When the VPN Tunnel Is Up but Connectivity Is Down
A remote site reports that an application is unreachable.
The VPN tunnel appears to be established, yet traffic is not reaching its intended destination. Identifying where the problem begins can require administrators to compare tunnel information, traffic behaviour, routing, and endpoint availability.
Starting from R82, Check Point VPN Network Probes add another important layer of visibility by actively validating connectivity across Site-to-Site VPN environments.
Instead of relying only on the reported tunnel state, administrators can verify whether a selected destination or service is actually reachable.
From Tunnel Status to Active Connectivity Validation
VPN Network Probes use ICMP, HTTP, or HTTPS to test connectivity between configured sources and destinations.
On the Security Gateway, the probemond daemon performs the tests according to the probe configuration:
- ICMP probes validate IP reachability.
- HTTP and HTTPS probes send requests to the configured URL.
- Probe results identify whether the selected path or service is reachable.
The probemond command can also be used in Expert mode to review the daemon status and generate standard, extended, or live probing reports.
This provides administrators with direct evidence about connectivity rather than relying only on whether the VPN tunnel is established. Learn more about probemon in the R82 Site to Site VPN Administration Guide.
Connecting VPN Network Probes with AIOps
VPN Network Probe information is available through Skyline metrics, including:
network.probes.statenetwork.probes.modenetwork.probes.last_probenetwork.probes.last_status_change
The probe state metric also includes identifiers such as the probe name, source, and destination. This allows probe activity to be monitored as structured operational data. Review the official Skyline Network Probe metrics.
In the Infinity Portal, this information is presented in the Events & AIOps Asset Dashboard, where administrators can review VPN traffic, probe status, and tunnel information from a unified view.
Investigating VPN Connectivity in AIOps
To review the VPN information:
- Open the Events & AIOps portal.
- Go to AIOps > Asset Dashboard.
- Select the relevant Security Gateway.
- Open the VPN tab.
The VPN tab appears when VPN probing is enabled and includes four key widgets:
VPN Throughput Timeline
Shows the rate of data transfer through the VPN over time.
A significant change in throughput can help identify when VPN traffic behavior changed.
Probe Status Timeline
Shows the probe status over time.
This helps administrators identify persistent or intermittent connectivity failures that may not be apparent from the tunnel state alone.
Status of Network Probes
Shows the current status of the configured Network Probes.
Administrators can use the probe details to determine which monitored source, destination, or service is affected.
Status of VPN Tunnels
Shows the status of current Site-to-Site VPN tunnels based on the configured Network Probes.
Together, these widgets make it easier to compare traffic behavior with active connectivity results. See the official AIOps VPN dashboard documentation.
A Practical Investigation Workflow
Consider a scenario in which users at a remote site cannot reach an internal application:
- Review the VPN Throughput Timeline to determine whether traffic volume changed.
- Compare the same period in the Probe Status Timeline.
- Open Status of Network Probes to identify the affected source and destination.
- Review Status of VPN Tunnels for the broader Site-to-Site VPN status.
- If deeper investigation is required, run
probemon report extended or probemon report live on the Security Gateway.
For example, if the VPN remains available but an HTTP or HTTPS probe to the application fails, the investigation can focus on the monitored path, routing, or destination service instead of starting only with tunnel negotiation.
Why It Matters
VPN Network Probes and AIOps help security and network teams:
- Validate connectivity across selected VPN paths.
- Detect persistent and intermittent probe failures.
- Compare probe status with VPN throughput.
- Narrow the troubleshooting scope.
- Use historical context instead of relying only on the current state.
- Investigate connectivity issues before or alongside user reports.
This creates a more complete operational view of Site-to-Site VPN connectivity.
Key Takeaway
A VPN tunnel being established does not always confirm that the required destination or service is reachable.
VPN Network Probes actively test connectivity.
Skyline exposes the results as operational metrics.
AIOps brings VPN throughput, probe status, and tunnel information together in the Asset Dashboard.
The result is VPN monitoring based on observed connectivity - not tunnel state alone.
Learn More
Technical Marketing Engineering Team
