remote access client IP address and port were changed -log flooded

[Ivailo_Yanchev]

Hi community,

recently our log is floated with this message, we receive like 20 per second, most of the time it is generated from the same VPN client.

We have not receive any report of connectivity problem, and our clients are not on mobile internet. We are using E80.40 GAIA with the latest Take 125

Can someone give is more information, what could be the reason for this?

Is it possible to suppress this log reports, so that our log is not flooded with it?

Best Regards.

{Time: Today, 09:25:24
Id: ac191402-e41e-7e0f-615e-bd04001*****
Id Generated By Indexer: true
First: true
Sequencenum: 100
Message: remote access client IP address and port were changed
User: epetkova
Old IP: 192.168.5.10
Old Port: 4500
New IP: 192.168.5.10
New Port: 4500
Mobile Access Session UID: 615E9222-0000-0000-AC19-1403D37*****
VPN Feature: Endpoint Connect
Type: Log
Policy Name: StandardGT
Policy Management: GTBGFW01
Db Tag: {B289A31F-77EB-B042-ABE5-AF5FB3EE7B2F}
Policy Date: Yesterday, 15:06:00
Blade: VPN
Origin: GW
Product Family: Access
Log Server Origin: GW (192.168.1.1)
Description: remote access client IP address and port were changed}

[_Val_]

Please look into sk65331 and sk145895 (scenario 4)

[G_W_Albrecht]

If this happens only for one special user, try uninstall and reinstall of (maybe newer) RA VPN client. The user is not disconnected after the message ?

[Ivailo_Yanchev]

Hi,

No, all of our users are affected, just not all at the same time. Also, we updated to the newer version of CP mobile VPN client E85.30

Thank you.

[G_W_Albrecht]

The user is not disconnected after the message, only logs are filing up ?

[Ivailo_Yanchev]

Yes, only logs filling up. We asked some users with logs reported, and they said that everything is ok and connection is good.

[Gabriel_Rodrigu]

Hi,

I'm having the same issue with a Firewall running R80.30 take 236, We have tested with the new RA client 85.40 but the issue still the same

[Ivailo_Yanchev]

Hi,

Have you identified any service degradation. Is some of your user suffers any disconnects?

Also, We have started a case with checkpoint and are waiting for a patch.

[Gabriel_Rodrigu]

HI,

The symptom is the same as yours, we have no degradation neither disconnections.

Regards

Gabriel Rodrigues

[Ivailo_Yanchev]

We reseave a notification from checkpoint that the ongoing take 126 should fix this problem

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

PRJ-31029

But, most likely, we will wait for general availability before implementing the patch.