Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Verified Answer
  • +2 person also asked this people also asked this
  • Locked Locked
  • Replies 5 replies
  • Answers 1 answer
  • Subscribers 41 subscribers
  • Views 2104 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SSL VPN (TCP) Static IP Address issues

Hugh D

Hello,

I am experiencing the issues listed in NC-120119 when I am using TCP mode for my SSL VPNs.

I have a select number of users who I required to get a static IP address, however when they are connected, if they change network type and it tries to reconnect, I get the auth error described in NC-120119.

All the symptoms I have are consistent with NC-120119, except I am not using UDP, I am definitely on TCP.

Is this a further known issue?

Thanks.

SFOS 20.0.0 GA-Build222



This thread was automatically locked due to age.
Parents
  • +1

    Hi  , This is a known limitation that on n/w switch (even with TCP) there is no mechanism that conveys this to SFOS and connection will remain Up on SFOS and immediate client reconnect will result in AUTH_FAIL as the assigned static ip to the RA client is still in use in SFOS' context; this happens until ‘disconnect dead peer’ kicks in ( on SFOS this can be set to 60 seconds minimum), post this timer, connection is removed by SFOS and RA client can re-connect successfully. Please set the config on SFOS: from Remote access VPN - SSLVPN - SSLVPN global settings - Disconnect dead peer after: set this timer as per the acceptable value. 

Reply
  • +1

    Hi  , This is a known limitation that on n/w switch (even with TCP) there is no mechanism that conveys this to SFOS and connection will remain Up on SFOS and immediate client reconnect will result in AUTH_FAIL as the assigned static ip to the RA client is still in use in SFOS' context; this happens until ‘disconnect dead peer’ kicks in ( on SFOS this can be set to 60 seconds minimum), post this timer, connection is removed by SFOS and RA client can re-connect successfully. Please set the config on SFOS: from Remote access VPN - SSLVPN - SSLVPN global settings - Disconnect dead peer after: set this timer as per the acceptable value. 

Children
No Data
Unfiltered HTML