fresh installation VPN client - connectivity with the VPN service is lost

[EricR]

Hi guys,

I tried to installed latest version of checkpoint Remote Access Clients for Windows E86.60 and 86.70 (MSI files).
Installation finished but get immediately popup notfication of "connectivity with the VPN service is lost"

I see these error events...

If I try an older version like E86.50 on the same device it works!
Please tell me what I am doing wrong? 

Tanks & Regards,
Eric

[PhoneBoy]

Recommend opening a TAC case to assist with debugging this.

[EricR]

OK, I will do.

[paredes_h]

Hello,

Did you ever get this resolved? If so, how?

[PhoneBoy]

We've had several reports of this over the last weekend.
Specifically, it appears to be related to the standalone VPN editions of E86.60 and E86.70 and the reported timing was just before/after Patch Tuesday for April.
Full Harmony Endpoint installations appear to be unaffected.

We are still investigating what exactly has triggered the issue and its potential scope.
Some customers reported the issue was fixed by installing either E86.61 or E86.71, both of which replaced their respective versions in October 2022.
Recommend applying these versions and contacting the TAC if this doesn't resolve the issue: https://help.checkpoint.com 

[jaruna]

Hello,

I am getting the same message "connectivity with the vpn service is lost".

I tried versions:

86.50

87.20

87.10

Please give me solution. 

PS Fresh installation of Windows 11.

[PhoneBoy]

To investigate this issue, you will need to open a TAC case: https://help.checkpoint.com 

[EricR]

Hi,

yes, I opened a case. Support was able to reproduce the issue when the checkpoint vpn will be installed while client has no internet connectivity. This is often a case in our environment because our clients are not allow to brows internet without user authentication.

This issue doesn't happened with older checkpoint client releases.
It don't know if they have fix the issue already!?

[PhoneBoy]

Until we know the exact root cause, it's difficult to say the issue is "fixed."
The fact this issue is easy reproducible will certainly help in that.

[AndreiR · Accepted solution]

Hi,

Here is the update from VPN RnD team. It is also documented in sk180845.

 

Root cause and symptoms

The issue happened due to expiration of certificate which was used for signing firewall driver vsdatant.sys. Validity period of this certificate ended on April 8, 2023, VPN client became unable to initiate firewall module and failed with error “Connectivity with VPN Service is lost”. In addition, following lines can be found in trac.log:

[ 47972 44400][9 Apr 10:16:03][TR_FIREWALL] CFirewallWrapper::InitFirewallMonitor: ERROR - lpFwMonitor_Start failed, try to wait for the service initialization
[ 47972 44400][9 Apr 10:16:03][TR_UTILS] WaitForServiceStart("vsmon")
[ 47972 44400][9 Apr 10:16:03][TR_UTILS] WaitForServiceStart: OpenService("vsmon") failed: The specified service does not exist as an installed service.
[ 47972 44400][9 Apr 10:16:03][TR_FIREWALL] CFirewallWrapper::InitFirewallMonitor: waiting for vsmon initialization failed

 

Affected versions

Endpoint Security VPN, versions E86.60 and E86.70

The issue impacts only “Endpoint Security VPN” flavor of standalone VPN clients which contains firewall module. Other flavors of standalone VPN client as well as Harmony Endpoint Protection (full suite) are not affected.

 

Mitigation

The only solution is to upgrade VPN client to newer version.

We are in RnD will improve our internal processes and enforce strict control over certificates we use inside our products.

[paredes_h]

Thank you!

[EricR]

Hi Andrei,

I tested the lastet version E87.30 (98.61.4715) and can still see the same behavior.
My client don't have a active internet connection. After few minutes my virtual machine crashes!

[PhoneBoy]

Please open a TAC case: https://help.checkpoint.com

[AlSeOr]

Hi, Have you found a solution?

[EricR]

Hi,
support ticket is still open --> SR#6-0003654968

I sent them my custom MSI files to reproduce the issue. I think the issue is because we configured a preconfigured VPN site which can't be reach from our deployment network. So this issue doesn't not exist when installing checkpoint vpn without a preconfigured or you have to take care that after installing your vpn site is reachable.

This wasn't an requirement in the past and I hope checkpoint will fix it. 

[EricR]

Hi all,
I got a response from the support engineer. They were able to reproduce the issue on a lab and will working on investigating.
I hope they will fix it asap.

[EricR · Accepted solution]

Hi,

issue seems to be resolved now! 
I used a "trac.config" and "trac.defaults" from a previous checkpoint installation. This is not supported!
I did a new clean installation with the latest checkpoint vpn client and configured all the settings in UI. After that I exported from their both config files (trac.config" and "trac.defaults) and used these ones with the vpn-config tool to create a custom MSI.

I want to say thanks to checkpoint support! 

Regards,
Eric