Re: [FW1] SecuRemote can't exchange keys w/VPN-1

[CryptoTech <cryptotech@FW1-NOSPAMgmx.de>]

Paul,
Just a few questions:
You got them to sell you gold support for an eval -- ah - no matter.

Is the firewall object ip the external interface?  Non-authenticated requests use
FWZ for topology download, which is not interface specific, but the key exchange and
encryption in SP1 will require that the client be able to communicate directly with
the ip address defined under manage->network objects-> <your firewall object - main
ip address>

Lemme know how this results.
Cheers,
CT

"Mills, Paul" wrote:

> Here are the details:
>
> VPN-1 4.1 SP1 on NT 4.0 Server(SP6a)
> Eval License
> SecuRemote build 4174
>
> I cannot get SecuRemote to authenticate with the firewall.  I can do a
> topology update but when I enter the username/password in SecuRemote, it
> says "Exchanging Keys with Firewall" and times out with a "Firewall did not
> answer" error message.
>
> I was on my way to trying Hybrid IKE authentication...I have already created
> the CA and the certificate.
> I have searched through saved emails from this list for the past year and
> have not found a solution.
>
> Encryption Domain is created; Exportable for SecuRemote is checked
> FW responds to unauthenticated topology requests
> FW object is configured with IKE (Pre-Shared Secret) and FWZ (Keys
> generated, FWZ encapsulate)
> User is created with IKE authentication (password); user is in the SR group
> Rule is S: SRgroup@any   D: Encryption Domain   Ser: Any   Act: Client
> Encrypt
> Client Encrypt properties NOT checked for "...desktop configuration
> options..."
>
> I need help on this.  I think my Checkpoint Gold support expired.
>
> Thanks in advance!
>
> Paul Mills
> CCSA, CCSE
> Data Security Analyst-Firewalls
>
> ================================================================================
>      To unsubscribe from this mailing list, please see the instructions at
>                http://www.checkpoint.com/services/mailing.html
> ================================================================================



================================================================================
     To unsubscribe from this mailing list, please see the instructions at
               http://www.checkpoint.com/services/mailing.html
================================================================================