topic Re: R82 to R82.10 - VPN Issues in General Topics

R82 to R82.10 - VPN Issues

Wayne_Hammond — Mon, 06 Jul 2026 15:23:00 GMT

Hi,

Had a weird issue that has never happened before. Upgrading caused a weird VPN issue going from R82 to R82.10

Upgrade worked fine, running tests, last one VPN failed - when testing with Capsule via Android, IOS or Windows I got capsule conenctions failing - message either malfomed reply from site or SSL error - failed to read data from site

Logs showed certificate mismatch

When connecting - VPN is connecting to fw2.*******.com, but gateway present default certificate

CN = ****** VPN Certificate

No matter what I do to state use fw2 cert, still fails

Any thoughts or ideas greatly appreciated

Currently rolled back snapshot so I can get VPN's working

Regards

Wayne

Re: R82 to R82.10 - VPN Issues

Lesley — Mon, 06 Jul 2026 20:21:47 GMT

Did you install a recent jumbo update after the R82.10 installation? Otherwise you will encounter:

PRJ-66998,

PRJ-67000,

PRJ-67034,

PMTR-124920,

PRHF-44366

VPN, Internal CA

Starting March 1st, 2026, newly created certificates and newly generated CRL may fail validation. Refer to sk184766.

Re: R82 to R82.10 - VPN Issues

PhoneBoy — Mon, 06 Jul 2026 22:11:53 GMT

Aside from the cert thing @Lesley mentioned, just confirming you installed policy AFTER upgrading to R82.10?
Installing policy with the gateway object set to the correct version is a necessary post-upgrade step.

Re: R82 to R82.10 - VPN Issues

Wayne_Hammond — Tue, 07 Jul 2026 06:57:28 GMT

Cheers, so the 15th Jun R82.10 build doesnt include the CRL validation HF?

Re: R82 to R82.10 - VPN Issues

Wayne_Hammond — Tue, 07 Jul 2026 06:57:47 GMT

I pushed policy

Re: R82 to R82.10 - VPN Issues

emmap — Tue, 07 Jul 2026 07:06:33 GMT

If you upgraded using the combined R82.10 / JHF take 24 package, then yes that fix was included.

Re: R82 to R82.10 - VPN Issues

Wayne_Hammond — Tue, 07 Jul 2026 07:09:41 GMT

yes i used - R82.10 Security Gateway + JHF T24 for Appliances and Open Servers

So still a bit confused

Re: R82 to R82.10 - VPN Issues

Wayne_Hammond — Tue, 07 Jul 2026 13:35:05 GMT

As a follow up i built an lab test R82 open server in VMware - configured it, this time just using default certificate - VPN works from test laptop. Took a snapshot - upgraded to R82.10 - changed build, pushed policy - VPN fails - so something else is happening I think?

Re: R82 to R82.10 - VPN Issues

PhoneBoy — Tue, 07 Jul 2026 15:08:06 GMT

Best to get TAC involved here.

Re: R82 to R82.10 - VPN Issues

Wayne_Hammond — Wed, 08 Jul 2026 18:15:39 GMT

I have logged a case with TAC - in the meantime here is some further info, to see if you guys can possibly assist?

I have two standalone (non-clustered) gateways:

FW1 – currently running R81.20
FW2 – currently running R82

The current Remote Access VPN Community contains FW1 only.

Capsule VPN works on both

Endpoint Security VPN works on FW1 - which is fine for our needs as it is used as primary work connection - staff use FW2 when we need to work on FW1.

FW2 (R82)

NOT a member of the Remote Access Community
IPsec VPN configured
VPN Clients configured
Mobile Access configured

Result:

Capsule VPN works successfully

(Although Endpoint Security VPN is not currently used against this gateway.)

R82.10 Testing

When FW2 is upgraded to R82.10, Capsule VPN fails unless FW2 is added to the Remote Access Community.

After adding FW2 to the Remote Access Community and installing policy:

Capsule VPN works

Endpoint Security VPN works

So has there has been a behavioural or configuration change in R82.10 which now requires a Security Gateway to be included in a Remote Access Community for Remote Access VPN functionality?

My understanding is that:

FW2 on R82 successfully accepts Capsule VPN connections without being a member of the Remote Access Community.
The same gateway on R82.10 does not.
Adding the R82.10 gateway to the Remote Access Community immediately resolves the issue.

Is this:

Expected behaviour in R82.10?

I have built a VM R82 - taken a snapshot - configured it exactly like my FW2 and Capsule connections work.

Upgrade to R82.10 Capsule fails, make it a member of Remote Access VPN community, Capsule and Endpoint work.

So there is clear picture R82.10 requires RA VPN, whereas R82 seemed not to be so fussy?

So is there;

A documented configuration requirement that was not enforced in earlier releases?
A known issue/PMTR affecting gateways not participating in a Remote Access Community?

Re: R82 to R82.10 - VPN Issues

PhoneBoy — Wed, 08 Jul 2026 23:15:46 GMT

Based on your description and the fact we require the gateway being in the RemoteAccess VPN community for other clients, I'd say it was a requirement not enforced in earlier releases.
TAC should be able to confirm.

Re: R82 to R82.10 - VPN Issues

Wayne_Hammond — Thu, 09 Jul 2026 06:39:32 GMT

Thanks - I will wait for TAC

Re: R82 to R82.10 - VPN Issues

Patro — Fri, 09 Oct 2026 13:31:27 GMT

Where you able to solve this as I just opened TAC case for similar issue, after patching VPN between R82 and R82.10 stopped working.

Re: R82 to R82.10 - VPN Issues

Wayne_Hammond — Sat, 10 Oct 2026 08:32:13 GMT

Hi,

Was advised by TAC not to upgrade and stay on R82.

Re: R82 to R82.10 - VPN Issues

Alex- — Sat, 10 Oct 2026 08:41:53 GMT

You mean, it's not recommended to upgrade to R82.10 in case of IPSEC VPN?

Any indication of an upcoming JHF for this?

Re: R82 to R82.10 - VPN Issues

Wayne_Hammond — Sat, 10 Oct 2026 08:43:49 GMT

Yes. They said R82 is the recommended version and not to upgrade yet. No idea about JHF release

Re: R82 to R82.10 - VPN Issues

RemoteUser — Sat, 10 Oct 2026 19:58:01 GMT

Mmm based on this sk https://support.checkpoint.com/results/sk/sk95746

R82.10 with its Recommended Jumbo Hotfix Accumulator Take is considered as Check Point Recommended version starting from August 12, 2026.
Not sure why TAC told this...