IPSec VPN tunnel stuck at phase 1 ESP traffic dropped

[ganaarya]

Hi all,

So, we're currently having issue with our IPSec vpn tunnel, where all of the tunnels stuck at phase 1 when i saw the status on SmartView Monitor. Btw, we are using ClusterXL that has two cluster member (80.20 gateway).

Log for outbound traffic via ipsec tunnel shows encrypted status. But there is no inbound traffic.

Our log indicates that ESP Traffics are dropped and "Packet is dropped because an IPsec SA associated with the SPI on the received IPsec packet could not be found" and there is also error regarding Unknown SPI.

I looked for list of IKE and IPSEC sa using "vpn tu" on the active cluster member (FW-1). It showed nothing. There are no IKE and IPSEC sa on the active cluster. But on the standby member (FW-2), it showed the list of IKE and IPSEC sa.

I tried to bring up the standby member (FW-2), but the error still the same. Now it's the opposite. The IPSEC and IKE did not show up on FW-1 (active member), but they were present on the FW-2 (standby member).

Now i'm thinking about disabling and enabling the IPSec VPN software blade for the cluster. how do you think of this?

Kindly need your help and advise regarding this issues.

[Timothy_Hall]

> Our log indicates that ESP Traffics are dropped and "Packet is dropped because an IPsec SA associated with the SPI on the received IPsec packet could not be found" and there is also error regarding Unknown SPI.

The other end doesn't realize the tunnel is dead and is continuing to send traffic referencing a tunnel that no longer exists on the Check Point side.  The other end needs to reset its tunnels, this is most typically caused in an interoperable VPN scenario where "Delete SA" notifications are not being handled properly between the peers after a peer gateway restarts, or the IKE Phase 1 and Phase 2 SA timers do not match between the two sides.

[YuriiBilyi]

Hello everybody,

I confirm this behavior on version 80.30 taka 191.
The VPN solution is very unstable.

For stability, I clean all IKE+IPSEC via 'vpn tu' every week.

[bmomartins]

I am facing the same issue.

Any solution on this? Already opened a support case, but they don't seem to know what to do...

[YuriiBilyi]

I found and removed all the host objects which had IP address used in the gateway object. This stabilized the VPN.

[Lars_S_]

I have exactly the same problem with one VPN location.

We have 2 other VPN locations what operates without  any issues.
We moved to R80.40 and since then we have the problem with one site-to-site VPN.
The VPN tunnel diconnects from our main site but the SMB (1450) holds still the VPN.
So the VPN isn't coming back until I remove the tunnel from the SMB (vpn tu).

What for host objects did you delete?
Host object with the public IP address or object with internal ip addresses?

[YuriiBilyi]

Hi,

Public IP address.

I think your case is different. Have you tried turning on "Permanent Tunnels"?

[Lars_S_]

Hi,
yes, yesterday I changed it back to a permanent tunnel and today I the problem is worse than the other days.
VPN tunnel disconnected 4 times now.
It came back aftet deleting the SAs from the SMB (vpn tu).

"Packet is dropped because an IPsec SA associated with the SPI on the received IPsec packet could not be found"

"Unknown SPI: 0x627e7f34 for UDP encapsulated IPsec packet."

I opend a ticket some weeks ago but they couldn't help.
Nothing in ike and vpn logs what could explain the problem.

[Lars_S_]

Maybe it's time for the solution?
The problem was the firmware of our 6000 check point in our headquarter.

Some weeks after my post here check point released a new firmware with a LOT bugfixes regarding ipsec.
Since then the problems are gone.

[_Val_]

@Lars_S_ you are answering a thread which is two years old. What are you trying to say?

[jbeckner]

Tell us please - what version did you go to that fixed the issue? And what was it on before if possible?

Command line: "fw ver" and "show version all"