NETWORK PRESENCE ABOUT SERVICES PRODUCTS TRAINING CONTACT US SEARCH SUPPORT
 


Search
display results
words begin  exact words  any words part 

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [FW-1] Strange behaviour of a VPN between a PIX and Checkpoint NG/FP3



hi,

some time ago I worked with a customer at a similar problem with a cisco
concentrator 4000. seems that this bug at ciscos was is causing the tunnel-
failure:
   * CSCea04137
There is a problem with IPSEC SAs reestablishing after checkpoint initiates
a soft reset.
maybe its possible that the pix has the same behaviour.

try to clear the ike-sa's at the pix instead of recompiling the fw-1
policy. this
should also work.
a solution would be to modify the ike-sa-renegotiation-timeouts on both
sites... let's say 70000 min ;-)

/markus

At 19:59 09.10.2003, you wrote:
Hello all,

We have a really strange phenomenon in a VPN between a PIX and a
Checkpoint module (NG/FP3).

>From time to time, the VPN stops working. IPSEC packets come in, but are
dropped (reason : "No valid SA"). And for each packet being dropped, a
packet "Delete IPSEC SA" is sent from the Checkpoint.

Fortunately, the solution is not really difficult : recompiling. But every
times, the guy at the other site rings like hell ...

Any idea ?

JF

--
Jean-Francois Gobin - Administrateur gobinjf.be
http://www.gobinjf.be   mailto:[email protected]

=================================================
To set vacation, Out-Of-Office, or away messages,
send an email to [email protected]
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
[email protected]
=================================================

-- Markus Hofbauer, IT-Service / Security Bacher Systems EDV GmbH, Wienerbergstr. 11B, A-1101 Wien, Austria phone: +43 (1) 60 126-34 | fax: +43 (1) 60 126-4 e-mail: [email protected] | web: www.bacher.at



=================================================
To set vacation, Out-Of-Office, or away messages,
send an email to [email protected]
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
[email protected]
=================================================



 
----------------------------------

ABOUT SERVICES PRODUCTS TRAINING CONTACT US SEARCH SUPPORT SITE MAP LEGAL
   All contents © 2004 Network Presence, LLC. All rights reserved.