Bob, Yes as far as I can tell, they are within a minute of each other time-wise. I'm wondering if it's a FP3 HF2 bug. I wish there was some way to see exactly what FP3 is doing when the Linksys tells it "invalid-id-information"
Chris -----Original Message----- From: Bob Scipioni [mailto:[EMAIL PROTECTED] Sent: Wednesday, April 02, 2003 12:26 PM To: [EMAIL PROTECTED] Subject: Re: [FW-1] befvp41 to fp3 - works on linksys side Chris, I don't recall anything being said earlier, but have you made sure there isn't any significant time offset between the two gateways? -Bob Covington, Chris wrote: >Sorry for all the postings... Here are the error messages on the >Linksys (whenever I try to access from behind FW-1): > >2003-04-01 21:32:29 IKE[8] Set up ESP tunnel with (MYIP) Success ! >2003-04-01 21:32:29 2003-04-01 21:34:16 IKE[8] Rx << QM_I1 : (MYIP) >HASH, SA, NONCE, KE, ID, ID >2003-04-01 21:34:16 IKE[8] **Check your Local/Remote Secure Group >settings ! >2003-04-01 21:34:16 IKE[8] Tx >> Notify : INVALID-ID-INFORMATION >2003-04-01 21:34:37 >2003-04-01 21:34:37 IKE[8] Tx >> MM_I1 : (MYIP) SA >2003-04-01 21:34:38 IKE[8] Rx << MM_R1 : (MYIP) SA >2003-04-01 21:34:38 IKE[8] ISAKMP SA CKI=[a5e2cfae f6359b46] >CKR=[dd2652ff a064e41c] >2003-04-01 21:34:38 IKE[8] ISAKMP SA 3DES / MD5 / PreShared / MODP_1024 >/ 28800 sec (*28800 sec) >2003-04-01 21:34:38 IKE[8] Tx >> MM_I2 : (MYIP) KE, NONCE >2003-04-01 21:34:38 IKE[8] Rx << MM_R2 : (MYIP) KE, NONCE >2003-04-01 21:34:38 IKE[8] Tx >> MM_I3 : (MYIP) ID, HASH >2003-04-01 21:34:39 IKE[8] Rx << MM_R3 : (MYIP) ID, HASH >2003-04-01 21:34:39 IKE[8] Tx >> QM_I1 : (MYIP) HASH, SA, NONCE, KE, ID, >ID >2003-04-01 21:34:39 IKE[8] Rx << QM_R1 : (MYIP) HASH, SA, NONCE, KE, ID, >ID >2003-04-01 21:34:39 IKE[8] Tx >> QM_I2 : (MYIP) HASH >2003-04-01 21:34:39 IKE[8] ESP_SA 3DES / SHA / 3600 sec (*3600 sec) / >SPI=[c99d6e8b:c47dbb84] >2003-04-01 21:34:39 IKE[8] Set up ESP tunnel with (MYIP) Success ! > >Chris > >-----Original Message----- >From: Covington, Chris >Sent: Tuesday, April 01, 2003 5:33 PM >To: [EMAIL PROTECTED] >Subject: Re: [FW-1] befvp41 to fp3 - works on linksys side > > >FYI, > >I have also tried sk16536 which looks like it describes the problem, >but that has not fixed the problem. > >Chris > >-----Original Message----- >From: Covington, Chris >Sent: Tuesday, April 01, 2003 3:41 PM >To: [EMAIL PROTECTED] >Subject: Re: [FW-1] befvp41 to fp3 - works on linksys side > > >Bob, > >Thanks for the followup. I don't think that applies in my case though; >since the remote gateway is an Interoperable device (a Linksys) and not >a Check Point Externally Management Gateway. > >Has anyone gotten a VPN working with a BEFVP41? What kind of tunnel >settings did you use? > >Chris > >-----Original Message----- >From: Bob Scipioni [mailto:[EMAIL PROTECTED] >Sent: Tuesday, April 01, 2003 1:51 PM >To: [EMAIL PROTECTED] >Subject: Re: [FW-1] befvp41 to fp3 - works on linksys side > > >Chris, > >In Solution ID: 55.0.7778402.2722456 it states: > ># The remote firewall object is defined with the wrong version in the >General tab > >as one possible cause. > >-Bob > > >Covington, Chris wrote: > > > >>Hi All, >> >>I've setup a traditional main mode 3DES MD5 site-to-site vpn with a >>linksys BEFVP41 to my Secureplatform FP3 HF2 box. Everything works >>fine on the linksys side, but if I try to access anything on the >>linksys's network from behind FW-1, I get the following errors: >> >>IKE: Quick Mode Received Notification from Peer: invalid id >>information >> >> > > > >>encryption failure: Error occured encryption fail reason: Packet is >>dropped because there is no valid SA >> >>I've tried turning on and off Perfect Forward Secrecy, Aggressive >>mode, >> >> > > > >>etc. and it seems to not make any difference. The IKE settings are >>identical on both ends. >> >>Is there anything I should I try differently? >> >>thanks, >>Chris >> >>================================================= >>To set vacation, Out Of Office, or away messages, >>send an email to [EMAIL PROTECTED] >>in the BODY of the email add: >>set fw-1-mailinglist nomail >>================================================= >>To unsubscribe from this mailing list, >>please see the instructions at >>http://www.checkpoint.com/services/mailing.html >>================================================= >>If you have any questions on how to change your >>subscription options, email >>[EMAIL PROTECTED] >>================================================= >> >> >> >> > >-- >Bob Scipioni <[EMAIL PROTECTED]> >Vice President, Product Development >Lucid Security >Research & Product Development >www.lucidsecurity.com > > > >================================================= >To set vacation, Out Of Office, or away messages, >send an email to [EMAIL PROTECTED] >in the BODY of the email add: >set fw-1-mailinglist nomail >================================================= >To unsubscribe from this mailing list, >please see the instructions at >http://www.checkpoint.com/services/mailing.html >================================================= >If you have any questions on how to change your >subscription options, email >[EMAIL PROTECTED] >================================================= > >================================================= >To set vacation, Out Of Office, or away messages, >send an email to [EMAIL PROTECTED] >in the BODY of the email add: >set fw-1-mailinglist nomail >================================================= >To unsubscribe from this mailing list, >please see the instructions at >http://www.checkpoint.com/services/mailing.html >================================================= >If you have any questions on how to change your >subscription options, email >[EMAIL PROTECTED] >================================================= > >================================================= >To set vacation, Out Of Office, or away messages, >send an email to [EMAIL PROTECTED] >in the BODY of the email add: >set fw-1-mailinglist nomail >================================================= >To unsubscribe from this mailing list, >please see the instructions at >http://www.checkpoint.com/services/mailing.html >================================================= >If you have any questions on how to change your >subscription options, email >[EMAIL PROTECTED] >================================================= > >================================================= >To set vacation, Out Of Office, or away messages, >send an email to [EMAIL PROTECTED] >in the BODY of the email add: >set fw-1-mailinglist nomail >================================================= >To unsubscribe from this mailing list, >please see the instructions at >http://www.checkpoint.com/services/mailing.html >================================================= >If you have any questions on how to change your >subscription options, email >[EMAIL PROTECTED] >================================================= > > -- Bob Scipioni <[EMAIL PROTECTED]> Vice President, Product Development Lucid Security Research & Product Development www.lucidsecurity.com ================================================= To set vacation, Out Of Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] ================================================= ================================================= To set vacation, Out Of Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
