Re: VPN problem for FW-1 Checkpoint

Alvin:

No response from peer is simple to diagnose, first
verify that the IKE/UDP 500 packets are leaving your
firewall's external interface and the partner's
firewall is not responding back.  This message is
generated when there is not a response from the
partner's firewall/gateway.
The vpn tunnel should not go down and have to be
re-created on a normal policy install, although it
sounds like your firewall attempted to re-create the
tunnel.  Depending on the partner's gateway, it may
think the VPN tunnel is currently up and will not
accept the IKE packet from your gateway. Some gateways
will not accept an IKE packet requesting to negotiate
a new tunnel if it currently has an existing IKE/IPSEC
tunnel.


--- Alvin Wong <alvin.wong@b2b.com.my> wrote:

> Hi all,
>
> I have a problem with production firewall FW-1
> Checkpoint with VPN 
> running constantly for 2 years. However with a
> normal policy update 
> yesterday, the VPN function stopped working. VPN is
> using IKE with DES, 
> MD5, shared secret. Tunnel checked out fine on both
> site firewalls , all 
> configuration is correct.
>
> I have 2 types of errors, encryption failure: no
> response from 
> peer.scheme: IKE
>
> and
>
> encryption failure: Packet is not IPSEC scheme: IKE
>
> Any Checkpoint gurus out there can shed light on
> this problem or share 
> experiences and troubleshooting on this form of
> failure?
>
> Regards,
> Alvin



                
_______________________________
Do you Yahoo!?
Declare Yourself - Register online to vote today!
http://vote.yahoo.com