Symantec VIP encountering issues after upgrading VIP. Checkpoint authentications failing with "User and Password denied"

Products

• VIP Service

Issue/Introduction

Checkpoint authentications are failing after upgrading Symantec VIP Enterprise Gateway server

Environment

VIP Enterprise Gateway 9.11.0

Cause

VIP Radius is able to receive the request, but Checkpoint is not receiving "Access Challenge" request or Radius responses. Checkpoint logs show error with "New session received. Closing previous session"

Resolution

1. There is a known issue with VIP Enterprise Gateway version 9.11.0 and checkpoint regarding the 'PUSH Number Challenge' attribute. Upgrading to VIP Enterprise Gateway 9.11.1 will resolve this issue.
   • Refer to KB 221015 for more information: https://knowledge.broadcom.com/external/article/221015
2. If validation fail after upgrading to 9.11.1 or later, there may be an issue with the CheckPoint firewall. See Solution ID: sk42184 (addresses a compatibility issue between Symantec VIP and Check Point. Following the guidance in the article, set the `radius_ignore` parameter to `80:` and push the policy. This should resolve the authentication issue without requiring a restart of Check Point services. 

Additional Information

Checkpoint support article sk42184:  https://support.checkpoint.com/results/sk/sk42184