Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted
Ivory

1550 VPN establishment delay

Some users observe that when connecting to VPN (from Capsule on Windows or IOS in our case), there is a delay until they can reach internal resources. They have to wait between 15 seconds and half a minute until they can reach devices with the allowed protocols.

Has anybody else experienced this problem?

 

0 Kudos
16 Replies
Highlighted
Admin
Admin

Re: 1550 VPN establishment delay

It does take some time for the VPN to negotiate and connect.
How precisely are you measuring this?
Have you done any tcpdumps to see what's going on?
0 Kudos
Highlighted
Platinum

Re: 1550 VPN establishment delay

What about Endpoint Security VPN client ? It has a nice progress window where you can see which phase of VPN establishment takes the most time. Usually that is the one where topology is downloaded from gateway if needed.

0 Kudos
Highlighted
Ivory

Re: 1550 VPN establishment delay

Also happpens with Endpoint Security Client. The delay occurs after negotiation is complete.

The other strange thing is that this does not happen for all connections. Some connections (few) get immediate connectivity.

0 Kudos
Highlighted
Ivory

Re: 1550 VPN establishment delay

I have not performed any measurements. Basically user experience being reported. And my own.

Also, as mentioned in other reports, it does not happen very time. Some connections get immediate connectivity.

How do I get a tcpdump on a 1550? 

0 Kudos
Highlighted
Admin
Admin

Re: 1550 VPN establishment delay

tcpdump is accessible in expert mode from the CLI.
0 Kudos
Highlighted

Re: 1550 VPN establishment delay

I would instantly involve TAC using chat if there is a good chance to replicate the issue in a quick RAS !

0 Kudos
Highlighted
Employee++
Employee++

Re: 1550 VPN establishment delay

 

For iOS setting the "tunType" custom data value to force snx (SSL) may improve the delay in cases where the client might be attempting IPSec first for example and failing.

Refer: http://supportcontent.checkpoint.com/documentation_download?id=20361

0 Kudos
Highlighted
Ivory

Re: 1550 VPN establishment delay

Hi Chris.

I will test this creating an iPhone profile to add the setting.

Nevertheless I must note that:

- the delay in accessing internal devices occurs after negotiation is over and "connected" status is presented by the client.

- users have also reported the delay using Windows 10 Capsule and Enpoint Security from Mac, so it does not seem to be specific to IOS, but rather to the 1550.

- we have no reports on this delay when connecting to R80.10, R80.30 or R80.40 open servers 

 

Thanks.

 

0 Kudos
Highlighted
Employee++
Employee++

Re: 1550 VPN establishment delay

Thanks for clarifying, please test the latest build of R80.20.05 if not already and engage TAC to assist further.

0 Kudos
Highlighted
Ivory

Re: 1550 VPN establishment delay

We had a very bad experience with TAC (Premium Support) in previous issue with 1550, so I prefer to wait and test available recommendations posted here.

Users will have to live with the short delay (sometimes a couple of retries connecting to their device) in the meantime.

Thanks again and best regards.

 

0 Kudos
Highlighted
Platinum

Re: 1550 VPN establishment delay

Btw, are you talking about slow RDP connection ?

0 Kudos
Highlighted
Ivory

Re: 1550 VPN establishment delay

The problem is with the first connection attempts failing to any device independently of protocol (RDP, http, https or vnc). Once connected speed and latency are fine with all protocols.

0 Kudos
Highlighted
Platinum

Re: 1550 VPN establishment delay

I am asking because recently I had a problem with my 1470 where RDP will connect instantly on WAN interface but very slow on DMZ interface. 

I guess you have already eliminated possible sources of delays such as TP blades ?

0 Kudos
Highlighted
Ivory

Re: 1550 VPN establishment delay

These are VPN connections from Internet (WAN) to intranet.

No Threat Prevention issues detected or logged.

 

0 Kudos
Highlighted
Platinum

Re: 1550 VPN establishment delay

Have you tried to temporarily disable SecureXL ?

0 Kudos
Highlighted
Ivory

Re: 1550 VPN establishment delay

No. I have not. 

I will have to leave this issue alone for a while.

 

Thanks to all.

0 Kudos