> Source: [sk97546](https://support.checkpoint.com/results/sk/sk97546)

# sk97546 - Random Remote Access users disconnected after 20 seconds while other users are able to connect 

| Property | Value |
|----------|-------|
| Solution ID | sk97546 |
| Date Created | 2013-12-03 |
| Last Modified | 2023-05-07 |
| Technical Level | General |
| Products | Security Gateway, Endpoint Security |
| Versions | R82.10, R82, R81.20, Cloud, E89.X, E88.X |

## Symptoms

- * Random Remote Access users disconnected after 20 seconds, while other users from same machine are able to connect.
* fw zdebug drop shows:  
  "dropped by vpn_ipsec_decrypt Reason: decryption failure: Could not get SAs from packet".
* In Smart View Tracker, traffic from the affected client is dropped:   
  Encryption Failure: Unknown SPI   
  Even though in previous log of "Quick Mode completion", you can see the same SPI was agreed upon with the client and should be valid.
* When using R75.x version - In the kernel debug with VPN flags - taken at the time of the connection - you see the following error messages:  
  "get_mspi_by_methods_ex_set_gtp: ERROR: failed to get meta sa;" and   
  "vpnioctl_store_spi_in_table: ERROR: outbound esp spi error;"
* When using R80.10 version - In the kernel debug with VPN flags - taken at the time of the connection - you see the following error messages:  
  "get_mspi_by_methods_with_user_kbuf: ERROR: Wrong user on MSA:;" followed few lines down by   
  "ERROR: store_outbound_spi_in_msa: failed to found/create MSA for SPI" and   
  "store_spi_in_table_ex: failed to store outbound esp SA;"

## Cause

The kernel is trying to store outbound SPI (IPSec SA) in MSA (Meta SA), MSPI_by_methods returns that there is already MSPI (Meta SPI), and thus a new MSPI is not created.

Therefore, when the client sends encrypted traffic and the gateway tries to get the MSPI - it is not found and the traffic is dropped.

The client is hard-coded to disconnect after 20 seconds if it does not get a response to tunnel test packets.

## Solution

This problem was fixed. The fix is included in:

* **[R80.10 Jumbo take 185](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk116380&partition=General&product=Security)**

Check Point recommends to always [upgrade to the most recent version](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk116380&partition=General&product=Security).  

<br />

<br />

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content