topic Re: IPsec L2TP with ClusterXL in SASE and Remote Access

IPsec L2TP with ClusterXL

Yaroslav_Basenk — Tue, 26 May 2020 17:36:41 GMT

Hi guys,
I am trying to configure a Windows IPsec \ L2TP (Pre-shared Key) client connection for ClusterXL and for standalone gateways. Authentication through AD. I made all the settings by the SK140832. All vpn setting on ClusterXL and on others gateways are the same.

The older client support must be enabled for AD-auth support

Other settings

But the connection only works for standalone gateways. For ClusterXL, I see an error in the logs: “This IKE SA should be used only for L2TP. Probably a computer certificate. "

For ClusterXL:

For others standalone gateways - the connection is perfect

Does anyone have an idea - why?

Re: IPsec L2TP with ClusterXL

PhoneBoy — Wed, 27 May 2020 00:06:03 GMT

There were definitely some issues with L2TP previously: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk145895
Recommend applying the latest GA Jumbo Hotfix.
If you're still having an issued, best to engage with TAC.

Re: IPsec L2TP with ClusterXL

Yaroslav_Basenk — Fri, 29 May 2020 07:21:51 GMT

The Take 196 solved the issue.