RA VPN Connectivity Issues - SSL Extender & Endpoint Client

[Wyman]

Hi. We're having a mixture of issues with remote access VPN connectivity to one of our offices in China. I've been working with my colleague there (I'm UK based) to troubleshoot and this is what we have found:

1) Connectivity to the SSL Extender browser page for the China office VPN doesn't work either from the UK or China (we get an ERR_EMPTY_RESPONSE browser error). This page works for our other sites; SSL Extender is selected as a connection option.

2) I'm able to connect to the China office VPN using the Endpoint Client from the UK without any issues, but when my colleague tries to do the same from China the client gives a 'site is not responding' error.

3) My colleague is able to connect to other sites' VPN successfully from China using the Endpoint Client.

We've verified the VPN settings on Smart Console and they're identical to the other sites' settings. The only difference is that the China gateways are running R80.30 and the other sites are on R80.40.

I'm using EC version E84.70 Build 986102705 and my colleague is using Version E85.20 Build 986103205

Is it more likely to be a routing issue within China, rather than a Check Point issue? I'm told it hasn't been working (the SSL Extender method) since February but nothing has changed that would affect connectivity. Please let me know if you require anymore details.

Thanks in advance.

[Timothy_Hall]

You will have to obtain packet captures with cppcap or tcpdump to figure out what is going on. 

I have heard of flaky VPN behavior like this before and specifically for the country you mention, have you considered that a "greater" firewall is interfering with your VPN?

[G_W_Albrecht]

Yes, i have heard the same...

[Wyman]

Thanks for the responses. As I thought, it's a location issue rather than a CP issue. Thanks once again.