Troubleshooting TrGUI VPN Connection Issues

When setting up a TrGUI VPN connection, there are several common issues that may arise. In this article, we will explore three scenarios where troubleshooting is necessary to establish a successful connection.

Scenario 1: Firewalls Upgrade and Visitor Mode Port Changes

If you have recently upgraded your firewalls from R75.45 to R77.20, you may encounter an issue with establishing a site using the IP address:port combination. Additionally, if you change the default Visitor Mode port (443) to something else, Endpoint Security VPN cannot establish a site connection when only the Security Gateway's IP address is used.

Scenario 2: Path MTU Discovery (PMTUD) Issues with Check Point Active Streaming (CPAS)

Path MTU Discovery (PMTUD) issues can occur with Check Point Active Streaming (CPAS), causing problems with TrGUI VPN connections. To resolve this issue, it is recommended to configure the same MTU size on the external interface of the Security Gateway as the MTU of the next hop router.

Scenario 3: ICMP 'Fragmentation Needed' Message and 'Don't Fragment' Flag

If the packets sent by the Security Gateway are larger than the next hop's MTU size, you may receive an ICMP 'Fragmentation Needed' message with the next hop's MTU size. This can cause the Security Gateway to send packets with the 'Don't Fragment' (DF) flag set, resulting in packet segmentation and failure to connect.

To troubleshoot these issues, follow these steps:

* Check the policy installation on the Security Gateway or Cluster object.

* Verify that the Gateway Object is added back into any relevant VPN communities.

* Ensure that the 'Certificate Nickname' is set to defaultCert (all letters are small, except for the 'C').

* Select 'IPSec VPN' and add the certificate called 'defaultCert' under 'Repository of Certificates Available on the Gateway'.

* Remove the Gateway Object from any VPN community it participates in.

By following these steps and troubleshooting common issues, you can successfully establish a TrGUI VPN connection. Remember to backup your database using Database Revision Control if you experience any errors or issues with your VPN certificate.

Trgui vpn