sk180855 - Site to Site VPN traffic in Load Sharing cluster is not synchronized across members and dropped

Site to Site VPN traffic in Load Sharing cluster is not synchronized across members and dropped

Product

Site-to-Site VPN

Version

R80.40 (EOS), R81 (EOS), R81.10 (EOS), R81.20

OS

Gaia

Platform

All

Last Modified

2023-08-14

Symptoms

In a Site to Site VPN, when one of the sites is a cluster in Load Sharing mode, packets are dropped with " _vpn_decrypt_verify Reason: CONN_ENC_NO_ENTRY[SR] with packet reversed to the original direction of the connection"

Cause

When one of the sites is a cluster in Load Sharing mode, both peers open renegotiation simultaneously, and each side uses different tunnel for encryption. This can be seen in the Ike.elg file: the Security Gateway and the peer send renegotiations at the same time.

It causes incorrect destination member calculation for asymmetric connection and leads to traffic drops.

Solution

This problem was fixed. The fix is included in:

Jumbo Hotfix Accumulator for R81.20 starting from Take 26
Jumbo Hotfix Accumulator for R81.10 starting from Take 95
Jumbo Hotfix Accumulator for R81 starting from Take 87

Install this Take on every member of the VPN that is a cluster.

To enable the fix, enable the kernel parameter on each Security Gateway:

[Expert@HostName]# ckp_regedit -a SOFTWARE/CheckPoint/VPN1 ikev1_initiator_opens_reneg -n 1

To apply the change, kill the VPND/IKED processes.

To disable the fix, run on each Security Gateway:

[Expert@HostName]# ckp_regedit -d SOFTWARE/CheckPoint/VPN1 ikev1_initiator_opens_reneg

To apply the change, kill the VPND/IKED processes.

If you choose not to upgrade, Check Point can supply a Hotfix. Contact Check Point Support to get a Hotfix for this issue.

A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.

For faster resolution and verification, please collect CPinfo files from the Security Management Server and Security Gateways involved in the case.

Hotfix installation instructions:
Refer to sk168597 - How to install a Hotfix.

If the Hotfix cannot be installed, the kernel parameter can be set to force FnA for encrypted traffic:

[Expert@HostName]# fw ctl set int try_prevent_fna_for_vpn 0

Note: This can introduce traffic slowness.

Article Properties

Access Level: General
Status: Approved
Date Created: 2023-04-30
Last Modified: 2023-08-14