topic Re: No response from gateway for 1st packet in SASE and Remote Access

No response from gateway for 1st packet

dc09 — Fri, 02 Jul 2021 10:29:15 GMT

Hi,

i've problem with vpn connections. I added a new site, but when i try to connect, i have error: No response from gateway for 1st packet.

I found similar problem here(https://community.checkpoint.com/t5/Remote-Access-VPN/Remote-Access-VPN-No-response-from-gateway-for-1st-packet/m-p/98415#M4016) but i think my router and routing are not a problem.

How can i debug problem? What have i done so far:

vpn debug on and check logs, i did not found any errors
fw monitor -e "accept src=ip_address;" - looks good, communication is on the same eth
i can curl any site form that gateway

What else should i check?

Cheers

Re: No response from gateway for 1st packet

PhoneBoy — Sat, 03 Jul 2021 04:14:00 GMT

Is your client connecting to the gateway you are performing the debugging from?
If so, have you done an fw ctl debug drop | grep x.y.z.w

Re: No response from gateway for 1st packet

dc09 — Mon, 05 Jul 2021 09:23:09 GMT

hi,

there arent any drops from my endpoint client ip address. I noticed that i have the correct https/443 communication, but there is nothing on the 4500 port.

Re: No response from gateway for 1st packet

PhoneBoy — Wed, 07 Jul 2021 00:04:33 GMT

That would imply the NAT-T packets are getting blocked upstream somehow.
Have you tried from a different network?

Re: No response from gateway for 1st packet

dc09 — Wed, 07 Jul 2021 07:08:27 GMT

Yes, i tried two different networks and isp, but still same error.

Re: No response from gateway for 1st packet

PhoneBoy — Thu, 08 Jul 2021 05:20:14 GMT

If the gateway is not receiving the NAT-T packet that you can see, it might be something on the client side.
Can you see on the client side that it's sending the NAT-T packet?

Re: No response from gateway for 1st packet

dc09 — Thu, 08 Jul 2021 06:40:23 GMT

I have set up access to another site on the same client and everythings works fine there. I added fresh logs from trac.log.

[IKE] TimeoutEventHandler: Got Timeout event #1001 - its looks weird