topic Re: Not able to establish BGP when ISP failover, BGP is using Configured VTI in Firewall and Security Management

Not able to establish BGP when ISP failover, BGP is using Configured VTI

ajsingh — Tue, 07 Oct 2025 15:03:50 GMT

Hi,

I have a CP to CP site to site VPN tunnel which has one VTI configured (numbered) and over that BGP is established.

One CP has 2 isp configured and ISP redundancy has been configured and apply to VPN settings too.

Upon failover of ISP , Internet traffic is working. VPN tunnel seems to be up too with Peer (CP) but BGP is in Active state. I couldn't ping other side VTI ip also.

I can see traffic is going from both sides to each other via VTI and encrypted but none of the sides are replying. IS there any limitation or am i missing anything in the configuration to make this setup work ?

Both FW's are R81.20 + T105 . . Managed by same FW manager.

Re: Not able to establish BGP when ISP failover, BGP is using Configured VTI

the_rock — Tue, 07 Oct 2025 15:07:05 GMT

Do you have simple diagram? It would help, for sure.

Andy

Re: Not able to establish BGP when ISP failover, BGP is using Configured VTI

ajsingh — Tue, 07 Oct 2025 15:12:18 GMT

Re: Not able to establish BGP when ISP failover, BGP is using Configured VTI

ajsingh — Tue, 07 Oct 2025 15:43:12 GMT

I do see Peer CP FW recieved ping request and reply :

[vs_0][fw_0] eth0:i[44]: 10.2.2.2 -> 10.1.1.1 (ICMP) len=84 id=38959

ICMP: type=8 code=0 echo request id=35083 seq=15

[vs_0][fw_0] vpnt1:I[44]: 10.2.2.2 -> 10.1.1.1 (ICMP) len=84 id=38959

ICMP: type=8 code=0 echo request id=35083 seq=15

[vs_0][fw_0] vpnt1:o[44]: 10.1.1.1 -> 10.2.2.2 (ICMP) len=84 id=42176

ICMP: type=0 code=0 echo reply id=35083 seq=15

[vs_0][fw_0] vpnt1:O[44]: 10.1.1.1 -> 10.2.2.2 (ICMP) len=84 id=42176

ICMP: type=0 code=0 echo reply id=35083 seq=15

[vs_0][fw_1] vpnt1:Oe[44]: 10.1.1.1 -> 10.2.2.2 (ICMP) len=84 id=42176

ICMP: type=0 code=0 echo reply id=35083 seq=15

But I dont see any reply on on-prem FW VTI when ISP failovers.

Re: Not able to establish BGP when ISP failover, BGP is using Configured VTI

the_rock — Tue, 07 Oct 2025 15:47:20 GMT

Can you do zdebug for the relevant IP when it fails? fw ctl zdebug + drop | grep x.x.x.x (just replace x.x.x.x with right IP)

Andy

Re: Not able to establish BGP when ISP failover, BGP is using Configured VTI

ajsingh — Tue, 07 Oct 2025 18:07:32 GMT

Hi,

This is what i see :

[Expert@GW5400-LAB:0]# fw ctl zdebug + drop | grep 10.1.1.1
@;52686503.19611;[kern];[tid_0];[SIM4];sim (vpn_encrypt): drop due vpn_ipsec_encrypt returns PKT_ERROR(0), conn: <10.2.2.2,22141,10.1.1.1,0,1>;
@;52686503.19612;[kern];[tid_0];[SIM4];handle_vpn_encryption: ipsec_encrypt failed: encrypted packet too big. Dropping packet... conn: <10.2.2.2,22141,10.1.1.1,0,1>;
@;52686503.19613;[kern];[tid_0];[SIM4];sim_pkt_send_drop_notification: (0,1) received drop, reason: Encryption Failed (5), conn: <10.2.2.2,22141,10.1.1.1,0,1>;
@;52686503.19614;[kern];[tid_0];[SIM4];sim_pkt_send_drop_notification: sending packet dropped notification drop mode: 0 debug mode: 1 send as is: 0 track_lvl: -1, conn: <10.2.2.2,22141,10.1.1.1,0,1>;
@;52686503.19615;[kern];[tid_0];[SIM4];sim_pkt_send_drop_notification: sending single drop notification, conn: <10.2.2.2,22141,10.1.1.1,0,1>;
@;52686509.19616;[kern];[tid_0];[SIM4];do_packet_finish: SIMPKT_IN_DROP vsid=0, conn:<10.2.2.2,22141,10.1.1.1,0,1>;
@;52686512.19619;[kern];[tid_0];[SIM4];sim (vpn_encrypt): drop due vpn_ipsec_encrypt returns PKT_ERROR(0), conn: <10.2.2.2,22141,10.1.1.1,0,1>;
@;52686512.19620;[kern];[tid_0];[SIM4];handle_vpn_encryption: ipsec_encrypt failed: encrypted packet too big. Dropping packet... conn: <10.2.2.2,22141,10.1.1.1,0,1>;
@;52686512.19621;[kern];[tid_0];[SIM4];sim_pkt_send_drop_notification: (0,1) received drop, reason: Encryption Failed (5), conn: <10.2.2.2,22141,10.1.1.1,0,1>;
@;52686512.19622;[kern];[tid_0];[SIM4];sim_pkt_send_drop_notification: sending packet dropped notification drop mode: 0 debug mode: 1 send as is: 0 track_lvl: -1, conn: <10.2.2.2,22141,10.1.1.1,0,1>;
@;52686512.19623;[kern];[tid_0];[SIM4];sim_pkt_send_drop_notification: sending single drop notification, conn: <10.2.2.2,22141,10.1.1.1,0,1>;
@;52686514.19624;[kern];[tid_0];[SIM4];do_packet_finish: SIMPKT_IN_DROP vsid=0, conn:<10.2.2.2,22141,10.1.1.1,0,1>;
@;52686536.19627;[kern];[tid_0];[SIM4];sim (vpn_encrypt): drop due vpn_ipsec_encrypt returns PKT_ERROR(0), conn: <10.2.2.2,22141,10.1.1.1,0,1>;
@;52686536.19628;[kern];[tid_0];[SIM4];handle_vpn_encryption: ipsec_encrypt failed: encrypted packet too big. Dropping packet... conn: <10.2.2.2,22141,10.1.1.1,0,1>;
@;52686536.19629;[kern];[tid_0];[SIM4];sim_pkt_send_drop_notification: (0,1) received drop, reason: Encryption Failed (5), conn: <10.2.2.2,22141,10.1.1.1,0,1>;
@;52686536.19630;[kern];[tid_0];[SIM4];sim_pkt_send_drop_notification: sending packet dropped notification drop mode: 0 debug mode: 1 send as is: 0 track_lvl: -1, conn: <10.2.2.2,22141,10.1.1.1,0,1>;
@;52686536.19631;[kern];[tid_0];[SIM4];sim_pkt_send_drop_notification: sending single drop notification, conn: <10.2.2.2,22141,10.1.1.1,0,1>;
@;52686538.19632;[kern];[tid_0];[SIM4];do_packet_finish: SIMPKT_IN_DROP vsid=0, conn:<10.2.2.2,22141,10.1.1.1,0,1>;

Re: Not able to establish BGP when ISP failover, BGP is using Configured VTI

the_rock — Tue, 07 Oct 2025 18:13:47 GMT

Please check if this sk might apply.

Andy

https://support.checkpoint.com/results/sk/sk166417

Re: Not able to establish BGP when ISP failover, BGP is using Configured VTI

ajsingh — Tue, 07 Oct 2025 18:18:22 GMT

Thank you. I checked and no it doesnt. I am using IKEv1 and vpn tu tlist does not show any symptoms as the SK :

[Expert@GW5400-LAB:0]# vpn tu tlist

Re: Not able to establish BGP when ISP failover, BGP is using Configured VTI

the_rock — Tue, 07 Oct 2025 18:23:32 GMT

To me, that 100% looks like phase 2 issue, based on the error. Can you send what I attached looks like for your side?

Andy

Re: Not able to establish BGP when ISP failover, BGP is using Configured VTI

ajsingh — Tue, 07 Oct 2025 18:26:36 GMT

Re: Not able to establish BGP when ISP failover, BGP is using Configured VTI

the_rock — Tue, 07 Oct 2025 18:28:37 GMT

Try unchecking permanent tunnel option and install policy. if no joy, just put it back and open TAC case, might need some more debugging. Btw, just curious, why use ikev1? Thats insecure, plus, ikev2 is standard nowdays.

Andy