Unstable VPN tunnel between two checkpoint firewalls; ike log indicates INVALID-COOKIE

[Hsanity]

Hi,
We have been experiencing an unstable VPN connection at one of our sites. VPN tunnels randomly go down. Looking at the log in the web portal shows "Peer closed connection" and "The peer is no longer responding" between the gateways. We can also see logs like "Informational Exchange Received Delete IPSEC-SA from Peer" coming from the remote gateway. Following is an example of one of the events:

Looking at ike.elg log file indicates towards lots of INVALID-COOKIE before and after phase 1 and phase 2 ike negotiation.

Troubleshooting steps taken:
1. Cross-checked VPN site settings on both ends
2. Delete and recreate VPN sites on both ends
3. Increased WAN bandwidth from ISP

SMB gateway: 1450 Appliance | Version: R77.20.75 (990172321)

[PhoneBoy · Accepted solution]

Before spending too much time troubleshooting this, I recommend upgrading to the latest firmware.
The most recent can be obtained from here: https://support.checkpoint.com/results/sk/sk153433 

[the_rock]

Make sure "keep ike SAs" in global properties is enabled.

[Hsanity]

We are running our gateways with local management. Is it possible to check and enable "keep ike SAs" without a management server?

[G_W_Albrecht]

Best next steps:

- upgrade to latest firmware

- if the issue persists contact TAC

[the_rock]

Not that I know of...I believe that option is only available as per below (from smart console):

 

[Hsanity]

Thank you. For local management, I found it under Device > Advanced Settings > VPN Site to Site global settings - Keep IKE SA Keys.

[the_rock]

Good stuff, learned something new today. So any way to tell if it helps or it may take some time?

[Hsanity]

We are trying with keeping the IKE SAs and observing the tunnel for the next several hours. Finger crossed.

[the_rock]

Honestly, even if that works, I would still upgrade to latest version available. It never hurts to do that with these SMB appliances, it can only help. 

[Chris_Atkinson]

Are you planning to upgrade to R77.20.87 JHF ?

[Hsanity]

Unfortunately, my user account does not have enough privileges to download the hotfix that @PhoneBoy suggested. Logged a separate support on this. Awaiting response.

[PhoneBoy]

Yes, because your account must be associated with a support agreement.
This is required to download most things from UserCenter.

[the_rock]

Hey @Hsanity ...any luck with changes made?

Andy

[Hsanity]

There were still tunnel drops after switching to keep ike SAs. But After upgrading to the latest JHF | fw1_sx_dep_R77_990173120_20.img, haven't had a single tunnel drop in the last 12 hours. This looks promising! But I must say, We have about fifteen other 1450 firewalls that have VPN tunnels to the same central site and this is the only gateway causing issues without the JHF. Thanks so much for the file @the_rock.

[G_W_Albrecht]

As i wrote above: Afaik and refering to sk142355, your issue has nothing to do with Keep IKE SAs...

[Chris_Atkinson]

They all need upgrading in that case as R77.20.75 has been End-of-support for almost 3-years already.

Refer:

https://www.checkpoint.com/support-services/support-life-cycle-policy/

[the_rock]

Glad it helped you.

[G_W_Albrecht]

Why ? See explanation in sk142355: Enabling this parameter changes the behavior so that the Security Gateway keeps all Phase 1 and Phase 2 keys after a policy installation to work around interoperability issues with 3rd party VPN peers.

I do not see any issue after policy installation mentioned here...