IP pool Source NAT issue R82.10 L2TP + IPsec

[saitoh]

Hi experts,

Env:

CP3950 clusterXL R82.10 jumbo take 22

VM management server R82 jumbo take 44

I tested CP3950, and L2TP users cannot access internal resource when VPN connection established.

I migrated all visible configuration from the actual environment, including database of management server, to two of CP3950, and VM management server.

The original product environment provides wide range of availability with L2TP users, so I did not expect it failed on CP3950.

All visible configuration such as GAiA configurations, and management server database are same as I double-checked, so I thought I might have missed some kernel parameters.

I noticed log says an unfamiliar IP address (10.127.45.X) for the connection of L2TP user while xxx.xxx.252.x/24 is expected.(IP Pool NAT)

Therefore, I hit google, and found seemingly related sk (sk172805).
https://support.checkpoint.com/results/sk/sk172805

I am not certain if this is relevant or not...

Any comments are more than welcome, but since the appliances are not within my reach log retrieving takes time.

Thanks in advance.

Saitoh

[Chris_Atkinson]

I don't believe your issue matches this, if you've confirmed the office mode address range and NAT configuration please open an SR with TAC to investigate further.

[the_rock]

Hey mate,

Greetings to Japan and Happy New Year!

I tend to agree with Chris, does not seem to me that sk would be 100% relevant in your specific case. Definitely best to open TAC case and let them confirm.

[PhoneBoy]

I'm guessing this is related to the move to UPPAK, which you probably weren't running in the older environment.
TAC will definitely need to be involved. 

[idants · Accepted solution]

Hi,

Thank you for the feedback.

I asked to check your case in our lab, and indeed seems that there is a bug which cause this behavior.

We are working to fix it and the fix will be included in one of the next JHF releases (#1 or #2).

Thanks,

Idan Tsarfati

R&D Director 

[saitoh]

Hi @PhoneBoy , @the_rock , @Chris_Atkinson ,

Much appreciated to your comments! It is fortune for me and the community that you legends are always here to help us 🙂

and thanks for conforming this behavior @idants!

I will open an TAC case to ask them for a bit more details.

Saitoh

[the_rock]

Im sure it will be fixed soon, as @idants indicated.

日本へのご挨拶

I hope google translate did that right : -)