| |
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[FW-1] invalid certificate on second external interface of VPN GW
Hi,
I'm running into problems with a VPN GW that has two external interfaces.
Here is our current situation:
__ce-rtr1__internal WAN__other WAN vpn-1 gateways
/
/
192.168.25.0 -- A ---+---- B --- 192.168.24.0
\
\___ce-rtr2__ internet __ other Internet vpn-1 gateways
Gateway A is running the management server and VPN-1,
its encryption domain is 192.168.25.0,
its internal interface 192.168.25.1,
its first external interface connects to a customer edge router to Internet
(ce-rtr2).
It has its default gateway defined to that router.
its second external interface connects to a subnet in which Gateway B
and another customer edge router that connects to an internal WAN.
Gateway B is running VPN-1
its encryption domain is 192.168.24.0,
its internal interface is 192.168.24.1
its external interface connects to Gateway A and ce-rtr1
All previous routing issues have been solved.
When i try to set up an IPSec tunnel between Gateway A and Gateway B or
one of the other WAN gateways, I see that the IKE handshake stops with the
message: "IKE: Phase1 received notification from peer: invalid certificate".
IKE Setup between gateway A and the Internet gateways doesnt give problems.
We are using the internal CA for the certificates.
We are using the central licensing scheme, with the IP defined on Gateways
A's first
interface.
If i swap the first and second interface on Gateway A, IKE setup will work
between
Gateway A and the WAN gateway's, but not between Gateway A and the Internet
gateways.
Is this a license isssue? Who gives a hint?
Hans Bayle
Network Consultant
[email protected]
+-----------------------------------------------------+
| Hans Bayle <[email protected]> |
| Technical Consultant |
| |
| Zinopsys BV |
| phone +31 20 6123614 |
| mobile +31 6 53948140 |
| fax +31 20 6123849 |
| [email protected] |
+-----------------------------------------------------+
=================================================
To set vacation, Out-Of-Office, or away messages,
send an email to [email protected]
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
[email protected]
=================================================
|
|
