem with site Certificate Based VPNs

Duane_Toler — Thu, 29 May 2025 15:20:24 GMT

Curious... what do you mean by "after a while"? What time interval (be as precise as you can) is this?

I'll hazard a guess, however: if it's 1 hour, then this is an IPsec phase 2 re-key issue. Make sure you have the VPN control connections enabled in your Global Properties, or be certain to have IPsec NAT-Traversal (UDP 4500) allowed in your ruleset.

Re: Problem with site Certificate Based VPNs

Agust — Wed, 04 Jun 2025 16:04:47 GMT

Hello PhoneBoy
Thank you very much for your response. We're using DAIP in this case to use certificates.
I asked you, would DPD also be a viable option, or would the survey you mentioned earlier only work for us in this case?
Thanks

Re: Problem with site Certificate Based VPNs

PhoneBoy — Wed, 04 Jun 2025 20:11:10 GMT

DPD will definitely help here.

Re: Problem with site Certificate Based VPNs

PhoneBoy — Wed, 04 Jun 2025 20:54:57 GMT

Implementing DPD definitely won't hurt here.