Checkpoint VPN Client stopped working

[DFC1]

I had been using the Checkpoint VPN client to connect to my customer's network from home successfully for the last 2 years.  A few days ago, I lost Internet connectivity and unplugged my router.  After I plugged it back in, I was back on the Internet, but I could not connect via VPN again.  My employer uses Cisco VPN and that still works.  I never had to add special settings to my Actiontec router for either one to get them to work.

I tried resetting my router to the factory settings, but that did not help.  I have since restored the original settings.

Checkpoint can use either IPSEC or HTTPS.  Neither works now.  I checked with the customer and nothing has changed at their end.  I can connect successfully at my office, or if I use my phone as a hotspot.  The only place it doesn't seem to work is at home, using FIOS.

Details:

Actiontec MI424WR, Rev D

Firmware 4.0.16.1.56.0.10.14.4

My router and ONT are connected via coax.

This is a horrible inconvenience.  I do work for my customer all hours of the day and night and can't drive to the office just to VPN in.

Many thanks in advance for your suggestions and help.

[Shamika_VZ]

I can understand your frustration here. I sent you a private message to get started.

Shamika_Vz
Verizon Support

Notice: Content posted by Verizon employees is meant to be informational and does not supersede or change the Verizon Forums User Guidelines or Terms or Service, or your Customer Agreement Terms and Conditions or Plan.

[prisaz]

I know for one reason or another some customers have had issues with the ONT and MOCA, IP over coax, and VPNs. Many have switched to Ethernet from the ONT to the router WAN. Not sure why, but it just works better. I have always been Ethernet.

http://forums.verizon.com/t5/forums/searchpage/tab/message?filter=location&location=Board%3AFiOS_Int...

 Don't know why it would go from MOCA working to MOCA not working. Post the fix so we all will know. Too many items not account related are being resolved via private mail. It sort of defeats the purpose of an open forum. I can understand why the private account related imformation needs to ve conveyed privately, but please post your solution.

Thank you.

[Shamika_VZ]

Thanks Prisaz,

Once we have more information we will post what we can here.

Shamika_Vz
Verizon Support

Notice: Content posted by Verizon employees is meant to be informational and does not supersede or change the Verizon Forums User Guidelines or Terms or Service, or your Customer Agreement Terms and Conditions or Plan.

[prisaz]

---

@Shamika_VZ wrote:

Thanks Prisaz,

Once we have more information we will post what we can here.

Shamika_Vz
Verizon Support

Notice: Content posted by Verizon employees is meant to be informational and does not supersede or change the Verizon Forums User Guidelines or Terms or Service, or your Customer Agreement Terms and Conditions or Plan.

---

Shamika_Vz

 It is good to keep others informed so the solutions can be shared. A few of us have noticed more of a trend toward private resolutions to non account related issues. Yes account related information for contacting the customer must be kept private. So thank you for your response to my concerns.

[DFC1]

Prisaz,

Before I had FiOS installed, I did not know whether the installer would use coax or cat-5, so I ran both.  Since I already had the wire in place, I decided to try switching to the ethernet port on the ONT, so I completed the connections and had FiOS support make the change today.  It did not help- everything works exactly as it did before, but the VPN software still can't connect to my customer's gateway.

Just to eliminate another variable, I installed the VPN software on a different machine I have here at home.  It behaves exactly like the first machine.

Thanks.

DFC

[prisaz]

It could be that the customer site is blocking IPs from a different subnets external router or internal hosts. Even though they say they are not. I have also read where some customers had to change their internal subnet from 192.168.0.x or 192.162.1.x to say 10..0.0.x class A. Now I am a a loss. Are they able to provide any error logs or router logs showing your public IP when you try to connect? Perhaps you could enable the Actiontec firewall router logging which is limited and fills up fast. It may indicate possble messages regarding the connection being refused. I am only going by the various posts I have seen here in the few years that I have kept track. Let us know if you find out more.

Sorry I was not of more help.

[DFC1]

Prisaz,

I tried the subnet thing this morning.  It did not help, but I did do a little more diagnostic work while I was at it.

I turned up the logging in the router's firewall.  I don't see any traffic being blocked.

I also turned on logging in my customer's VPN client and tried connecting.  I am getting through to the VPN gateway.  I am getting an IKE negotiation failure afterwards.  I sent this information as well as my external IP address to the customer and I'll see what he can find out.

You are being plenty of help- we are narrowing things down, and I am learning a thing or two.

Many thanks.

DFC.

[prisaz · Accepted solution]

Wow the logging points to the right direction. There are many hits on google.

http://www.google.com/search?hl=en&gl=us&btnmeta_news_search=1&q=IKE+negotiation+failure+&oq=&aq=&aq...=

Good luck

[DFC1]

Prisaz,

Reading through the links provided by the search link you posted, and running a few more tests, I got the idea that:

1.) The problem was at the destination, and

2.) It was related to the fact that rebooting my router gave me a new IP address.

So, I unplugged the power to my router before I went to bed last night.  This morning I plugged the router back in, and my VPN connection works again.  My old IP address was in the 108.XX range, and the new one is in the 173.XX range. 

It was hard to focus my customer's attention on this issue, so I don't have an explanation.  I believe that they are doing some kind of IP filtering.  I reported my results to them, and I will post if they reply.

Many, many thanks for your help.

DFC