[FW-1] Hybrid Mode IKE for SecureRemote Authentication

[Tom Abraham <ta@FW1-NOSPAMACECOMM.COM>]

I am having a problem getting Hybrid mode for IKE working with SecureClient.
I am running 4.1 SP4 for both the FW/VPN and SecureClient.  I have followed
the instructions in the document from Checkpoint's Web site "Hybrid Mode IKE
for SecureRemote Authentication", but I continue to have a problem.  I am
trying to use IKE in Hybrid mode so that we can use the SecureIDs for
authentication.

I get this error message when I try to log in using Secure Remote and IKE:
"Negotiation with firewall ... has failed. IKE is not properly defined for
user."
The firewall log shows this error: "reject, rule 0, reason client
encryption: user cannot use IKE"

I found a posting with this same exact error in the mailing list archives on
Phoneboy but could not find a solution.  I believe IKE is configured
correctly in the FW/VPN becaue we use an IKE VPN between a SonicWall and the
Checkpoint firewall and have had no problems.  In addition, if I select
"Password" for IKE authentication everything works fine with the
SecureClient access.  When I try and use the SecureID for authentication, I
get the error listed above.

I would sure appreciate any input.

Tom

=================================================
To set vacation, Out Of Office, or away messages,
send an email to LISTSERV@lists.us.checkpoint.com
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
fw-1-owner@ts.checkpoint.com
=================================================