Tunnel goes periodically down, LAN interfaces flap

[Crzcarlo]

Hi everyone,

we have deployed a 1590 (R80.20.01) a few moths ago and since the beginning we are experiencing an issue: every other weekend the tunnel between this branch office and the HQ goes down. It happen on Saturday or Sunday, mostly between 4 and 7 PM.

The only way for re-establish the tunnel is to reboot the CP 1590 on site. The 1590 appliance is connected to a switch and router, and during the absence of the tunnel the switch log reports the flapping of 4 interfaces connected to PCs (not used during the weekend) but not the one connected to the CP 1590, while the router log reports the flapping of the interface connected to the CP 1590.

In both cases the interfaces are flapping both link and protocol.

Since the CP 1590 is restarted, we don't have the log, so I would like to know if on the SmartConsole there is a way to check the system log of this branch device. Furthermore I would like to understand if this is a known issue and if something external could be the cause for this behavior.

Thank you so much

Carlo

[PhoneBoy · Accepted solution]

First of all, I recommend making sure you are on the latest firmware, which as of this writing is: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut... 

Second, it might not be a bad idea if you configure the device to send syslog message to a syslog server that can store the log messages for longer than the limited storage of the 1590 allows.
This should aid in current and future troubleshooting.
Meanwhile, you should be able to see what's available (if anything) in /var/log/messages or similar via expert mode.

[G_W_Albrecht]

Maybe just try sk167876: Jumbo Hotfix Accumulator for SMB R80.20.05 ?

[Crzcarlo]

First of all, thank you both @PhoneBoy  and @G_W_Albrecht .

I just implemented a syslog server dedicated for this device for having an insight of what happens during the issue. I also planned to upgrade the firmware ad I noticed that the last release is R80.20.10 (16-Jul-2020), is there a particular reason to opt for the R80.20.05 Jumbo? Since the lattes was released on 05-Jul-2020, I thought that the .10 should contain those fixes.

[G_W_Albrecht]

CP policy is to install the latest firmware. On the other hand, if i do not need the additional features of .10, the .05 Jumbo should resolve most issues with that version. At least you do have two possibilities to proceed...

[Crzcarlo]

Finally, I decided to upgrade the firmware to the latest version (R80.20.10) and during these two weeks there was no problems, so it seems to be solved.

Thank you everyone!