topic Remote Access VPN Issue on /31 ISP in General Topics

Remote Access VPN Issue on /31 ISP

madu1 — Fri, 20 Sep 2024 17:18:33 GMT

I've got an R81.20 gateway where everything works fine, including Remote Access VPN.

Today I've tried to switch to a new ISP circuit. The new circuit is a /31 subnet, so just the firewall and the ISP router. Interface IP, default gateway, Toplogy etc. all updated. Everything else works fine - Internet access, NAT (in and out), email in and out. But Check Point Mobile clients will no longer connect.

In tcpdump I see the client sending traffic hitting the firewall and it's accepted in the logs on the correct rule, but the gateway never answers. It's like the traffic just falls into a black hole. Turning on remote access Control Connections in Global Properties makes no difference either.

I switched back to the old ISP line (on a /29 subnet) and VPN clients work perfectly again.

The only difference is the new ISP circuit being a /31 subnet. Could this alone really be the reason why VPN clients won't connect? Or more specifically why the gateway receives the connecting traffic but fails to reply with a single packet back?

I know /31 subnets have been a problem in the past on SMB appliances, but is this also the case on non-SMB gateways?

Re: Remote Access VPN Issue on /31 ISP

the_rock — Fri, 20 Sep 2024 17:29:47 GMT

According to below, it is supported.

Andy

https://support.checkpoint.com/results/sk/sk91020

Now, just to confirm, is it the case where you create a site, but user cant connect?

Re: Remote Access VPN Issue on /31 ISP

madu1 — Fri, 20 Sep 2024 17:58:45 GMT

Thanks for finding that SK.

I did some more testing before I left site. I was testing with a new laptop so in fact the problem is that I cannot even create the site via the new line. Traffic gets to the gateway, the gateway never replies, and the client times out with a "gateway not responding" message.

I then put the laptop onto the LAN and was able to create the site with no problem.

After that I went back onto the Internet and tried to connect. This time it DID connect. At least as far as the SAML login pop-up. I didn't bother changing all the SAML stuff with the new URL/IP as I knew I'd need to roll back anyway, but at least it then connected. So it's just initially creating the site that doesn't work.

As soon as I went back to the old /29 ISP line I could once again create a new VPN site with no problem.

So with the old ISP and the LAN both allowing me to create a new site, I'm thinking it can only be due to the fact that the new ISP is a /31 and it won't work. I've raised a case with TAC.

Re: Remote Access VPN Issue on /31 ISP

the_rock — Fri, 20 Sep 2024 18:02:04 GMT

That all makes sense to me! Let us know how it goes.

Andy