topic Re: RA VPN Connectivity Issues - SSL Extender & Endpoint Client in SASE and Remote Access

RA VPN Connectivity Issues - SSL Extender & Endpoint Client

Wyman — Thu, 23 Sep 2021 09:33:33 GMT

Hi. We're having a mixture of issues with remote access VPN connectivity to one of our offices in China. I've been working with my colleague there (I'm UK based) to troubleshoot and this is what we have found:

1) Connectivity to the SSL Extender browser page for the China office VPN doesn't work either from the UK or China (we get an ERR_EMPTY_RESPONSE browser error). This page works for our other sites; SSL Extender is selected as a connection option.

2) I'm able to connect to the China office VPN using the Endpoint Client from the UK without any issues, but when my colleague tries to do the same from China the client gives a 'site is not responding' error.

3) My colleague is able to connect to other sites' VPN successfully from China using the Endpoint Client.

We've verified the VPN settings on Smart Console and they're identical to the other sites' settings. The only difference is that the China gateways are running R80.30 and the other sites are on R80.40.

I'm using EC version E84.70 Build 986102705 and my colleague is using Version E85.20 Build 986103205

Is it more likely to be a routing issue within China, rather than a Check Point issue? I'm told it hasn't been working (the SSL Extender method) since February but nothing has changed that would affect connectivity. Please let me know if you require anymore details.

Thanks in advance.

Re: RA VPN Connectivity Issues - SSL Extender & Endpoint Client

Timothy_Hall — Thu, 23 Sep 2021 15:12:35 GMT

You will have to obtain packet captures with cppcap or tcpdump to figure out what is going on.

I have heard of flaky VPN behavior like this before and specifically for the country you mention, have you considered that a "greater" firewall is interfering with your VPN?

Re: RA VPN Connectivity Issues - SSL Extender & Endpoint Client

G_W_Albrecht — Thu, 23 Sep 2021 14:42:24 GMT

Yes, i have heard the same...

Re: RA VPN Connectivity Issues - SSL Extender & Endpoint Client

Wyman — Mon, 04 Oct 2021 12:44:27 GMT

Thanks for the responses. As I thought, it's a location issue rather than a CP issue. Thanks once again.