S2S VPN via Cellular Backup Issues

[VikingsFan]

We have many 1595R appliances that setup a S2S tunnel to two main clusters (9000 appliances).  The firewall sits behind a Cisco router which is connected via MPLS and has a cellular backup connection.  While on MPLS, the tunnel works perfect and we have no issues but if MPLS goes down and the Cisco router fails over to cellular, the tunnel starts acting up.  Sometimes existing traffic continues to work and then after a while (presumably during the next rekey) traffic will stop working and connections will drop.  We determined during test that if we set the community to IKEv1 only that cellular failover works well.  All 1595R locations are configured for IKEv2 only currently and we'd prefer to stay there.

Any idea on what settings on the firewalls we can tweak to help improve things?  If the network team tweaks the MTU on the router side we can get the tunnel working over cellular but the settings apparently get overwritten by the carrier so we're looking for a Check Point solution.  I'm guessing it will be tweaking of MTU and/or IKE fragmentation but not 100% sure on the correct commands and also if it can be done just on the 1595R side or if the 9000 clusters need to be changed (which I assume would impact all locations and we are trying to avoid that without more testing).

Any guidance is appreciated.  Below is a snippet of how a typical Cisco router is configured for each location:

interface Tunnel10
description "Tunnel via Verizon"
ip address X.X.X.X 255.255.255.252
ip mtu 1428
ip tcp adjust-mss 1364
load-interval 30
keepalive 10 3
tunnel source Cellular0/4/0
tunnel destination X.X.X.X
!

//Set by Carrier
interface Cellular0/4/0
mtu 1428
ip address negotiated
no ip unreachables
ip tcp adjust-mss 1388
load-interval 30
dialer in-band
dialer idle-timeout 0
dialer enable-timeout 6
dialer watch-group 1
dialer-group 1
pulse-time 1

[Chris_Atkinson]

Common issue in CGNAT environments...

You can set the MTU & MSS clamping on the Check Point as long as your comfortable with imposing an artificial limit on both network paths to the lowest common denominator.