I have a customer that has 4 1800 SMB appliances which is integrated with their existing Enterprise management software. They have 4 gws with site to site VPN configured.Recently,they have been facing alot of issues with their VPN connection after they migrated to the new appliances. I had raised several cases with checkpoint support and they have not been able to pin point the issue as well. It just works sometimes and then it stops working(Usually after policy installation). Checkpoint TAC support has not been able to solve the issue after countless escalation of the cases aswell. After hours of troubleshooting it just starts to work again and then we dont make changes to the gws anymore. We have done a VPN debug aswell but it has not proved fruitful.
When the gws first started to show errors with VPN i did the following to solve it:
1.Followed sk102712 to make the change about firewalls
2. on the firewall side, changed $FWDIR/conf/masters
with management IP address
The two steps above solved my VPN issue for awhile. After a few months, although the symptoms of the VPN issue was the same, the above steps didnt help me at all. So the only immediate solution for me was to make one of the gws(downtime cannot be tolerated during office hours) in standalone mode.
The customer has been complaining that he wants the standalone gw to be integrated to the management aswell so last night when i tried to install the policy, it fails midway. Funny thing is that, policy is installed(Access policy only)VPN is up,i can ping the management server's ip address from the gw and all the internal services but in the smart console it shows "connection is lost"for that specific gw, although i can ping,etc to the management server from that gw. I cant make further changes to the gw.
Note that the policy is any any accept.
So i read an SK on r81.10.x and SMB devices are supposed to work like a enterprise gateway as it inherits the code base from r81.10 GA version from enterprise appliances. So, will upgrading my management software and the gws to R81.10 help me solve this issue? Because all the configuration on the management server was working fine with the 4000 series appliances.
Would highly appreciate it if a SMB specialist could advice me on this.