topic Re: IP pool Source NAT issue R82.10 L2TP + IPsec in Firewall & Security Management

IP pool Source NAT issue R82.10 L2TP + IPsec

saitoh — Thu, 08 Jan 2026 01:35:50 GMT

Hi experts,

Env:

CP3950 clusterXL R82.10 jumbo take 22

VM management server R82 jumbo take 44

I tested CP3950, and L2TP users cannot access internal resource when VPN connection established.

I migrated all visible configuration from the actual environment, including database of management server, to two of CP3950, and VM management server.

The original product environment provides wide range of availability with L2TP users, so I did not expect it failed on CP3950.

All visible configuration such as GAiA configurations, and management server database are same as I double-checked, so I thought I might have missed some kernel parameters.

I noticed log says an unfamiliar IP address (10.127.45.X) for the connection of L2TP user while xxx.xxx.252.x/24 is expected.(IP Pool NAT)

Therefore, I hit google, and found seemingly related sk (sk172805).
https://support.checkpoint.com/results/sk/sk172805

I am not certain if this is relevant or not...

Any comments are more than welcome, but since the appliances are not within my reach log retrieving takes time.

Thanks in advance.

Saitoh

Re: IP pool Source NAT issue R82.10 L2TP + IPsec

Chris_Atkinson — Tue, 06 Jan 2026 11:08:46 GMT

I don't believe your issue matches this, if you've confirmed the office mode address range and NAT configuration please open an SR with TAC to investigate further.

Re: IP pool Source NAT issue R82.10 L2TP + IPsec

the_rock — Tue, 06 Jan 2026 11:53:21 GMT

Hey mate,

Greetings to Japan and Happy New Year!

I tend to agree with Chris, does not seem to me that sk would be 100% relevant in your specific case. Definitely best to open TAC case and let them confirm.

Re: IP pool Source NAT issue R82.10 L2TP + IPsec

PhoneBoy — Tue, 06 Jan 2026 15:32:27 GMT

I'm guessing this is related to the move to UPPAK, which you probably weren't running in the older environment.
TAC will definitely need to be involved.

Re: IP pool Source NAT issue R82.10 L2TP + IPsec

idants — Tue, 06 Jan 2026 20:30:36 GMT

Hi,

Thank you for the feedback.

I asked to check your case in our lab, and indeed seems that there is a bug which cause this behavior.

We are working to fix it and the fix will be included in one of the next JHF releases (#1 or #2).

Thanks,

Idan Tsarfati

R&D Director

Re: IP pool Source NAT issue R82.10 L2TP + IPsec

saitoh — Thu, 08 Jan 2026 01:55:08 GMT

Hi @PhoneBoy , @the_rock , @Chris_Atkinson ,

Much appreciated to your comments! It is fortune for me and the community that you legends are always here to help us 🙂

and thanks for conforming this behavior @idants!

I will open an TAC case to ask them for a bit more details.

Saitoh

Re: IP pool Source NAT issue R82.10 L2TP + IPsec

the_rock — Thu, 08 Jan 2026 02:28:25 GMT

Im sure it will be fixed soon, as @idants indicated.

日本へのご挨拶

I hope google translate did that right : -)