Hi Erez,
I didn't set this FW-1 up - I mostly do Cisco/Netscreen - so I was very hopeful
when I got your email.
Unfortunately all of these settings were already exactly as you described.
I'll forward this to the external guys - though the problem seems to me to be
on our end.
Thanks a bunch though for the information - any other ideas?
Thanks!
Chris Meidinger
Consultant
Network Security
MCSE; GIAC: GSNA, GAWN
badenIT GmbH
________________________________
Von: ??????? ?? ??? [mailto:erezsht@netvision.net.il]
Gesendet: Donnerstag, 24. August 2006 22:25
An: Meidinger Chris; firewalls@securityfocus.com
Betreff: RE: Stale IKE SA on FW-1
Dear Chris,
Please Try this:
1. Remove the: "Keep Ike SA's" smartDashBoardà Policy à Global Properties à
SmartDashboard Customization à Configure à VPN / IKE Properties à uncheck
"Keep Ike SA's" (make sure that the externally managed GW guy's do that too)
2. In the cluster object itself: à advanced à connection persistency à select:
rematch all connections.
3. In the cluster object itself: à VPN à advanced à check: perform organized
shutdown (make sure that the externally managed GW guy's do that too)
4. Install the policy to the cluster.
5. Optionally: [Install R61 Latest HFA (if available) to management server
and cluster.]
If the externally managed gw support's the "send initial contact" then
Under: smart Dashboardà Policy à Global Properties à Smart Dashboard
Customization à Configure à VPN / IKE Properties à
Make sure that the settings in the cluster and the settings in the remote
GW are identical (both should send each other)
This should bring order to chaos in the SA's
Erez Shtang - [ Information Security Consultant ]
________________________________
From: Meidinger Chris [mailto:chris.meidinger@badenIT.de]
Sent: Thursday, August 24, 2006 8:52 PM
To: firewalls@securityfocus.com
Subject: FW: Stale IKE SA on FW-1
Hi List,
has anyone ever had an IKE SA that just wouldn't die on a Checkpoint?
The Firewall in question is a (fairly new) R61 clustered on Nokia hardware.
Normally the #vpn tu command should allow SA's to be deleted either singly or
collectively.
I have a stale IKE SA between this gateway and another (externally managed)
gateway that refuses to die. The SA is more than twice as old as the reneg
time, and is just sitting there blocking negotiation of a new one. If I delete
it with #vpn tu absolutely nothing changes and the SA is still showing in the
list.
Have any of you ever seen this before? Does anyone have an idea what I can do?
I have already tried:
- making changes in encryption in the community settings and publishing the
policy
- deleting the object for the remote gateway and the related rules, publishing
and then recreating them
- every possible #vpn tu command, including deleting ALL IKE+IPSec SA's
- banging my head on the wall
I was even considering booting the firewall, but the SA should be synched on
both so I assume that will be pretty useless as the other node will have the SA
as well.
Thanks in advance for any suggestions, I wasn't able to find *anything* on
google about this type of problem.
Chris Meidinger
<http://545293.sigclick.mailinfo.com/sigclick/04070703/080B4E00/030A4E03/21321182.jpg>
--
No virus found in this incoming message.
Checked by AVG Free Edition.
Version: 7.1.405 / Virus Database: 268.11.5/426 - Release Date: 23/08/2006
--
No virus found in this outgoing message.
Checked by AVG Free Edition.
Version: 7.1.405 / Virus Database: 268.11.5/426 - Release Date: 23/08/2006
