About three months ago, a strange phenomenon started happening in our network.
Firstly, let me describe the network layout (only the details which I think I'll be allowed to divulge):
- We have a router which establishes a VPN connection over the internet to our client's network.
- Checkpoint is used for the VPN connection
- I don't know the exact model of the router. But our IT admins refer to it as the "Nokia firewall"
- Workstations set their gateway to the router's IP address and that gives them both internet and VPN access.
So there's the problem:
About four months ago, Linux workstations intermittently lose internet and VPN connections. This does not happen to Windows workstations. The problem appears to only plague the ones running on Linux.
We can see that packets gets sent to the gateway but no response is received. This lasts for about 3-5mins and then internet and VPN connectivity is reestablished. We fail to see any pattern on the occurrence. The said problem reoccurs at intervals ranging from a few seconds up to a few hours.
To rule-out the Linux workstations as being the problem, we tried switching a couple of them to a different gateway. A plain router (let's call it GateWay-B). The problem does not occur when a different gateway is used.
One thing I did was to setup the IP tables so that:
- All packets bound to workstations over the VPN, use the "Nokia/checkpoint" gateway
- All other packets use another gateway; GateWay-B.
With this, I no longer loose internet connection. However, the VPN connection remains intermittent.
Does anyone have an idea what the problem is? Is it possible for a gateway to determine the OS where an incoming packet came from?