> Source: [sk1000218](https://support.checkpoint.com/results/sk/sk1000218)

# sk1000218 - Remote Access VPN disconnects shortly after connection in Scalable Platform Environments.

| Property | Value |
|----------|-------|
| Solution ID | sk1000218 |
| Date Created | 2026-10-01 |
| Last Modified | 2026-10-04 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |
| OS | Gaia |

## Symptoms

- * Remote Access VPN users connect successfully using Visitor Mode, but the connection disconnects shortly afterward, for example, after a few seconds.

* This log is shown when running kernel debug on the Security Gateway (`fw ctl zdebug + drop`):

  `pnktcpt_chain_out Reason: vpnk_tcpt invalid negative tunnel id`
* This issue can occur in Scalable Platform environments, such as:

  * Maestro
  * ElasticXL
  * Active-Active ClusterXL deployments

## Cause

When the client uses Visitor Mode, the Remote Access connection is encapsulated within a TCP tunnel.

In a Scalable Platform environment, the VPN tunnel can be created on one Security Group Member (SGM) or cluster member, while the return traffic is handled by a different member.

The member that receives the return traffic does not own the TCP tunnel and therefore identifies the tunnel ID as invalid, causing the packet to be dropped.

Traffic on port 18234 is used for tunnel testing. This traffic is not the root cause of the issue; it only exposes the tunnel ownership problem in the logs.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content