[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [FW-1] Strange behaviour of a VPN between a PIX and Checkpoint NG/FP3
hi,
some time ago I worked with a customer at a similar problem with a cisco
concentrator 4000. seems that this bug at ciscos was is causing the tunnel-
failure:
* CSCea04137
There is a problem with IPSEC SAs reestablishing after checkpoint initiates
a soft reset.
maybe its possible that the pix has the same behaviour.
try to clear the ike-sa's at the pix instead of recompiling the fw-1
policy. this
should also work.
a solution would be to modify the ike-sa-renegotiation-timeouts on both
sites... let's say 70000 min ;-)
/markus
At 19:59 09.10.2003, you wrote:
Hello all,
We have a really strange phenomenon in a VPN between a PIX and a
Checkpoint module (NG/FP3).
>From time to time, the VPN stops working. IPSEC packets come in, but are
dropped (reason : "No valid SA"). And for each packet being dropped, a
packet "Delete IPSEC SA" is sent from the Checkpoint.
Fortunately, the solution is not really difficult : recompiling. But every
times, the guy at the other site rings like hell ...
Any idea ?
JF
--
Jean-Francois Gobin - Administrateur gobinjf.be
http://www.gobinjf.be mailto:[email protected]
=================================================
To set vacation, Out-Of-Office, or away messages,
send an email to [email protected]
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
[email protected]
=================================================
--
Markus Hofbauer, IT-Service / Security
Bacher Systems EDV GmbH, Wienerbergstr. 11B, A-1101 Wien, Austria
phone: +43 (1) 60 126-34 | fax: +43 (1) 60 126-4
e-mail: [email protected] | web: www.bacher.at
=================================================
To set vacation, Out-Of-Office, or away messages,
send an email to [email protected]
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
[email protected]
=================================================