Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
KM1895
Contributor
Contributor

vpn tunnels doesnt survive hard failover on isp redundancy

 

i have a somewhat weird issue with isp redundancy.

 

The setup is correct, and it is working just fine if i do a manual failover in cli (fw isp_link isp1 down/up).

The script runs, the default gateway is changed, and everything is working.

But if there is an issue with the physical link(we tested with unplugging the cable), i observe a strange behaviour.

 

The script is still working just fine, default gateway is changed, and almost everything is working, except for vpn tunnels.

This is the internal mesh for the customer, so there are Checkpoints on both sides.

What i see, is that the gateway that has changed isp due to hard failover, sends ike packets to the other mesh member on the new and correct ip address, but the other member sends the reply packet back to the primary isp ip address, which has an unplugged cable.

Tried resetting the vpn tunnels on both sides, but no matter what i tried, the result was the same. The customer currently has to sites now with the same issue, and im running out of ideas for troubleshooting.

Has anyone come across something similar before, and if so, what was the solution/workaround?

 

the environment is r81.10 t95

 

 

0 Kudos
5 Replies
PhoneBoy
Admin
Admin

Recommend engaging with the TAC here: https://help.checkpoint.com 

KM1895
Contributor
Contributor

yeah, ended up opening a tac case yesterday.

 

 

0 Kudos
Peter_Lyndley
Advisor
Advisor

was there a solution provided ?

0 Kudos
starmen2000
Collaborator
Collaborator

@KM1895  did you find the solution? I have also similar issue.

0 Kudos
KM1895
Contributor
Contributor

hi,

 

I think this case is still being investigated, together with tac

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    Thu 25 Apr 2024 @ 11:00 AM (SGT)

    APAC: CPX 2024 Recap

    Tue 30 Apr 2024 @ 03:00 PM (CDT)

    EMEA: CPX 2024 Recap

    Wed 01 May 2024 @ 02:00 PM (EDT)

    South US: HTTPS Inspection Best Practices

    Thu 02 May 2024 @ 11:00 AM (SGT)

    APAC: What's new in R82

    Thu 25 Apr 2024 @ 11:00 AM (SGT)

    APAC: CPX 2024 Recap

    Tue 30 Apr 2024 @ 03:00 PM (CDT)

    EMEA: CPX 2024 Recap

    Wed 01 May 2024 @ 02:00 PM (EDT)

    South US: HTTPS Inspection Best Practices

    Thu 02 May 2024 @ 11:00 AM (SGT)

    APAC: What's new in R82
    CheckMates Events