L2L Cisco to Checkpoint VPN frequent drops

[captnops]

I have a 2811 that connects via T1 to a checkpoint device (not ours) via a L2L VPN tunnel.

Every day at approximately the same time, the tunnel drops and will not reconnect. If I reload the router, the tunnel reestablishes until the next day.

I do have keepalives 10 set.

All help is greatly appreciated.

 

[North323]

what time of day? night time? is there a heavier load during that time? is there something going on the checkpoint side? do they reboot or take it down for maintenance? does your ISP take down the T1?

 

[captnops]

It usually occurs in the morning between 8-10AM EST. The load is about the same as any other time (that is to say nothing but RDP traffic to terminal server)

The admin on the checkpoint side doesn't indicate that his logs show any problems. I have requested him to send the settings for his lifetime settings to verify that they are the same but I remember during implementation that we verified that they were.

T1 does not come down and the ISP indicates no errors (framing, timing, etc) on the circuit during those outages.

One other symptom that was interesting. One of my customers indicated that they were unable to traceroute past the inside interface address during the time that the tunnel came down. However, that may be due to the static route pointing all that traffic to the tunnel.

Thanks again.

 

[North323]

is the checkpoint using pfs? perfect forward secret? (i think thats what its called)?

 

[captnops]

I honestly do not know and the admin is OOO until monday.

 

[North323]

do you have any log files from your device at the time the connection drops?

 

[captnops]

Unfortunately, not a great deal. I am seeing a message that Rec'd packet not an IPSEC packet, but I suspect that is due to the acl for this be any any

 

[North323]

only thing i can think of is the time out is not set the same on both ends. i would verify all configurations with the owner of the checkpoint

 

[captnops]

Thank you. That is what I was thinking it was, but I wanted to eliminate any other possibles. I will post more once I have all the info from the checkpoint.

Interesting note: I have enabled logging on the router ported to syslog server for level debugging. The tunnel came down again (same symptoms as above), but no debugging logs were sent to the syslog server.