AWS Cross Availability Zone cluster member sends VPN traffic from its Elastic IP address instead of its alias IP

Product: CloudGuard Network for AWS, ClusterXL, Site-to-Site VPN
Version: R81 (EOS), R81.10 (EOS), R81.20
OS: Gaia
Platform: AWS
Last Modified: 2024-07-01

Symptoms

• VPN community uses IKEv2, and the active member of the Cross Availability Zone cluster sends IKE packets with the source IP address of the cluster's Elastic IP and not the alias IP.
• When you configure probing link selection, the Cross Availability Zone cluster sends RDP probes with a source address of the Elastic IP and not the alias IP.

Solution

This problem was fixed. The fix is included in:

• Jumbo Hotfix Accumulator for R81.20 starting from Take 70

If you choose not to upgrade, Check Point can supply a Hotfix. Contact Check Point Support to get a Hotfix for this issue.

A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.

For faster resolution and verification, please collect CPinfo files from the Security Management Server and Security Gateways involved in the case.

Hotfix installation instructions:

Refer to sk168597 - How to install a Hotfix.

NOTE

This solution has been verified for the specific scenario, described by the combination of Product, Version and Symptoms. It may not work in other scenarios.

Article Properties

Access Level: General
Status: Approved by TAC
Date Created: 2024-01-22
Last Modified: 2024-07-01