I'm assuming you are snooping the firewall using the firewall machine itself. I have often gotten strange results when doing that. It is important to make sure you are snooping on the correct interface. Snoop will always use the same interface unless you tell it differently so on a machine with multiple interfaces, you might not see traffic that doesn't make it thru. Use the snoop -d <interface> option to make sure you are on the right one. I have another machine connected in between my firewall and the Internet with the interface shut off. I can still snoop traffic passing that interface but no one can connect to it.
You seems to know this already but just for the record, you will only see traffic from the two VPN points, not from the originating hosts. Excuse me if I'm telling you something you already know but this tripped me up at first. For example, if the end points are 1 and 2 but the tunnel is between 3 and 4, you will only see traffic between 3 and 4. Hope this helps. Jim Edwards -----Original Message----- From: Schroeer, Waldemar [mailto:[EMAIL PROTECTED] Sent: Friday, November 21, 2003 7:10 AM To: [EMAIL PROTECTED] Subject: [FW-1] how to snoop Hi, i am currently trying to set up vpn between my checkpoint ng+ai, running on sparc solaris, and a cisco pix. it does not work at first go. so tried to use snoop to see whether there are any IKE related packets originated on my site or coming from the vpn endpoint. i tried the following (just assume 10.10.105.2 is the external nic of the fw): snoop -r -V from 10.10.105.2 or to 10.10.105.2 i did a telnet from outsite and snoop showed me this incoming packet correctly even if the rulebase is blocking such packets. when i try to make any connection from a host on my site to a host on the other site of the vpn tunnel, nothing happens. snoop remains mute and after a while, about a minute sometime a little bit more, i get the following error: -------------------------------------------------------- Number: 1091517 Date: 20Nov2003 Time: 17:43:31 Product: VPN-1 & FireWall-1 Interface: daemon Origin: eukey003 (10.10.105.2) Protocol: ip Action: Reject Type: Log Reject Reason: IKE failure Rule: 0 - Implied Rules Encryption Scheme: IKE VPN Peer Gateway: TX__VPN-Gateway (120.50.162.6) Information: encryption failure: no response from peer. -------------------------------------------------------- twenty seconds later i get: -------------------------------------------------------- Number: 1091523 Date: 20Nov2003 Time: 17:43:55 Product: VPN-1 & FireWall-1 Interface: hme1 Origin: eukey003 (10.1.102.31) Source: eukey003 (10.10.105.2) Destination: TX__VPN-Gateway (120.50.162.6) Protocol: udp Service: IKE (500) Action: Drop Type: Log Rule: 0 - Implied Rules Source Port: IKE (500) Destination Key ID: 0x00000000 Encryption Scheme: IKE VPN Peer Gateway: TX__VPN-Gateway (120.50.162.6) Encryption Methods: ESP: AES-128 + MD5 Community: TX_EU_VPN_2 Information: encryption fail reason: Packet is dropped because there is no valid SA - please refer to solution sk19423 in SecureKnowledge Database for more information -------------------------------------------------------- thanks, waldemar ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] ================================================= ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
