topic Re: S2S VPN Problem after Hotfix R80.20 Take_103 on GW in General Topics

S2S VPN Problem after Hotfix R80.20 Take_103 on GW

Technical_Servi — Thu, 31 Oct 2019 11:56:49 GMT

Hi All

After installing Take_103 on a GW we are running in strange behaviors with S2S VPNs with 3. party vendors (WatchGuard).

The tunnels are up. Traffic goes through (HTTP,RDP .....). But AD authentication doesn't work.

We can see packets from the clients through the tunnel to the AD controller:

12:49:01.212147 IP xxx.xxx.xxx.41.62985 > 10.xxx.xxx.11.389: UDP, length 214
12:49:01.212669 IP 10.xxx.xxx.11.389 > xxx.xxx.xxx.41.62985: UDP, length 195

But the don't reach the other site?! No log entries on both sites!

Any ideas?

Thanx in advance
Marc

Re: S2S VPN Problem after Hotfix R80.20 Take_103 on GW

Technical_Servi — Thu, 31 Oct 2019 13:23:10 GMT

@;23175706;[cpu_0];[SIM-206874016];prepare_cut_through: route ifn change requires F2F (curr_ifn=2, out_ifn=6, ci_flags=0x8080), conn: <10.xxx.xxx.11,389,xxx.xxx.xxx..41,55889,17>;

@;23175706;[cpu_0];[SIM-206874016];sim_pkt_send_drop_notification: (0,0) received drop, reason: general reason, conn: <xxx.xxx.xxx..41,55889,10.xxx.xxx.11,389,17>;

@;23175706;[cpu_0];[SIM-206874016];sim_pkt_send_drop_notification: no track is needed for this drop - not sending a notificaion, conn: <xxx.xxx.xxx.41,55889,10.xxx.xxx.11,389,17>;

@;23175709;[cpu_0];[SIM-206874016];do_packet_finish: SIMPKT_IN_DROP vsid=0, conn:<10.xxx.xxx.11,389,xxx.xxx.xxx..41,55889,17>;

@;23175709;[cpu_1];[fw4_0];fw_log_drop_ex: Packet proto=17 10.xxx.xxx.11:389 -> xxx.xxx.xxx..41:55889 dropped by vpn_route_change_sxl_notification_handler Reason: dynamic VPN routing is not supported;

Nothing except the HFA has been changed?!

Marc

Re: S2S VPN Problem after Hotfix R80.20 Take_103 on GW

PhoneBoy — Fri, 01 Nov 2019 20:18:37 GMT

Best to engage with the TAC, but the error message "Reason: dynamic VPN routing is not supported" might be a clue.

Re: S2S VPN Problem after Hotfix R80.20 Take_103 on GW

Technical_Servi — Tue, 05 Nov 2019 14:19:55 GMT

We just had a remote session with TAC.

The problem is already known and devlopment is searching for a solution.

We have currently a workaround. We have disabled vpn accelaration.

So far, it works!

Keep u up to date!

Re: S2S VPN Problem after Hotfix R80.20 Take_103 on GW

Technical_Servi — Fri, 06 Dec 2019 11:07:53 GMT

The problem has been fixed by Check Point

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk137592

PRJ-4647,PRHF-4819

https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.SearchResultMainAction&eventSubmit_doGoviewsolutiondetails=&solutionid=sk162400