[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] Re: [FW-1] VPN Question - ICMP Packet Out of State - Linksys BEFV P41
Not to be picky, but the icmp code message you are receiving is for a protocol unreachable and not a port unreachable. What type of data are you sending between the firewalls which results in the logs you are seeing? ----- Original Message ----- From: "Kinsey, Brian A." <[email protected]> To: <[email protected]> Sent: Tuesday, May 21, 2002 10:48 AM Subject: Re: [FW-1] VPN Question - ICMP Packet Out of State - Linksys BEFV P41 > Yes, I have IPSec_cluster_nat = true for all my firewall objects and my > Cluster Objects, but I still can't get the VPN to terminate on the VRRP > address. I assume that this is what you were saying was "posted less than 2 > weeks ago" as it is all I can find in the list archives or on Phoneboy. > > Any further help on this would be wonderful, BUT... > > My main problem, which I see no info in the archives or on Phoneboy about, > is the first issue. Even when I terminate the VPN at the actual Firewall IP > address (not the virtual IP), I cannot communicate across the tunnel. Both > sides show the tunnel as active, but when I try to ping across, I get the > following in my Checkpoint logs: > > Source = firewall external IP > Destination = Linksys external IP > Action = Drop > Info = icmp-type 3 icmp-code 2 message_info ICMP packet out of state > > I can't find anything that tells me why I would be getting these Port > Unreachables from my Checkpoint firewall, or why it would be out of state. > > > -----Original Message----- > From: Don [mailto:[email protected]] > Sent: Thursday, May 16, 2002 3:15 PM > To: [email protected] > Subject: Re: [FW-1] VPN Question - ICMP Packet Out of State - Linksys > BEFVP41 > > > I am trying to set up a VPN between my NG FP1 FW and a Linksys BEFVP41. I > > see the key installs in my log, and the Linksys shows the Status as > > Connected, but I cannot access machines across the tunnel. When I try to > > ping from a machine behind the Linksys to a machine inside my firewall, I > > get request timed out. In my firewall log, I see the following: > > > > Source = firewall external IP > > Destination = Linksys external IP > > Action = Drop > > Info = icmp-type 3 icmp-code 2 message_info ICMP packet out of state > > > > > > Also, my firewalls are Nokias with VRRP (monitored circuit). If I enter > the > > virtual external address of my firewalls into the Remote Security Gateway > > field on the Linksys, I don't even get the key installs. I have to enter > the > > actual IPs of one of the firewalls for it to get that far. Any ideas as to > > why I can't terminate my VPNs to the virtual IP? > Did you define cluster_nat (or whatever it is called) to true in > objects.c? > > This same question was posted less than 2 weeks ago. Please check the > archives for the appropriate answer or search on www.phoneboy.com as the > answer is there as well. > > -Don > > ================================================= > To set vacation, Out Of Office, or away messages, > send an email to [email protected] > in the BODY of the email add: > set fw-1-mailinglist nomail > ================================================= > To unsubscribe from this mailing list, > please see the instructions at > http://www.checkpoint.com/services/mailing.html > ================================================= > If you have any questions on how to change your > subscription options, email > [email protected] > ================================================= > > ================================================= > To set vacation, Out Of Office, or away messages, > send an email to [email protected] > in the BODY of the email add: > set fw-1-mailinglist nomail > ================================================= > To unsubscribe from this mailing list, > please see the instructions at > http://www.checkpoint.com/services/mailing.html > ================================================= > If you have any questions on how to change your > subscription options, email > [email protected] > ================================================= ================================================= To set vacation, Out Of Office, or away messages, send an email to [email protected] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [email protected] =================================================
|