NETWORK PRESENCE ABOUT SERVICES PRODUCTS TRAINING CONTACT US SEARCH SUPPORT
 


Search
display results
words begin  exact words  any words part 

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [FW-1] VPN Question - ICMP Packet Out of State - Linksys BEFV P41



Not to be picky, but the icmp code message you are receiving is for a
protocol unreachable and not a port unreachable.  What type of data are you
sending between the firewalls which results in the logs you are seeing?
----- Original Message -----
From: "Kinsey, Brian A." <[email protected]>
To: <[email protected]>
Sent: Tuesday, May 21, 2002 10:48 AM
Subject: Re: [FW-1] VPN Question - ICMP Packet Out of State - Linksys BEFV
P41


> Yes, I have IPSec_cluster_nat = true for all my firewall objects and my
> Cluster Objects, but I still can't get the VPN to terminate on the VRRP
> address. I assume that this is what you were saying was "posted less than
2
> weeks ago" as it is all I can find in the list archives or on Phoneboy.
>
> Any further help on this would be wonderful, BUT...
>
> My main problem, which I see no info in the archives or on Phoneboy about,
> is the first issue. Even when I terminate the VPN at the actual Firewall
IP
> address (not the virtual IP), I cannot communicate across the tunnel. Both
> sides show the tunnel as active, but when I try to ping across, I get the
> following in my Checkpoint logs:
>
> Source = firewall external IP
> Destination = Linksys external IP
> Action = Drop
> Info = icmp-type 3 icmp-code 2 message_info ICMP packet out of state
>
> I can't find anything that tells me why I would be getting these Port
> Unreachables from my Checkpoint firewall, or why it would be out of state.
>
>
> -----Original Message-----
> From: Don [mailto:[email protected]]
> Sent: Thursday, May 16, 2002 3:15 PM
> To: [email protected]
> Subject: Re: [FW-1] VPN Question - ICMP Packet Out of State - Linksys
> BEFVP41
>
> > I am trying to set up a VPN between my NG FP1 FW and a Linksys BEFVP41.
I
> > see the key installs in my log, and the Linksys shows the Status as
> > Connected, but I cannot access machines across the tunnel. When I try to
> > ping from a machine behind the Linksys to a machine inside my firewall,
I
> > get request timed out. In my firewall log, I see the following:
> >
> > Source = firewall external IP
> > Destination = Linksys external IP
> > Action = Drop
> > Info = icmp-type 3 icmp-code 2 message_info ICMP packet out of state
> >
> >
> > Also, my firewalls are Nokias with VRRP (monitored circuit). If I enter
> the
> > virtual external address of my firewalls into the Remote Security
Gateway
> > field on the Linksys, I don't even get the key installs. I have to enter
> the
> > actual IPs of one of the firewalls for it to get that far. Any ideas as
to
> > why I can't terminate my VPNs to the virtual IP?
> Did you define cluster_nat (or whatever it is called) to true in
> objects.c?
>
> This same question was posted less than 2 weeks ago. Please check the
> archives for the appropriate answer or search on www.phoneboy.com as the
> answer is there as well.
>
> -Don
>
> =================================================
> To set vacation, Out Of Office, or away messages,
> send an email to [email protected]
> in the BODY of the email add:
> set fw-1-mailinglist nomail
> =================================================
> To unsubscribe from this mailing list,
> please see the instructions at
> http://www.checkpoint.com/services/mailing.html
> =================================================
> If you have any questions on how to change your
> subscription options, email
> [email protected]
> =================================================
>
> =================================================
> To set vacation, Out Of Office, or away messages,
> send an email to [email protected]
> in the BODY of the email add:
> set fw-1-mailinglist nomail
> =================================================
> To unsubscribe from this mailing list,
> please see the instructions at
> http://www.checkpoint.com/services/mailing.html
> =================================================
> If you have any questions on how to change your
> subscription options, email
> [email protected]
> =================================================

=================================================
To set vacation, Out Of Office, or away messages,
send an email to [email protected]
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
[email protected]
=================================================



 
----------------------------------

ABOUT SERVICES PRODUCTS TRAINING CONTACT US SEARCH SUPPORT SITE MAP LEGAL
   All contents © 2004 Network Presence, LLC. All rights reserved.