> Source: [sk171314](https://support.checkpoint.com/results/sk/sk171314)

# sk171314 - L2TP connections are disconnected after 12 minutes from the Security Gateway

| Property | Value |
|----------|-------|
| Solution ID | sk171314 |
| Date Created | 2021-01-04 |
| Last Modified | 2025-07-08 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R81 (EOS) |
| OS | Gaia |

## Symptoms

- * L2TP connections are disconnected after 12 minutes from the Security Gateway.

* SmartConsole / SmartView show the log "`Cannot control L2TP tunnel owned by others`"

* This problem started after installing one of these:

  * Check Point R81
  * [Jumbo Hotfix Accumulator for R80.40](https://sc1.checkpoint.com/documents/Jumbo_HFA/R80.40/Default.htm) starting from Take 69
  * [Jumbo Hotfix Accumulator for R80.30](https://sc1.checkpoint.com/documents/Jumbo_HFA/R80.30/Default.htm) starting from Take 217
  * [Jumbo Hotfix Accumulator for R80.20](https://sc1.checkpoint.com/documents/Jumbo_HFA/R80.20/Default.htm) starting from Take 173
  * [Jumbo Hotfix Accumulator for R80.10](https://support.checkpoint.com/results/sk/sk116380) starting from Take 283

## Cause

The original fix PRHF-1164 (see [sk167636](https://support.checkpoint.com/results/sk/sk167636)) added an expiration of 10 minutes for entries in the kernel table "`L2TP_cluster`". This kernel table includes the mapping between the MSPI values for L2TP and IPsec.

Because of this new behavior, 10 minutes after the L2TP connection is established, the Security Gateway may lose the IPsec MSPI that is associated with each L2TP tunnel. As a result, the Security Gateway cannot decrypt / encrypt L2TP packets. Eventually, the L2TP client sends a disconnect request.

## Solution

This problem was fixed. The fix is included starting from:

* Check Point R81.10
* [Jumbo Hotfix Accumulator for R81](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81/Default.htm) starting from Take 13
* [Jumbo Hotfix Accumulator for R80.40](https://sc1.checkpoint.com/documents/Jumbo_HFA/R80.40/Default.htm) starting from Take 100
* [Jumbo Hotfix Accumulator for R80.30](https://sc1.checkpoint.com/documents/Jumbo_HFA/R80.30/Default.htm) starting from Take 232
* [Jumbo Hotfix Accumulator for R80.20](https://sc1.checkpoint.com/documents/Jumbo_HFA/R80.20/Default.htm) starting from Take 190

<br />

If you cannot upgrade, then as an immediate workaround, remove the expiration timeout from entries in the kernel table "`L2TP_cluster`":

1. Connect to the command line on the Management Server.
2. Log in.
3. If the default shell is Gaia Clish, then go to the Expert mode:  
   `expert`
4. On the Multi-Domain Security Management Server, go to the context of the relevant Domain Management Server:  
   `mdsenv <IP Address of Domain Management Server>`
5. Back up the applicable "`vpn_table.def`" file (refer to the [Security Management Server Administration Guide](https://support.checkpoint.com/product/184#f-commonsource=C.%20Documentation) for your version / [Multi-Domain Security Management Server Administration Guide](https://support.checkpoint.com/product/166#f-commonsource=C.%20Documentation) for your version).
6. Edit the applicable "`vpn_table.def`" file.
7. In the definition of the kernel table "`L2TP_cluster`", remove the parameter "`MSPI_CLUSTER_UPDATE_TIMEOUT`":  
   from:  
   `L2TP_cluster = dynamic sync keep expires `MSPI_CLUSTER_UPDATE_TIMEOUT` kbuf 1 limit 25000;`   
   to:  
   `L2TP_cluster = dynamic sync keep expires kbuf 1 limit 25000;`
8. Save the changes in the file.
9. On the Security Gateway / each Cluster Member, delete all current LT2P connections.  
   **Important Note** - This will disconnect all current LT2P connections.  
   1. Connect to the command line.
   2. Run: `fw tab -t L2TP_cluster -x -y`
10. In SmartConsole, install the Access Control policy on the Security Gateway / Cluster.

The Security Gateway will no longer apply the expiration timeout to **new** L2TP connections.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content