Ping Request time out under vpn to azure issue

pyiephyohtay — Fri, 18 Aug 2023 06:52:35 GMT

Dear Team,

I am facing intermittent 'Ping Request Timeout' issues within an IPsec VPN connection with Azure. The tunnel is connected. Currently, we are monitoring the VPN tunnel using ICMP ping from our on-premise Zabbix server to Azure VMs.

Initially, I attempted the following method: I set the Encryption setting to 'Default Encryption (Most Compatible)' on the Checkpoint Appliance 1880 SMB (on-premise), and on the Azure side, I also used the 'Default (IPsec/IKE) policy'. This resulted in a successful 'Tunnel is connected' status.

The on-premise subnets, 10.101.0.0/16 and 10.102.0.0/16, already have security policies allowed in the Azure configuration.

Azure VNet subnets, 10.10.0.0/16, 10.11.0.0/16, and 30.203.243.64/28, also have security policies allowed in the on-premise Checkpoint firewall.

Initially, I observed that I could access Azure resources using ping, RDP, and SSH from the on-premise network. However, after approximately 6 hours, ICMP monitoring failed from Zabbix to Azure, and none of the subnet networks could reach the cloud.

As a next step, I decided to change the Default Encryption setting to a custom encryption value for both Phase 1 and Phase 2. I configured Phase 1 with AES-256, SHA-256, and DH2, and Phase 2 with AES-256, SHA-256, and PFS2 on both the Checkpoint appliance and the Azure side. This resulted in a successful 'Tunnel is connected' status.

The on-premise subnets, 10.101.0.0/16 and 10.102.0.0/16, already have security policies allowed in the Azure configuration.

Azure VNet subnets, 10.10.0.0/16, 10.11.0.0/16, and 30.203.243.64/28, also have security policies allowed in the on-premise Checkpoint firewall.

However, the problem persisted. Initially, I could access Azure resources using ping, RDP, and SSH from the on-premise network. Nevertheless, after approximately 6 hours, ICMP monitoring failed from Zabbix to Azure, and none of the subnet networks could reach the cloud.

Please kindly see the attached information

Thanks to all.

Re: Ping Request time out under vpn to azure issue

G_W_Albrecht — Fri, 18 Aug 2023 08:17:15 GMT

Does taking tunnel down and up again resolve it for a while? Where on the way do the ICMP packets get dropped ? Consult logs and sniffer.

topic Ping Request time out under vpn to azure issue in Spark Firewall (SMB)

Ping Request time out under vpn to azure issue

Re: Ping Request time out under vpn to azure issue