topic Re: site-to-site vpn stops in between - What other debug should be collected? in General Topics

site-to-site vpn stops in between - What other debug should be collected?

Blason_R — Thu, 18 Jun 2020 10:05:30 GMT

Hi Team,

So I have S2S with AWS and internally I have 12000 series devices with R80.20. Recently we established tunnel with AWS however what we noticed is the traffic works fine for certain time while it just stops in between then if I do vpn tu and delete the IKE SA the traffic starts again for some time and same behaviour after that.

I took a vpn debug and for testing purpose I disabled vpn accel for that particular vpn peer IP. However the issue still persists.

Anything else that needs to be looked at?

One thing I noticed is when this issue happens multiple IKE SA are seen for Phase-1.

Re: site-to-site vpn stops in between - What other debug should be collected?

Timothy_Hall — Thu, 18 Jun 2020 11:40:03 GMT

Make sure your VPN Tunnel Sharing setting is "one VPN tunnel per gateway pair", due to this:

sk113561: VPN Tunnel to Amazon Web Services (AWS) is unstable

Also make sure that the IKE and IPSec renegotiate lifetimes on the Advanced VPN Properties screen match those on the AWS side.

Re: site-to-site vpn stops in between - What other debug should be collected?

Blason_R — Thu, 18 Jun 2020 12:32:53 GMT

Hi,

Probably that could be - Thanks for pointing this out. Let me make the changes and see.

Re: site-to-site vpn stops in between - What other debug should be collected?

Blason_R — Fri, 19 Jun 2020 04:54:34 GMT

Still no luck with this. vpnd.elg show nothing.

Re: site-to-site vpn stops in between - What other debug should be collected?

Timothy_Hall — Fri, 19 Jun 2020 13:00:19 GMT

Assuming you have followed the steps in this SK, it is probably time to engage the TAC:

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk100726&partition=Basic&product=IPSec