topic Re: The site to site VPN between CheckPoint just won't bring up automatically after reboot in Spark Firewall (SMB)

The site to site VPN between CheckPoint just won't bring up automatically after reboot

MTS — Wed, 11 Aug 2021 15:04:55 GMT

Hi,

We just set up a VPN community for both CheckPoints for two remote sites.

Both CheckPoints are managed by the same SMS.

We find that even we configure the permanent tunnel for the community and install the policy package for it to both CPs.

The site to site VPN between CheckPoint just won't bring up automatically after reboot

Now, we have to get the Smartview and manually reset the Tunnel to bring it up...

How to fix this?

By the way, we have another three VPN tunnels' communities connecting to Fortigate and PaloAlto, and no the same issue was found...

Re: The site to site VPN between CheckPoint just won't bring up automatically after reboot

PhoneBoy — Wed, 11 Aug 2021 15:59:21 GMT

What version/JHF?
What messages appear in the firewall logs?
Anything odd in $FWDIR/log/vpnd.elg?

Re: The site to site VPN between CheckPoint just won't bring up automatically after reboot

MTS — Thu, 12 Aug 2021 00:59:49 GMT

What version/JHF?
the latest.

What messages appear in the firewall logs?

Seems no error?

I will just reset / reinstall the policy package then the VPN will up again,

Anything odd in $FWDIR/log/vpnd.elg?

Nope.

Re: The site to site VPN between CheckPoint just won't bring up automatically after reboot

the_rock — Thu, 12 Aug 2021 01:46:40 GMT

Ok, so if its brand new community, we know for sure it never worked before...phoneboy made a good point, usually vpnd* files in $FWDIR/log would give some indication about possible failures...have you tried running vpn debug ikeon and vpn debug ikeoff when this occurs and then examine ike.elg file?

Re: The site to site VPN between CheckPoint just won't bring up automatically after reboot

PhoneBoy — Thu, 12 Aug 2021 03:29:09 GMT

The latest version is R81.10 which doesn’t have a JHF yet.
Is this what you are running?
If not, please state the precise version/JHF you are running.

Might want to look at the general VPN debug steps here: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk34467&partition=Advanced&product=IPSec
In General, the more information you provide, the more likely we can help you.

Re: The site to site VPN between CheckPoint just won't bring up automatically after reboot

MTS — Thu, 12 Aug 2021 12:39:44 GMT

How to check the version/JHF?

Re: The site to site VPN between CheckPoint just won't bring up automatically after reboot

the_rock — Thu, 12 Aug 2021 12:50:12 GMT

cpinfo -y all from expert mode

Re: The site to site VPN between CheckPoint just won't bring up automatically after reboot

MTS — Thu, 19 Aug 2021 02:59:02 GMT

This command can not be used for SMB model.

No "-y"

Re: The site to site VPN between CheckPoint just won't bring up automatically after reboot

PhoneBoy — Thu, 19 Aug 2021 06:56:11 GMT

For SMB, you can see the exact version and build in the WebUI, which should have been provided at the beginning of this thread.
In general the more information you can provide us about your environment, the easier it is for us to help you.

The general VPN debugging SK I linked to earlier should still be helpful on SMB.
See also: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk160972&partition=Advanced&product=Quantum

Re: The site to site VPN between CheckPoint just won't bring up automatically after reboot

G_W_Albrecht — Thu, 19 Aug 2021 07:15:19 GMT

I would suggest to involve TAC !

Re: The site to site VPN between CheckPoint just won't bring up automatically after reboot

MTS — Fri, 20 Aug 2021 07:29:22 GMT

Version:

1570 GW: R80.20.25

Re: The site to site VPN between CheckPoint just won't bring up automatically after reboot

G_W_Albrecht — Fri, 20 Aug 2021 08:11:11 GMT

Which Build, 992002136 ?

Re: The site to site VPN between CheckPoint just won't bring up automatically after reboot

MTS — Mon, 23 Aug 2021 00:58:16 GMT