topic Re: Problem with VPN AMAZON(AWS) CHECK POINT in General Topics

Problem with VPN AMAZON(AWS) CHECK POINT

kobi_rudy — Mon, 10 Aug 2020 13:30:21 GMT

I have several VPNs against AWS, it happens that at random the traffic falls and come back again .sometimes I have to install policy to make come back again

it was with 5900 and 80.10 , and now again with a new 6700 and 80.40

what I see in the logs:

IKE_NAT_TRAVERSAL Traffic Dropped from aws to cp

"Packet is dropped because an IPsec SA associated with the SPI on the received IPsec packet could not be found"

and:

"Unknown SPI: 0x8799740b for UDP encapsulated IPsec packet"

any idea? cp tech are trying to resolve it for a long time

Re: Problem with VPN AMAZON(AWS) CHECK POINT

Timothy_Hall — Mon, 10 Aug 2020 18:16:56 GMT

Those messages indicate that the Check Point expired or otherwise removed an existing IPSec VPN tunnel, yet the AWS side still thinks it is up and is sending traffic which the Check Point cannot decrypt because the tunnel no longer exists.

I assume you have already seen this SK, as AWS will only allow 2 SPIs:

sk113561: VPN Tunnel to Amazon Web Services (AWS) is unstable

Assuming it is not that, make sure the Phase 1 and Phase 2 SA Lifetimes match *exactly* between the configuration on both sides.

Re: Problem with VPN AMAZON(AWS) CHECK POINT

Dale_Lobb — Mon, 10 Aug 2020 18:58:29 GMT

We had a similar issue with Amazon AWS; it was fixed by setting the CheckPoint gateway to respond to DPD packets.

Check for "DPD responder mode" in sk108600. You have to turn it on via a ckp_regedit on each gateway of the checkpoint cluster.

Re: Problem with VPN AMAZON(AWS) CHECK POINT

kobi_rudy — Thu, 13 Aug 2020 10:15:53 GMT

when you change to "dpd responder mode" do you have to cpstop, cpstart ? did you leave the MTU on 1500 or it changed too?

Re: Problem with VPN AMAZON(AWS) CHECK POINT

kobi_rudy — Sun, 16 Aug 2020 05:07:17 GMT

cp tech said it wont help since we see on the debug files that we are getting "DPD Hello " from amazon, and cp answers "DPD Ack" but some times we don't get the "DPD Hello" from amazon and than the vpn get a reset . amazon checked and say they are sending it- so its a mystery why cp does'nt get it ...

Re: Problem with VPN AMAZON(AWS) CHECK POINT

Jung_Patrick — Mon, 18 Oct 2021 09:08:34 GMT

Hello, kobi.

Have you ever solved s2s vpn between AWS and CP?

I wonder.

thank you.

topic Re: Problem with VPN AMAZON(AWS) ​​CHECK POINT in General Topics

Problem with VPN AMAZON(AWS) ​​CHECK POINT

Re: Problem with VPN AMAZON(AWS) ​​CHECK POINT

Re: Problem with VPN AMAZON(AWS) ​​CHECK POINT

Re: Problem with VPN AMAZON(AWS) ​​CHECK POINT

Re: Problem with VPN AMAZON(AWS) ​​CHECK POINT

Re: Problem with VPN AMAZON(AWS) ​​CHECK POINT

topic Re: Problem with VPN AMAZON(AWS) CHECK POINT in General Topics

Problem with VPN AMAZON(AWS) CHECK POINT

Re: Problem with VPN AMAZON(AWS) CHECK POINT

Re: Problem with VPN AMAZON(AWS) CHECK POINT

Re: Problem with VPN AMAZON(AWS) CHECK POINT

Re: Problem with VPN AMAZON(AWS) CHECK POINT

Re: Problem with VPN AMAZON(AWS) CHECK POINT