[FW1] SecureRemote Hybrid IKE MEP Issue

["Aaron Shilts" <ashilts@FW1-NOSPAMesecurityconsulting.net>]

Hi all,

Firewalls: FW-1 v4.1 SP3 on Nokia IP440's running IPSO 3.3
Mgmt. Console: FW-1 v4.1 SP3 on W2K
SecureRemote build 4176

I'm experiencing some real pain getting SecureRemote running with multiple
entry points.  If one of our firewalls (not clustered) dies, I want the
SecureRemote users to failover to a different firewall.

I've got SecureRemote with hybrid IKE up and running.  When only one
firewall is being used as an entry point (only one marked as exportable),
the VPN works fine.  When I attempt to configure the other three firewalls
as backup gateways, I get the following error:  "Negotiation with firewall
at site ..xxx.xxx has failed.  Firewall does not support IKE."  I am
able to successfully retrieve the topology and authenticate at all times.  I
have attempted this with users from the FW-1 database and Radius.

The firewall obviously supports IKE because an IKE tunnel was sucessfully
established before switching to the multiple entry point configuration.

Any ideas?  Please CC my email address in any feedbak you may provide to the
list.  I don't seem to be receiving the digest of this last as much
recently...?

___________________________
Aaron Shilts
eSecurity Consulting, Inc.

PGP key ID: 0x1BD13B5F
__________________________



================================================================================
     To unsubscribe from this mailing list, please see the instructions at
               http://www.checkpoint.com/services/mailing.html
================================================================================