[FW-1] Antw: [FW-1] CPNG VPN with other FWs

[Tobias Wagner <Tobias.Wagner@FW1-NOSPAMCONTROLWARE.DE>]

Hi Alan,

I had the same masage if I would perform a VPN betwen a CP-FW1 and an Crypto Cluster from Nokia.
In my confurations i had on one side sha1 and on the other md5 for the hash algorythm.

It seems that both endpoints have not the same Encryption Methode.

If you are using PFS, you must on the Netscreen use the DiffieHellman Group 1 in Phase 2 of the IPsec-settings and Diffie Hellmann Group 2 in the IKE settings.
You can also disable the PFS on both sides for the test to get sure.
In a second step, you must configure the "Time outs" for IKE and IPSEC in the Propertys of your Firewall to the same times that are configured in the Netscreen box.

Please let me know, if it will run.

Thanks

Tobi



>>> Alan Yeow <alan@SILICON.NET.MY> Donnerstag, 28. März 2002 04:27 >>>
hi all,

Has anyone tested VPN using Traditional Mode (setup with Encryption Rule) which is
one of the 3 VPN cfg methods provided in CPNG?

We're testing CPNG FP1 with NetScreen firewalls.
After configuring both ends of the firewalls, we did a ping to each end and got this msg
from the logviewer, perhaps you guys understand what it means?

ID    SRC            DEST        Info
1    NetScreen    CPNG        IKE main mode completed
2    NetScreen    CPNG        IKE Informational Exchange Received Delete IPSEC SA from Peer : XBCNsd8s SPIs: 4asd8514f
3    NetScreen    CPNG        IKE Quick Mode Completion IKE IDs:- 192.168.2.0 (msk=/24) and subnet 192.168.4.0 (msk=/24)
4    Remote LAN CPNG        icmp type 8 code 0 encryption failure: Peer GW mismatch ESP: 3DES + MD5 + PFS

ID 1 = Phase 1 IKE done
ID 3 = Phase 2 IKE done
ID 4 = ??

After viewing the log, it seems that the VPN is established but both ends of the LAN still cant PING each other.
How is that possible when all the IKE key exchange has been completed as displayed and all services allowed at both ends?
Perhaps we missed out some cfg's on the CPNG, any suggestions?


Thanks
Alan

=================================================
To set vacation, Out Of Office, or away messages,
send an email to LISTSERV@lists.us.checkpoint.com
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
fw-1-owner@ts.checkpoint.com
=================================================