topic remote access client IP address and port were changed -log flooded in SASE and Remote Access

remote access client IP address and port were changed -log flooded

Ivailo_Yanchev — Thu, 07 Oct 2021 06:45:38 GMT

Hi community,

recently our log is floated with this message, we receive like 20 per second, most of the time it is generated from the same VPN client.

We have not receive any report of connectivity problem, and our clients are not on mobile internet. We are using E80.40 GAIA with the latest Take 125

Can someone give is more information, what could be the reason for this?

Is it possible to suppress this log reports, so that our log is not flooded with it?

Best Regards.

{Time: Today, 09:25:24
Id: ac191402-e41e-7e0f-615e-bd04001*****
Id Generated By Indexer: true
First: true
Sequencenum: 100
Message: remote access client IP address and port were changed
User: epetkova
Old IP: 192.168.5.10
Old Port: 4500
New IP: 192.168.5.10
New Port: 4500
Mobile Access Session UID: 615E9222-0000-0000-AC19-1403D37*****
VPN Feature: Endpoint Connect
Type: Log
Policy Name: StandardGT
Policy Management: GTBGFW01
Db Tag: {B289A31F-77EB-B042-ABE5-AF5FB3EE7B2F}
Policy Date: Yesterday, 15:06:00
Blade: VPN
Origin: GW
Product Family: Access
Log Server Origin: GW (192.168.1.1)
Description: remote access client IP address and port were changed}

Re: remote access client IP address and port were changed -log flooded

_Val_ — Thu, 07 Oct 2021 07:07:58 GMT

Please look into sk65331 and sk145895 (scenario 4)

Re: remote access client IP address and port were changed -log flooded

G_W_Albrecht — Thu, 07 Oct 2021 07:25:31 GMT

If this happens only for one special user, try uninstall and reinstall of (maybe newer) RA VPN client. The user is not disconnected after the message ?

Re: remote access client IP address and port were changed -log flooded

Ivailo_Yanchev — Thu, 07 Oct 2021 07:34:25 GMT

Hi,

No, all of our users are affected, just not all at the same time. Also, we updated to the newer version of CP mobile VPN client E85.30

Thank you.

Re: remote access client IP address and port were changed -log flooded

G_W_Albrecht — Thu, 07 Oct 2021 07:41:53 GMT

The user is not disconnected after the message, only logs are filing up ?

Re: remote access client IP address and port were changed -log flooded

Ivailo_Yanchev — Thu, 07 Oct 2021 07:51:29 GMT

Yes, only logs filling up. We asked some users with logs reported, and they said that everything is ok and connection is good.

Re: remote access client IP address and port were changed -log flooded

Gabriel_Rodrigu — Thu, 14 Oct 2021 19:20:10 GMT

Hi,

I'm having the same issue with a Firewall running R80.30 take 236, We have tested with the new RA client 85.40 but the issue still the same

Re: remote access client IP address and port were changed -log flooded

Ivailo_Yanchev — Fri, 15 Oct 2021 06:54:07 GMT

Hi,

Have you identified any service degradation. Is some of your user suffers any disconnects?

Also, We have started a case with checkpoint and are waiting for a patch.

Re: remote access client IP address and port were changed -log flooded

Gabriel_Rodrigu — Fri, 15 Oct 2021 12:19:49 GMT

HI,

The symptom is the same as yours, we have no degradation neither disconnections.

Regards

Gabriel Rodrigues

Re: remote access client IP address and port were changed -log flooded

Ivailo_Yanchev — Wed, 20 Oct 2021 10:13:51 GMT

We reseave a notification from checkpoint that the ongoing take 126 should fix this problem

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk165456#Take%20126

PRJ-31029

But, most likely, we will wait for general availability before implementing the patch.