R81 SNX disconnects randomly

[Dilian_Chernev]

Hi mates,

We have issue with SNX after upgrading on R81.

SNX connection disconnects at random interval - 2, 5, 13, 48 .. minutes.
Connection is re-established automatically after few seconds, but interruption is enough to drop an RDP session.

Every other VPN clients are working fine.

The issues are monitored with different Windows 10 machines.

Does any one has experience such issue?

Thanks   

[G_W_Albrecht]

What do the logs show about the disconnects ?

[Dilian_Chernev]

Unfortunately nothing useful.

In Mobile Access just a single "Authorize" record and no other logs for each disconnect/connect.
In slimsvc.log file on local machine on each disconnect has the following record :

[ 4292 4800]@antec[11 Jun 10:38:55][] T_event_do_del: no event for socket/type: 1964/1

Running debug of cvpnd doesn't show anything useful or at least I can't find.

[G_W_Albrecht]

Try installing R81 Jumbo HotFix - Ongoing Take 29 (24 May 2021), as T_13 and T_25 contain SNX fixes - see https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

[Alexander_Konon]

Hello. I'm also have the same problem.

R81 without updates. This problem persist in any browsers except IE.

Installing take 65 doesn't solve.

My SR 6-0003271671.

[Chris_Atkinson · Accepted solution]

Have you investigated sk173765?

[Alexander_Konon]

Sure. This solution was applied on R81 take 65, but didn't solve the problem.

Today evening i plan to apply that solution on take 58.

I will write about the result.

[Alexander_Konon]

Good day.
Today we tested the installation of the fix from sk173765.
1. R81 take 58 - ssl vpn breaks when trying to transfer a file via vpn. All browsers including internet explorer.
2. R81 take 58 + fix  sk173765 - the same thing, but also we got a problem with reconnecting, we can reconnect only after restart PC.

We are already thinking of rolling back to R80.40, but we really need a gre((((

[Chris_Atkinson]

Both elements of the fix from sk173765 including the latest portal update from sk168353?

Refer also: Chrome/Edge SNX disconnections on R81.10 Take 45 - Check Point CheckMates

[Alexander_Konon]

Hello Chris.

Yes, both.

[CPUpdates]
BUNDLE_ESOD_SWS_AUTOUPDATE Take: 14
BUNDLE_ESOD_SCANNER_AUTOUPDATE Take: 9
BUNDLE_R81_MTA Take: 8
BUNDLE_CORE_FILE_UPLOADER_AUTOUPDATE Take: 11
BUNDLE_GOT_TPCONF_AUTOUPDATE Take: 104
BUNDLE_R80_40_MAAS_TUNNEL_AUTOUPDATE Take: 45
BUNDLE_HCP_AUTOUPDATE Take: 54
BUNDLE_GENERAL_AUTOUPDATE Take: 12
BUNDLE_ESOD_CSHELL_AUTOUPDATE Take: 17
BUNDLE_CPSDC_AUTOUPDATE Take: 21
BUNDLE_INFRA_AUTOUPDATE Take: 55
BUNDLE_TEX_ENGINE_R81_AUTOUPDATE Take: 14
BUNDLE_DEP_INSTALLER_AUTOUPDATE Take: 23

[CheckPointerXL]

hello, same problem like Alexander.

Any update? 

[AndreiR]

Folks,

We are aware of this issue. It happens due to JavaScript throttling mechanism in Chromium-based browsers and Safari. Throttling suspends auxiliary working loop on Mobile Access Portal page, which checks state of SNX connection. Once loop is suspended, this is considered as condition to terminate SNX connection.

At this moment we are working on temporary workaround and permanent solution in parallel. Both will be published within sk173765. Please keep watching it.

We apologize for that inconvenience.

[Alexander_Konon]

Hello Andrei.

But why after installing the fix from sk173765 ssl vpn crashed also in Internet Explorer?
And i want to say some details about Take 58.

In my environment we have R81 GA without any take's and before installing take 58 we made snapshot.

After install take 58 + fix from sk173765, tried to remove fix and take 58 using CPUSE.

Uninstall fix and restart gw proceeded without issue, but after uninstall take and reboot, gw lost connectivity to network, connected using LOM interface and when input "ip a" in output i receive only info about "lo" interface.  After reboot same result. Then i revert to snapshot and all became normal.

Now we back to R81 GA.

[AndreiR]

Hello Aleksander,

I can't comment on issues with gateway as it is not in my domain. You can open support case if you still experience issues with installing GA take.

Just a heads-up on random SNX disconnects. We have several positive feedbacks from real customers and plan to make the fix available within next few weeks.

[Alexander_Konon]

Hello.

Hello.

Sorry for the long response time. My problem was solved by installing a modified fix from sk173765 provided by support.

Thank you all for your support.