Re: [FW1] Invalid Cookie

[CryptoTech <cryptotech@FW1-NOSPAMgmx.de>]

Gus,
The cookie that is off is the timeliness cookie, designed to validate that the vpn
connection is not a replay of a previous session.  Phase 2 stage 0 indicates that
alcatel is not holding the phase 1 cooking going into the SA establishment.  I've
seen this problem before where a unidirectional tunnel was possible because of
incompatibility in VPN code.  However, since Alcatel and Checkpoint are both IPSec
1.0a certified, I would be more inclined to suspect that the Alcatel side is using
perfect forward secrecy with a low re-key interval.  This would mean that check
point does not invalidate the session, but that the remote side initiates a SA
renewal request, using a completely different set of parameters upon each rekey,
whereas the check point is probably not configured for PFS, and thus reuses the old
Skey_id_r, id_e, and id_a.
The solution, I would look closely at the details of the alcatel side connection,
and then check the Policy->Properties->Encryption and look for the IPSEC
renegotiation interval.

Although suspicion has it that it will be a PFS issue.

Just a guess,
CryptoTech

Gus Reyes wrote:

> I set up VPN between Checkpoint and Alcatel systems using IKE, MD5, Shared
> Secret.  So far, only CP to Alcatel connections works, not vice versa.  Log
> viewer in CP shows successful key installs - phase 1 and phase 2.  I see
> encrypted packets going out and can even see a server behind the alcatel.
> Ten minutes after key exchange, I get the following: 'IKE Log: Sent
> Notification: invalid cookie <phase2 stage0>'. Remote end does not find my
> server.  Despite this error, I can still VPN connect with Alcatel.  Not the
> other way around.  Any ideas???
>
> Thanks
>
> Gus
>
> ================================================================================
>      To unsubscribe from this mailing list, please see the instructions at
>                http://www.checkpoint.com/services/mailing.html
> ================================================================================



================================================================================
     To unsubscribe from this mailing list, please see the instructions at
               http://www.checkpoint.com/services/mailing.html
================================================================================