topic CLoudGuard Azure - Remote Access Disconnecting within 20secs in SASE and Remote Access

CLoudGuard Azure - Remote Access Disconnecting within 20secs

Brad135631 — Sat, 18 Oct 2025 15:32:29 GMT

Afternoon,

Im fairly new to CP and setting up a POC for migrating our on prem to Azure. Ive been playing with RemoteVPN and OfficeMode and set it up along with Azure SSO. But Im getting some strange issues...

If I configure IPSEC VPN > Link Selection to Calculate Base on Topology - I can VPN in successfully and access stuff.

However, when I disconnect and reconnect, the Endpoint security gateway address changes to 10.0.0.4 (eth0) thus unable to reconnect.

I tried to change to Statically NAT IP with the external IP which Azure NATs to 10.0.0.4. I can connect successfully but then I get in a reconnect loop every 15s.

Ive going through a bunch of docs and struggling to find an answer.

CP instance has been deployed from the marketplace.

Has anyone ever come across this before?

Thanks,

Brad

Re: CLoudGuard Azure - Remote Access Disconnecting within 20secs

PhoneBoy — Mon, 20 Oct 2025 15:20:25 GMT

You need to change the Link Selection settings, which default to the Main IP of the object, which is likely private.
See: https://sc1.checkpoint.com/documents/RemoteAccessClients_forWindows_AdminGuide/Content/Topics-RA-VPN-for-Win/LinkSelection-for-RA-Clients.htm

To force the client to use a specific FQDN (because the public IP may change): https://support.checkpoint.com/results/sk/sk103440

Re: CLoudGuard Azure - Remote Access Disconnecting within 20secs

the_rock — Tue, 21 Oct 2025 01:08:32 GMT

Thats exactly what you need to do what @PhoneBoy said. I had to follow same sk for 3 customers in the past.

Re: CLoudGuard Azure - Remote Access Disconnecting within 20secs

Sameer_Basha — Sat, 21 Feb 2026 22:15:32 GMT

i faced a similar issue when used link selection as statically natted IP address. i observed tunnel tests were getting dropped and i am seeing statically natted IP address in the logs. the error was According to the policy the packet should not have been decrypted. By logic this IP address should not appear in the logs as Azure should Nat all traffic on this IP address to to private VIP IP address on the frontend.

To resolve the problem i added the NAT IP address to encryption domain of the remote access vpn. the disconnection stopped and i started seeing the tunnel tests to the correct IP address.

My environment is on R82 Take 60.