topic Re: fresh installation VPN client - connectivity with the VPN service is lost in SASE and Remote Access

fresh installation VPN client - connectivity with the VPN service is lost

EricR — Mon, 10 Oct 2022 15:45:00 GMT

Hi guys,

I tried to installed latest version of checkpoint Remote Access Clients for Windows E86.60 and 86.70 (MSI files).
Installation finished but get immediately popup notfication of "connectivity with the VPN service is lost"

I see these error events...

If I try an older version like E86.50 on the same device it works!
Please tell me what I am doing wrong?

Tanks & Regards,
Eric

Re: fresh installation VPN client - connectivity with the VPN service is lost

PhoneBoy — Mon, 10 Oct 2022 18:52:45 GMT

Recommend opening a TAC case to assist with debugging this.

Re: fresh installation VPN client - connectivity with the VPN service is lost

EricR — Wed, 12 Oct 2022 07:58:54 GMT

OK, I will do.

Re: fresh installation VPN client - connectivity with the VPN service is lost

paredes_h — Sat, 08 Apr 2023 22:46:11 GMT

Hello,

Did you ever get this resolved? If so, how?

Re: fresh installation VPN client - connectivity with the VPN service is lost

PhoneBoy — Mon, 10 Apr 2023 23:11:22 GMT

We've had several reports of this over the last weekend.
Specifically, it appears to be related to the standalone VPN editions of E86.60 and E86.70 and the reported timing was just before/after Patch Tuesday for April.
Full Harmony Endpoint installations appear to be unaffected.

We are still investigating what exactly has triggered the issue and its potential scope.
Some customers reported the issue was fixed by installing either E86.61 or E86.71, both of which replaced their respective versions in October 2022.
Recommend applying these versions and contacting the TAC if this doesn't resolve the issue: https://help.checkpoint.com

Re: fresh installation VPN client - connectivity with the VPN service is lost

EricR — Tue, 11 Apr 2023 07:52:56 GMT

Hi,

yes, I opened a case. Support was able to reproduce the issue when the checkpoint vpn will be installed while client has no internet connectivity. This is often a case in our environment because our clients are not allow to brows internet without user authentication.

This issue doesn't happened with older checkpoint client releases.
It don't know if they have fix the issue already!?

Re: fresh installation VPN client - connectivity with the VPN service is lost

PhoneBoy — Tue, 11 Apr 2023 15:22:41 GMT

Until we know the exact root cause, it's difficult to say the issue is "fixed."
The fact this issue is easy reproducible will certainly help in that.

Re: fresh installation VPN client - connectivity with the VPN service is lost

AndreiR — Tue, 11 Apr 2023 18:49:58 GMT

Hi,

Here is the update from VPN RnD team. It is also documented in sk180845.

Root cause and symptoms

The issue happened due to expiration of certificate which was used for signing firewall driver vsdatant.sys. Validity period of this certificate ended on April 8, 2023, VPN client became unable to initiate firewall module and failed with error “Connectivity with VPN Service is lost”. In addition, following lines can be found in trac.log:

[ 47972 44400][9 Apr 10:16:03][TR_FIREWALL] CFirewallWrapper::InitFirewallMonitor: ERROR - lpFwMonitor_Start failed, try to wait for the service initialization
[ 47972 44400][9 Apr 10:16:03][TR_UTILS] WaitForServiceStart("vsmon")
[ 47972 44400][9 Apr 10:16:03][TR_UTILS] WaitForServiceStart: OpenService("vsmon") failed: The specified service does not exist as an installed service.
[ 47972 44400][9 Apr 10:16:03][TR_FIREWALL] CFirewallWrapper::InitFirewallMonitor: waiting for vsmon initialization failed

Affected versions

Endpoint Security VPN, versions E86.60 and E86.70

The issue impacts only “Endpoint Security VPN” flavor of standalone VPN clients which contains firewall module. Other flavors of standalone VPN client as well as Harmony Endpoint Protection (full suite) are not affected.

Mitigation

The only solution is to upgrade VPN client to newer version.

We are in RnD will improve our internal processes and enforce strict control over certificates we use inside our products.

Re: fresh installation VPN client - connectivity with the VPN service is lost

paredes_h — Tue, 11 Apr 2023 19:48:59 GMT

Thank you!

Re: fresh installation VPN client - connectivity with the VPN service is lost

jaruna — Tue, 09 May 2023 17:12:02 GMT

Hello,

I am getting the same message "connectivity with the vpn service is lost".

I tried versions:

86.50

87.20

87.10

Please give me solution.

PS Fresh installation of Windows 11.

Re: fresh installation VPN client - connectivity with the VPN service is lost

PhoneBoy — Wed, 10 May 2023 15:59:19 GMT

To investigate this issue, you will need to open a TAC case: https://help.checkpoint.com

Re: fresh installation VPN client - connectivity with the VPN service is lost

EricR — Thu, 22 Jun 2023 14:39:45 GMT

Hi Andrei,

I tested the lastet version E87.30 (98.61.4715) and can still see the same behavior.
My client don't have a active internet connection. After few minutes my virtual machine crashes!

Re: fresh installation VPN client - connectivity with the VPN service is lost

PhoneBoy — Thu, 22 Jun 2023 18:09:37 GMT

Please open a TAC case: https://help.checkpoint.com

Re: fresh installation VPN client - connectivity with the VPN service is lost

AlSeOr — Wed, 05 Jul 2023 09:49:36 GMT

Hi, Have you found a solution?

Re: fresh installation VPN client - connectivity with the VPN service is lost

EricR — Wed, 05 Jul 2023 11:11:14 GMT

Hi,
support ticket is still open --> SR#6-0003654968

I sent them my custom MSI files to reproduce the issue. I think the issue is because we configured a preconfigured VPN site which can't be reach from our deployment network. So this issue doesn't not exist when installing checkpoint vpn without a preconfigured or you have to take care that after installing your vpn site is reachable.

This wasn't an requirement in the past and I hope checkpoint will fix it.

Re: fresh installation VPN client - connectivity with the VPN service is lost

EricR — Tue, 11 Jul 2023 10:09:07 GMT

Hi all,
I got a response from the support engineer. They were able to reproduce the issue on a lab and will working on investigating.
I hope they will fix it asap.

Re: fresh installation VPN client - connectivity with the VPN service is lost

EricR — Tue, 18 Jul 2023 13:14:43 GMT

Hi,

issue seems to be resolved now!
I used a "trac.config" and "trac.defaults" from a previous checkpoint installation. This is not supported!
I did a new clean installation with the latest checkpoint vpn client and configured all the settings in UI. After that I exported from their both config files (trac.config" and "trac.defaults) and used these ones with the vpn-config tool to create a custom MSI.

I want to say thanks to checkpoint support!

Regards,
Eric