topic Re: VPN Client disconnects after one hour in SASE and Remote Access

VPN Client disconnects after one hour

Daniel_Peschke1 — Mon, 29 Apr 2019 06:35:24 GMT

Hello,

I ran into a problem with remote access VPN.

The connection can be established successfully and the ressources are available, but exactly after one hour the client disconnects with the error message "Failed to renew encryption keys".

In ike.elg it looks like phase 2 is failing, but everything is fine at the initial connection.

I checked and changed several lease times and renegotiation times, the client still disconnects after one hour.

I already have a service request open since three weeks now with no solution.

Did anyone experience this before?

Re: VPN Client disconnects after one hour

_Val_ — Mon, 29 Apr 2019 07:00:39 GMT

This is a classic case. Please make sure CRL on the Management is available through VPN or is not encrypted.

Re: VPN Client disconnects after one hour

Daniel_Peschke1 — Mon, 29 Apr 2019 10:14:33 GMT

How can I check these parameters? (I am kinda new to Check Point)

Re: VPN Client disconnects after one hour

Daniel_Peschke1 — Mon, 29 Apr 2019 12:00:15 GMT

How do I check those parameters? (I'm kinda new to Check Point)

Re: VPN Client disconnects after one hour

Martin_Raska — Mon, 29 Apr 2019 16:16:10 GMT

Are you using certificates for authentication?

Re: VPN Client disconnects after one hour

Daniel_Peschke1 — Tue, 30 Apr 2019 08:08:40 GMT

There are no certificates for the clients, but a SSL certificate for the gateway. So the clients connect to the domain-name and not to the IP of the gateway. But I also tried to connect to the IP and got the same error.

For authentication I am using Identity Awareness with AD-Query and local configured users. The error occurs on both of them.

More information to the gateway - it's a stand-alone solution on R80.20 and Endpoint Security E80.92.

Re: VPN Client disconnects after one hour

yigiterol — Sat, 18 Jan 2020 20:04:25 GMT

Hello,

Did you find a solution for this?

Re: VPN Client disconnects after one hour

Jeff_Gao — Sat, 21 Mar 2020 13:38:30 GMT

@Daniel_Peschke1. Did you find a solution fot this issue? i also have the same issue.

Re: VPN Client disconnects after one hour

Daniel_Peschke1 — Sat, 21 Mar 2020 14:09:56 GMT

Hello,

It took me some days to notice, but we had a misconfigured NAT rule. A static NAT from gateway IP to a server in the DMZ.

Re: VPN Client disconnects after one hour

Volodymyr — Fri, 17 Apr 2020 09:33:58 GMT

I had the same problem on R80.10 and then R80.30 gateway. It was solved today with TAC (SR 6-0001915434).

Needs to change the parameter on file $FWDIR/boot/modules/fwkern.conf:

natt_probe_do_in_kernel=0

Re: VPN Client disconnects after one hour

Per_Opel — Wed, 28 Oct 2020 09:01:58 GMT

Did you get any explanation on what this kernel attribut does? We're having the same issue with rekey started a few days ago (despite that nothing has changed regarding policy or fw-version).

We're using 80.30 take 217.

Yesterday I rebooted the gateways and after that I executed fw ctl set int natt_probe_do_in_kernel 0 on one of the gateways (the active one).
Since then I don't have the issue with rekey but if it was the reboot or the kernel param update which solved remains to find out.

Re: VPN Client disconnects after one hour

PradeepSonawne — Sat, 05 Aug 2023 09:56:39 GMT

I am also facing the same kind of issue and also raised the ticket with TAC but as of now no Cath on the issue, But they suggested the same command and we did that, but the issue remains the same.

We are in the Maestro environment R81.10 and my GW is in Active Active, If I execute the below commands do I need a reboot of GW?

Thanks in advance

Re: VPN Client disconnects after one hour

Volodymyr — Mon, 07 Aug 2023 09:06:52 GMT

Hi,

if you`re talking about natt_probe_do_in_kernel=0, note it is not command, it is string in $FWDIR/boot/modules/fwkern.conf file.

And sure, any changes of $FWDIR/boot/modules/fwkern.conf file will be applied after reboot of GW.

Re: VPN Client disconnects after one hour

Srihari_E — Thu, 04 Apr 2024 13:09:41 GMT

we using p12 certificate authentication