topic Re: Remote VPN Isssue [during stress testing] in SASE and Remote Access

Remote VPN Isssue [during stress testing]

Daniel_A — Tue, 24 Jan 2023 13:47:57 GMT

Dear All,

We have deployed remote VPN access, the remote VPN is stable and works fine. However, when we run a query for service stress testing with high traffic volume using the remote VPN, it immediately kicks out from the server. This is, therefore, to request your usual assistance in resolving the issue.

Regards,

Re: Remote VPN Isssue [during stress testing]

PhoneBoy — Wed, 25 Jan 2023 04:56:08 GMT

Let's start with some basic information like:

Version/JHF of gateway
VPN client version
What precisely happens in a "service stress test"
What precisely do you mean by it "kicks out from the server"

Any other pertinent details would be helpful.

Re: Remote VPN Isssue [during stress testing]

Daniel_A — Wed, 25 Jan 2023 05:54:52 GMT

We hope you are doing well. We really appreciate your prompt response.

Version/JHF of gateway

Answer: 120

VPN client version

Answer: We are currently using SNX.

What precisely happens in a "service stress test"

Answer: Currently, system developers use a remote VPN connection to stress test newly

developed applications. Previously, such testing was done on-site.

What precisely do you mean by it "kicks out from the server"

Answer: We've noticed that when a system tester runs a query, it is likely to be quite expensive in terms of network traffic. In this case, the tester will immediately be disconnected from the RDP, but the remote VPN will still be running.

Questions:

Is it possible to use a remote VPN for high-volume file transfers?

Re: Remote VPN Isssue [during stress testing]

G_W_Albrecht — Wed, 25 Jan 2023 07:16:44 GMT

Version/JHF of gateway

Answer: 120

This is no CheckPoint version / JHF ! Any RA or S2S VPN connection is throttled, to get the full speed you have to use more than one process / connection at a time. But why do such app stress tests over VPN ? Never encountered that. Sounds like you stress your RDP connection only... With what error message the connection stops ?

Re: Remote VPN Isssue [during stress testing]

PhoneBoy — Wed, 25 Jan 2023 18:29:28 GMT

"120" is not a valid version, it should be something of the form Rxx.yy JHF Take zz.
You can obtain this information using the CLI command cpinfo -y all.

Note that SNX uses Visitor Mode and, in earlier releases, the number of connections supported is limited.
See: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk36128&partition=Basic&product=IPSec
If you're on R81 or above and you can consistently reproduce this issue, I recommend opening a TAC case.

Re: Remote VPN Isssue [during stress testing]

Chris_Atkinson — Thu, 26 Jan 2023 05:01:50 GMT

R80.40 JHF T120 (August 2021), what hardware model and how is the load on the Gateway itself during the test ?

The following could be relevant:

sk87760 - SNX fails during large file transfers