topic Re: Client VPN issues after installing Jumbo, regardless of R80.20 or R80.30 in SASE and Remote Access

Client VPN issues after installing Jumbo, regardless of R80.20 or R80.30

Thomas_Eichelbu — Tue, 20 Oct 2020 13:12:08 GMT

Hello Check Mates,

on several occasions we have encountered a failure of the whole Client VPN functionality after we have installed "a HFA".
We see this happen on R80.20 after installtion of 184 for example.
Also on R80.30 when upgrading from Take 140 to Take 219.
So iam not sure if it is directly related to a specific constellation from where the upgrade starts or what blades are enabled.

The errors are not always the same, sometimes the VPN client just cannot connect, or the connect is successful but all traffic hits the cleanup rule ...

there are such SK´s like
"After upgrading R80.20 Security Gateways to Jumbo take 103 or above, Remote Access users can no longer connect with Endpoint Security VPN" sk164240

My question is very general, can you confirm the same, that some certain HFA just disable the RAS VPN?

What are your stories about this? Have you seen this before?

best regards
Thomas.

Re: Client VPN issues after installing Jumbo, regardless of R80.20 or R80.30

G_W_Albrecht — Tue, 20 Oct 2020 14:00:07 GMT

I have seen RA VPN client issues a lot before - mostly they are caused by miss configuration. There also have been some bugs introduced by Jumbo HFAs, like the one from sk164240 you mentioned, or from sk169877 or sk169152, but it is clearly not true that RA VPN was disabled 8)!

Re: Client VPN issues after installing Jumbo, regardless of R80.20 or R80.30

Thomas_Eichelbu — Tue, 20 Oct 2020 14:16:06 GMT

Hello,

well yes "disabled" is the wrong word, but we encounter alot of issues with RA VPN ...
iam not sure if "misconfiguration" is the only case ...
it works before HFA installation, after it, RA VPN fails ...

i just want to collect some feedback from other Check Point users ... i doubt to believe we are the only one running into this issues?

Re: Client VPN issues after installing Jumbo, regardless of R80.20 or R80.30

Martin_Peinsipp — Tue, 20 Oct 2020 14:39:25 GMT

Hi!

As Thomas mentioned, "disabled" was the wrong wording.

The clients are able to establish the vpn-client-connection, but the overall traffic (which is routed through the vpn-tunnel) was dropped by the clean-up-rule. The overall remote-access worked fine right before the installation of the jumbo-take. Because of this, a misconfiguration can be excluded!

All your provided SKs are not relevant for this issue.

BR
Martin

Re: Client VPN issues after installing Jumbo, regardless of R80.20 or R80.30

PhoneBoy — Sat, 24 Oct 2020 05:44:17 GMT

Perhaps certain JHF have bugs related to Remote Access VPN.
We’d probably need to gather some specific details through the TAC.

Re: Client VPN issues after installing Jumbo, regardless of R80.20 or R80.30

G_W_Albrecht — Sat, 24 Oct 2020 08:00:20 GMT

I did not think that any of the cited SKs above were relevant for your issue (that i do know nearly no details about) - i was just answering the general question posted. If the cleanup rule kills a packet that should come thru, either the rule that should match it is misconfigured or we see a new bug here. As the rue base did work before it would be for TAC to find out why it stopped to work!

Re: Client VPN issues after installing Jumbo, regardless of R80.20 or R80.30

Thomas_Eichelbu — Mon, 26 Oct 2020 12:17:31 GMT

Hello,

maybe we can try to reproduce it and generate some logs.
Since we are all gifted with the COVID-19 crap, customers heavily depend on Client VPN, messing around with it is not really welcomed ...
But perhaps we are lucky to get some data!

best regads
Thomas.