topic Re: R80.40 IPSEC VPN shows stuck at Phase I but is fully operational in General Topics

R80.40 IPSEC VPN shows stuck at Phase I but is fully operational

scottikon — Thu, 05 Mar 2020 18:40:19 GMT

I have a R80.40 lab with three Check Point gateways. One distributed environment (managed by separate management server) and the other two are standalone (gateway and management on same device).

I have site to site VPNs configured as follows: -

1. from Main GW to Remote GW1

2. from Main GW to Remote GW2

VPNs show in SmartView monitor as Up - Phase I but when I look at vpn tu on the cli I see phase II tunnels formed: -

SAs of all instances:

Peer 192.168.101.11 , RemoteGW1 SAs:

IKE SA <b026ba653a85f493,13cd8ad810ce962a>
INBOUND:
1. 0x97698d60 (i: 0)
OUTBOUND:
1. 0x5c3cf41e (i: 0)

Peer 192.168.101.12 , RemoteGW2 SAs:

IKE SA <c33a8776de4d53f1,62554189591c0af1>
INBOUND:
1. 0xa306b733 (i: 1)
OUTBOUND:
1. 0x53ff98e0 (i: 1)

the IKE.elg also shows three messages in quick mode.

I have also cleared the tunnel down and brought it up by initiating traffic firstly from local network (issuing a ping from PC1 to remote PC 2) and then secondly from remote network (issuing ping from remote PC2 to local PC1).

Has anyone seen this before?

Re: R80.40 IPSEC VPN shows stuck at Phase I but is fully operational

PhoneBoy — Sun, 08 Mar 2020 01:21:21 GMT

Just to clarify, SmartView Monitor is not showing the VPN up but it actually is?
Please open a TAC case.

Re: R80.40 IPSEC VPN shows stuck at Phase I but is fully operational

scottikon — Sun, 08 Mar 2020 13:19:53 GMT

That is correct.

This is in a lab environment so no support unfortunately. That's why I was wondering if anyone else had seen this or if it was something specific to my lab.

Re: R80.40 IPSEC VPN shows stuck at Phase I but is fully operational

HeikoAnkenbrand — Sun, 08 Mar 2020 16:46:36 GMT

Hi @scottikon

This issue always occurs if both gateways are in the same external network with the external interface.

Add a router instance beetween VPN gateways in your LAB:

internal network A <> Gateway A <> Router <> Gateway B <> internal network B)
<---VPN--->

Re: R80.40 IPSEC VPN shows stuck at Phase I but is fully operational

scottikon — Sun, 08 Mar 2020 20:52:08 GMT

Thanks Heiko, I will give this a try

Re: R80.40 IPSEC VPN shows stuck at Phase I but is fully operational

scottikon — Thu, 12 Mar 2020 11:16:15 GMT

Unfortunately I put a virtual SRX in packet mode (router) in between the Check Point external interfaces and the VPN is still showing as Phase I. Even though tunnel utility shows full VPN established and the logs show encrypt/decrypt and quick mode key installs.

Re: R80.40 IPSEC VPN shows stuck at Phase I but is fully operational

Narsimha_Rao_Ko — Fri, 10 Apr 2020 18:19:32 GMT

I too observed this in our production environment with R80.40. I am installing latest Hotfix to see if it resolves the issue.

Re: R80.40 IPSEC VPN shows stuck at Phase I but is fully operational

scottikon — Fri, 10 Apr 2020 20:16:12 GMT

Thanks Narsimha, be good to hear from you once you have done that.

Re: R80.40 IPSEC VPN shows stuck at Phase I but is fully operational

BoGa — Thu, 09 Jul 2020 07:09:07 GMT

Hello Mates,

Does anybody have any update regarding this symptom? I can observe this behaviour after upgrading from R80.20 to R80.40 JHA48.

All of the S2S tunnels operate noramlly, but in SmartView Monitor all of them show State UP - Phase 1

Additionally it is production environment, not lab.

Thanks for all,

Gabor

Re: R80.40 IPSEC VPN shows stuck at Phase I but is fully operational

HristoGrigorov — Thu, 09 Jul 2020 17:42:35 GMT

Same here. But I don't mind as long as VPN actually works.

Re: R80.40 IPSEC VPN shows stuck at Phase I but is fully operational

BoGa — Fri, 14 Aug 2020 12:05:48 GMT

The problem with this cosmetical issue is, that it hides the actual and real status of the VPN tunnels.

The issue is being investigated by the R&D.

SmartView Monitor is a separate and legacy dashboard. Does anybody know if it will be integrated into the inified console?

Best regards,

Gabor

Re: R80.40 IPSEC VPN shows stuck at Phase I but is fully operational

Marcel_Gramalla — Mon, 31 Aug 2020 13:52:52 GMT

We have the same problem with our R80.40 Clusters (JHF 67 and 77) and we opened a case and hopefully Check Point will fix this soon. For us this is not just a cosmetical issue as we rely on that VPN status for monitoring. It's not only the status in the SmartView but also directly via SNMP so we currently don't get any notification if a VPN goes down etc.

Of course I can check the status manually (if something seems broken) but that's not the point. I wonder how other people monitor the status of their VPNs...

Re: R80.40 IPSEC VPN shows stuck at Phase I but is fully operational

BoGa — Tue, 01 Sep 2020 14:00:31 GMT

Hello to Everybody,

The SR was closed - Check Point R&D provided a custom hotfix regarding this issue. Thanks for their development.

We haven't tried the custom hotfix as it is not a good practice imo. We are waiting for the custom hotfix will be integrated to a JHA GA.

Re: R80.40 IPSEC VPN shows stuck at Phase I but is fully operational

scottikon — Tue, 01 Sep 2020 14:05:06 GMT

Thank you for letting us know. I agree, since this is cosmetic, better to wait for it to be included in the next JHF,

Re: R80.40 IPSEC VPN shows stuck at Phase I but is fully operational

VictorPG — Tue, 01 Sep 2020 16:00:01 GMT

We received the hotfix and I tried in a lab environment and it indeed solved the cosmetic issue

Re: R80.40 IPSEC VPN shows stuck at Phase I but is fully operational

Florin_Dumitru — Mon, 07 Sep 2020 06:35:32 GMT

Is the custom hotfix (?number?) available ?

Re: R80.40 IPSEC VPN shows stuck at Phase I but is fully operational

BoGa — Mon, 07 Sep 2020 06:43:18 GMT

fw1_wrapper_HOTFIX_R80_40_JHF_T48_605_MAIN_GA_FULL.tgz - so it is suitable to this exact software version & JHA combination imo.

Re: R80.40 IPSEC VPN shows stuck at Phase I but is fully operational

Florin_Dumitru — Mon, 07 Sep 2020 06:54:58 GMT

Is there on that would apply to R80.40 Clusters with JHA T77 ?

Re: R80.40 IPSEC VPN shows stuck at Phase I but is fully operational

BoGa — Mon, 07 Sep 2020 06:59:12 GMT

I don't know, so I can't recommend it to use. The best way is to open a TAC SR for this purpose or wait for an upcoming JHA GA, which contains this fix.

Re: R80.40 IPSEC VPN shows stuck at Phase I but is fully operational

Darren_Fine — Thu, 15 Oct 2020 20:22:38 GMT

Hi ,

We have the same issue on two clients R80.40 JHF T78.

One was a new install - conversion from ASA - waisted hours thinking the vpns were not coming up !!!! 😞

Opened TAC case.