topic Re: New R80.10 ClusterXL gateway cluster VPN NAT issues in SASE and Remote Access https://community.checkpoint.com/t5/SASE-and-Remote-Access/New-R80-10-ClusterXL-gateway-cluster-VPN-NAT-issues/m-p/15220#M12847 <HTML><HEAD></HEAD><BODY><P>Might be worth checking this SK:&nbsp;<A class="link-titled" href="https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&amp;solutionid=sk31832" title="https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&amp;solutionid=sk31832">How to prevent ClusterXL / VRRP / IPSO IP Clustering from hiding its own traffic behind Virtual IP address</A>&nbsp;</P><P>Obviously this is the opposite of what you want, but my thought process is maybe this got configured somehow.</P></BODY></HTML> Sat, 15 Dec 2018 05:06:07 GMT PhoneBoy 2018-12-15T05:06:07Z New R80.10 ClusterXL gateway cluster VPN NAT issues https://community.checkpoint.com/t5/SASE-and-Remote-Access/New-R80-10-ClusterXL-gateway-cluster-VPN-NAT-issues/m-p/15219#M12846 <HTML><HEAD></HEAD><BODY><P>I built out a new R80.10 ClusterXL gateway (using previous cluster's policy).&nbsp; When I attempt to connect to the remote access VPN using the Virtual IP of the cluster, return traffic is sent back via the physical IP address of the gateway, not the virtual IP.&nbsp; I feel like I just missed a checkbox somewhere, but am not sure where to look.&nbsp; IPSEC gateway to gateway tunnels work fine.&nbsp; I have verified that RADIUS authentication is working and properly authenticating.&nbsp; SSL VPN hangs when authentication is successful (I believe it is because the site is no longer listening on the virtual IP).&nbsp; If anyone has any suggestions, I would really appreciate it.</P></BODY></HTML> Wed, 12 Dec 2018 17:31:37 GMT https://community.checkpoint.com/t5/SASE-and-Remote-Access/New-R80-10-ClusterXL-gateway-cluster-VPN-NAT-issues/m-p/15219#M12846 Steven_Boone 2018-12-12T17:31:37Z Re: New R80.10 ClusterXL gateway cluster VPN NAT issues https://community.checkpoint.com/t5/SASE-and-Remote-Access/New-R80-10-ClusterXL-gateway-cluster-VPN-NAT-issues/m-p/15220#M12847 <HTML><HEAD></HEAD><BODY><P>Might be worth checking this SK:&nbsp;<A class="link-titled" href="https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&amp;solutionid=sk31832" title="https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&amp;solutionid=sk31832">How to prevent ClusterXL / VRRP / IPSO IP Clustering from hiding its own traffic behind Virtual IP address</A>&nbsp;</P><P>Obviously this is the opposite of what you want, but my thought process is maybe this got configured somehow.</P></BODY></HTML> Sat, 15 Dec 2018 05:06:07 GMT https://community.checkpoint.com/t5/SASE-and-Remote-Access/New-R80-10-ClusterXL-gateway-cluster-VPN-NAT-issues/m-p/15220#M12847 PhoneBoy 2018-12-15T05:06:07Z