IPSEC site to site VPN fails after R80.20 upgrade

[Scott_Paisley]

Hi

We have a large number of IPSEC VPN tunnels between our R77.30 gateway clusters.

Yesterday we upgraded one of the remote clusters to R80.20. After the upgrade the tunnel was still working fine, until we pushed policy to the R77.30 cluster late last night.

Now the tunnel will not stay up. If I push the R80.20 cluster it comes up briefly, then fails again.

The error message is 

Auth exchange: Sending notification to peer: Authentication failed MyAuthMethod: Certificates

I have support ticket open, but is there something simple and obvious I am missing?

Thanks

[Maarten_Sjouw]

Do make sure to push the policy on the R77.30 again. We have seen many times during a R77.30 to R77.30 migration, a couple of years ago, that when we had VPN's we needed to at least push twice to those gateways to make sure the tunnels came back.

[Scott_Paisley]

Thanks

I removed the R80.20 gateway from the VPN, pushed to both gateways, added it back in and pushed again, and now the tunnel is up.

Checkpoint recommendation is to renew the cert, but each of our gateways is involved in multiple VPNs, so we will end up pushing to the whole estate eventually.

[OL]

@Scott_Paisley did you find the root cause of this? Could it have been that after upgrade that PFS was turned off?

I just saw similar behaviour going from R80.10 to R80.30. Im pretty sure I had PFS enabled before upgrade. It was disabled after upgrade I think. I reenabled, and it looks more stable.

[Scott_Paisley]

it turned out to be an unrelated issue. The Remote gateways were not able to reach the management server to check the validity of the certs. Once that was resolved the tunnels came up