topic Re: Why does IPsec VPN auto-reconnect fail on mobile devices but not PCs? in SASE and Remote Access

Why does IPsec VPN auto-reconnect fail on mobile devices but not PCs?

Ok1 — Tue, 24 Dec 2024 09:11:42 GMT

We have IPsec VPN, between iOS and Android mobile users with Capsule VPN. There are also computer versions with this client. There is DHCP in all networks, and judging by the logs, when the IP changes on clients, auto-reconnect fails on mobile devices. Only if you reconnect manually and then it works. However, we don't see this behavior on the PC clients. Auto-reconnection succeeeds when the IP changes. Our users with whom the problem occurs are not traveling, so DHCP is the only factor we can think of that results in IP changes.

Earlier there was a post in CheckMates, where there are similar errors as we have are and PhoneBoy provided an answer that this is normal behavior:
https://community.checkpoint.com/t5/Mobile/VPN-Capsule-reconnecting-fails-after-client-changing-IP/m-p/220209#M1157

Why, then, don't we see a similar behavior on PC clients?

Re: Why does IPsec VPN auto-reconnect fail on mobile devices but not PCs?

PhoneBoy — Tue, 24 Dec 2024 14:06:42 GMT

I presume we are limited by the mobile OS in a way that we aren’t on Windows/MacOS where we can use our own implementation of IPsec VPN and have less restrictions in operating apps in the background.

Re: Why does IPsec VPN auto-reconnect fail on mobile devices but not PCs?

the_rock — Tue, 24 Dec 2024 14:17:44 GMT

Is it same behavior on all PCs?

Andy

Re: Why does IPsec VPN auto-reconnect fail on mobile devices but not PCs?

Ok1 — Wed, 25 Dec 2024 07:45:18 GMT

@PhoneBoy @the_rock

I apologize, I will edit the problem, the PC version has nothing to do with this problem. Reconnection occurred on mobile devices if we used another Check Point cluster similar to the problematic one as a VPN gateway.

Can you tell me if there is any information in SK or in any documentation about limiting mobile version clients to reconnect related to IP address change?

Re: Why does IPsec VPN auto-reconnect fail on mobile devices but not PCs?

PhoneBoy — Thu, 26 Dec 2024 18:01:55 GMT

Given there are significant differences between our VPN client implementation on PCs versus mobile devices, some differences in behavior certainly exist.
I have not seen any official documentation related to the issue you raise, however.
Your best bet is to consult with TAC.