After a while VPN is going down

[starmen2000]

Hi Mates,

We have recently established an S2S VPN connection between Checkpoint and Barracuda FW. They are able to communicate effectively over this VPN. However, when a remote desktop connection is initiated between the two sites, after 10-15 minutes, the S2S VPN is automatically reset, and the tunnel is established again. As a result, the RDP connection is lost. Upon examining the logs, I discovered that when the connection is lost, the other site sends a "delete SA" message, which causes the tunnel to reset. What might be causing the tunnel to reset and how we can fixthis issue?

Thanks

[Chris_Atkinson]

How's is the encryption domain currently configured?

Refer also:

sk142355 - keep_IKE_SAs

sk108600 - Scenario 4

[starmen2000]

IKEv1

Phase 1

AES-256

SHA-256

Group 14

Renegotiate : 86400 sec

Phase 2

AES-256

SHA-256

Renegotiate : 3600 sec

Group 14

Perfect Forward Secrecy is enabled

[starmen2000]

log says after a while, when the tunnel went down -->  Informational Exchange Received Delete IPSEC-SA from Peer: 3.party external IP. 

[Timothy_Hall]

Your IKE Phase 1 and Phase 2 timers do not match on both sides.  The tunnel will start even though they don't match and you will see behavior like this.  Unfortunately Check Point chose to express the Phase 1 timer in minutes and the Phase 2 timers in seconds, while most other vendors express both values in seconds so double-check that they really match on both sides.

[_Val_]

Second that.

[starmen2000]

Actually Phase 1 and Phase 2 timers match.  But it is interesting, on barracude site there is max and min life time options. Normal lifetime options already match. But min/max lifetime is different. You can see in the attachment.

And also one point, After I reset the vpn, before tunnel goes up, fw received a message from other site, that "Quick Mode received Notification Peer: Invalid payload type" and " Payload malformed". But then vpn goes up, while vpn up in 30 min tunnel is resetted automatically. 

[the_rock]

Make sure option for "keep ike SAs" in global properties is checked as @Chris_Atkinson mentioned. I cant open the attachment from your last response, but not 100% certain what those timers options would equate to on CP side.

[starmen2000]

Keep ike SA is already checked in global properties.  Following picture is from other site. Barracuda.

[the_rock]

I cant find any timer settings on VPN community except under advanced tab in community itself (Im sure thats been like that for the last 25 years with CP vpn), but I did find below. Not sure this would help you, but I agree with @Timothy_Hall 

Andy

[Timothy_Hall]

Set Min, Max, and Lifetime to the same value on the Barracuda matching the Check Point timers.  Anything that brings down the tunnel early (idle time, data lifesize) in an interoperable scenario will hang the tunnel and produce the behavior you are experiencing.

[Matlu]

Hello,
I am having a problem with an S2S VPN with a third party, where every 4 to 5 hours, the tunnel goes down.
I have several other tunnels with other clients that are working fine.
Could this be a problem with the remote peer at the PUBLIC IP level?
Is there a command that can help me validate the negotiation, perhaps with tcpdump or cppcap?
Thank you.

[the_rock]

Any relevant logs you can send?

[Matlu]

The logs that I find suspicious are sequential; I see some “REJECT” messages followed by a “KEY INSTALL.”

It works well for a few hours, and then suddenly the tunnel collapses.

[the_rock]

So does not like something with phase 2...just wondering, how is tunnel management configured? per subnet. gw, host?

[Matlu]

Per Subnet ....

[the_rock]

Route based, domain based? Permanent tunnel?

[Matlu]

It is domain-based.
The resources behind the remote pair are IPs with /32, but on my side, I have /24.
Is it necessary to set it per host?
The permanent tunnel is enabled.

[the_rock]

From my experience, when you have comination of hosts and subnets, per gateway is the right option.

[Matlu]

Sorry, my mistake.
Permanent tunneling is disabled.
But I don't think that's the problem because most of my other VPNs work fine.

So in scenarios where HOST vs SUBNET are combined, is it better to set “per GW”?

[the_rock]

Might be worth enabling permanet tunnel option and yes, per gw should be set in your case. What is the other side?