Quantum Spark Remote Access VPN Drops or Asks for Reauthentication Every Hour

[sx8n20394]

After upgrading to the latest builds for R81.10.17 (4901) and R82.00.10 (2216) we now have all clients complaining that VPNs are dropping or asking for reauthentication every hour. This affect Entra SSO, AD Auth, etc.

If someone from Checkpoint sees this, please escalate this with R&D. 

[sx8n20394]

Updating this post with logs. We have a TAC case open but want other people to know this is a problem. This is with IKEv2 turned on R82. IKEv2 doesn't work on R81 for Remote Access even though it is in the advanced settings (brilliant!). Apparently IKEv2 is completely broken on R82 as well (brilliant!). 

FW CTL ZDEBUG output:

fw_log_drop_ex: Packet proto=17 [redacted] dropped by vpn_ipsec_decrypt Reason: decryption failure: Could not get SAs from packet;

Client Helpdesk.log

No reply from the gw ip= for tunnel test packet. Office Mode IP=, source port=18232.

No reply from the gw ip= for tunnel test packet. Office Mode IP=, source port=18233.

No reply from the gw ip= for tunnel test packet. Office Mode IP=, source port=18234.

IKE tunnel disconnected, error code=-1000. Reason: Site is not responding.

Client state is connected

Tunnel (0x1) disconnected. State is connected. Trying to reconnect.

IKE connection failed, error code=-1000. Reason: Site is not responding.

Client state is reconnecting

Reconnect failed. trying again (0x1)

State reconnecting. Roaming timeout is reached, cancelling connection (0x1)

Checkpoint GUI:

IKE failure: Child SA exchange: Exchange failed: timeout reached.

IKE failure: Informational exchange: Sending notification to peer: Invalid IKE SPI.

IKE SPIs: 4b5c

Drop UDP/4500

[perfect4situa]

Hi, I've similar problem after upgrading to R82 with CVE fix on my Spark 2000 centrally managed.

The only solution was reverting VPN Remote Access IKE support to IKEv1 (Use IKEv2 and support IKEv1 do not work).

I'll open a ticket...

[sx8n20394]

I've had a ticket open for weeks. I have a good engineer that I have worked with in the past but he said he was not able to replicate the issue so I am just providing him access to our firewall to see if he can monitor it.