topic Re: vpn warning: VPN-1 has reached its tunnel capacity in Spark Firewall (SMB)

vpn warning: VPN-1 has reached its tunnel capacity

Raymond_Poede — Wed, 22 Nov 2017 10:00:59 GMT

Hi All,

One of our decentralize Firewall Cluster (type 1180) gives the following information info:

vpn warning: VPN-1 has reached its tunnel capacity

It's part of a VPN Star Community with our central gateways (12000) R77.30

Increasing the Optimizations on the Cluster Object for:

Maximum concurrent IKE negotiations

doesn't solve the problem.

We have other decentralize Firewall Clusters (also type 1180) who do not have this problem.

Does anyone knows what it means, and how to solve this? How can i debug it?

Regards,

Ray

Re: vpn warning: VPN-1 has reached its tunnel capacity

Timothy_Hall — Wed, 22 Nov 2017 15:51:46 GMT

Your VPN Tunnel Sharing setting under Advanced Properties in the VPN Community is probably set to "pair of hosts", which creates a unique Phase 2 IPSEC tunnel for every possible combination of hosts that try to use the VPN. "Pair of subnets" is more appropriate; if that is already selected consider the "one tunnel per gateway pair" setting. Be careful changing this setting though as it can have a wide impact on VPN connectivity, best to do it during a maintenance window.

--
My book "Max Power: Check Point Firewall Performance Optimization"
now available via http://maxpowerfirewalls.com.