topic R80.10/R80.20 not displaying correct number of remote access tunnels in General Topics

R80.10/R80.20 not displaying correct number of remote access tunnels

mr_andy — Wed, 03 Jul 2019 13:04:23 GMT

Can anyone help with a strange problem we are experiencing.

Smartview Monitor has started mis-reporting the number of remote user tunnels.

the actual number of connected users is only 12, but cluster member A is saying 383, and cluster member B is showing 208 ? if the gateways are restarted or cpstop/cpstart the number changes again.

it is definitely a gateway issue and not a management/smartconsole issue. on each gateway if I run the following command - cpstat -f all vpn and check the value of 'IPsec number of VPN-1 RA peers" I get the same result shown above, e.g. 383 on the A member.

if I run the following command:

fw tab -t userc_users -s

this shows the correct number of connected remote access users under the #VALS column.

anyone seen this before and know of a fix ? looks like we need to reset the count somewhere.

We have seen this behaviour on two of our clustered gateways and first occurred after upgrade from R77.30. One pair of clusters is running R80.10 with JHFA 189, the other is R80.20 with JHFA 33 and both are exhibiting the same issue.

Re: R80.10/R80.20 not displaying correct number of remote access tunnels

PhoneBoy — Thu, 04 Jul 2019 01:08:39 GMT

Best to engage the TAC here.

Re: R80.10/R80.20 not displaying correct number of remote access tunnels

Licensing_User — Tue, 08 Oct 2019 15:45:04 GMT

Did you get to the bottom of this? We see the same problem on R80.30 Take 50

Re: R80.10/R80.20 not displaying correct number of remote access tunnels

mr_andy — Wed, 09 Oct 2019 07:59:11 GMT

Hello

we tried the latest Jumbo Take 225 for R80.10 but this did not resolve the issue.

we have an open SR with Check Point on this problem, the latest update is that they have reproduced the issue and are currently working on a fix.

Re: R80.10/R80.20 not displaying correct number of remote access tunnels

mr_andy — Wed, 09 Oct 2019 08:00:13 GMT

if you can I would suggest engaging with TAC as well, as it looks as though this is affecting more than one customer.

Re: R80.10/R80.20 not displaying correct number of remote access tunnels

Daniel_Castleto — Fri, 11 Oct 2019 07:59:17 GMT

Hi,

I have a TAC case currently logged for this exact issue. working fine under R77.30 but afterR80.20 upgrade it does this.

TAC have managed to replicate in a lab and are currently working on a fix. I will keep you posted on progress.

Regards,

Dan

Re: R80.10/R80.20 not displaying correct number of remote access tunnels

Filippos_Tsikog — Mon, 06 Apr 2020 10:30:41 GMT

Hi, Can you tell us eventually what happened with the results of the TAC Case?

Regards

Kostas

Re: R80.10/R80.20 not displaying correct number of remote access tunnels

Daniel_Castleto — Mon, 06 Apr 2020 12:41:10 GMT

Hi All,

Checkpoint provided 2 separate hotfixes. Neither of them resolved the issue.

Ongoing Hotfix 270 mentions the following:

PRJ-2978,
VPNS2S-417

VPN

SmartView Monitor VPN tunnel status may show incorrect or missing tunnels status for a cluster object.

Jumbo Hotfix Take 272 went GA yesterday. I am going to recommend to my client to install JHF Take 272.

Let me know if you managed to get it installed before my customer.

Regards,

Dan

Re: R80.10/R80.20 not displaying correct number of remote access tunnels

Filippos_Tsikog — Mon, 06 Apr 2020 19:32:02 GMT

Our software versions are different from yours, we have R80.30 for management server and R80.20 for firewalls (active-passive) and after upgrading to the latest jumbo fix both Management server and firewalls we have the same results. So if anyone else has any idea what to do next please you are welcome.

Re: R80.10/R80.20 not displaying correct number of remote access tunnels

Albert_Wilkes — Thu, 14 May 2020 11:24:19 GMT

We found this is still an issue in R80.30 Take: 191

CP have provided a HF for another customer and lower JHF but the customer have yet to install and test to see if it fixes this.