topic Re: Intermittent VPN issue in General Topics

Intermittent VPN issue

D_TK — Fri, 08 Mar 2019 20:40:35 GMT

Good Day everyone.

Have a very intermittent site to site VPN issue. Current environment is 9 locations, connected by private MPLS.

Management is R80.20

(8) clusters are R77.30

(1) cluster is R80.20

I have a mesh VPN community which has 8 locations in it. The 9th location, where management resides is not part of the VPN community.

From time to time, i see a site become unreachable from one or more of the other VPN sites - the fix is to get to that cluster either directly, or via the non-VPN management server, and run vpn tunnelutil and "Delete all IPsec+IKE SAs for ALL peers and users" - that site becomes available immediately.

Any troubleshooting ideas - not knowing when it will happen, or how to trigger it makes setting up anything in advance difficult.

"permanent tunnels" is not turned on - would that setting add value here?

thanks.

dave

Re: Intermittent VPN issue

Vladimir — Fri, 21 Jun 2019 09:02:21 GMT

Looks like this may be the case.

Take a look at https://community.checkpoint.com/message/11233-re-unstable-vpn-tunnels post.

Re: Intermittent VPN issue

Maarten_Sjouw — Sat, 09 Mar 2019 13:48:37 GMT

Allways when you use Check Point to Check Point tunnels turn on the Permanent tunnels and set the community to 1 tunnel per gateway pair.

This will makes sure your tunnels remain solid, so far I have never seen problems like these when we apply these settings.

Re: Intermittent VPN issue

D_TK — Sun, 10 Mar 2019 19:35:38 GMT

Thanks for the info. I have made the change to permanent tunnels, hopefully this will resolve the issue.

thanks

Re: Intermittent VPN issue

Jesse — Tue, 17 Sep 2019 19:55:41 GMT

Did the permanent tunnels solution fix your issue?