CLoudGuard Azure - Remote Access Disconnecting within 20secs

[Brad135631]

Afternoon,

Im fairly new to CP and setting up a POC for migrating our on prem to Azure.  Ive been playing with RemoteVPN and OfficeMode and set it up along with Azure SSO.  But Im getting some strange issues...

If I configure IPSEC VPN > Link Selection to Calculate Base on Topology - I can VPN in successfully and access stuff.

However, when I disconnect and reconnect, the Endpoint security gateway address changes to 10.0.0.4 (eth0) thus unable to reconnect.

I tried to change to Statically NAT IP with the external IP which Azure NATs to 10.0.0.4.  I can connect successfully but then I get in a reconnect loop every 15s. 

Ive going through a bunch of docs and struggling to find an answer.

CP instance has been deployed from the marketplace.

Has anyone ever come across this before?

Thanks,

Brad

[PhoneBoy · Accepted solution]

You need to change the Link Selection settings, which default to the Main IP of the object, which is likely private.
See: https://sc1.checkpoint.com/documents/RemoteAccessClients_forWindows_AdminGuide/Content/Topics-RA-VPN... 

To force the client to use a specific FQDN (because the public IP may change): https://support.checkpoint.com/results/sk/sk103440 

[the_rock]

Thats exactly what you need to do what @PhoneBoy  said. I had to follow same sk for 3 customers in the past.

[Sameer_Basha]

i faced a similar issue when used link selection as statically natted IP address. i observed tunnel tests were getting dropped and  i am seeing statically natted IP address in the logs. the error was According to the policy the packet should not have been decrypted. By logic this IP address should not appear in the logs as Azure should Nat all traffic on this IP address to to private VIP IP address on the frontend. 

To resolve the problem i added the NAT IP address to encryption domain of the remote access vpn. the disconnection stopped and i started seeing the tunnel tests to the correct IP address. 

My environment is on R82 Take 60.