It says rule 0 - implied rules .... have you had a look at those? First look at those then....
It seems as though the remote peer is trying to use AES-MD5 in the SA negotiation. Ensure this is the intended transform-set that you wish to use and make sure that your negotiation contains the same information: Key exchange: Diffie (1,2,5) Encryption: DES, 3DES, AES Secret: Pre-shared/CA IPsec & IKE lifetime IPSec Transform Set ESP-MD5-HMAC or AH-SHA-HMAC etc etc.... On the pix to a 'sh crypto ipsec sa' and 'sh crypto ike sa' and if you cant see the goods in there then do some debugs. Regards, Paul Dawson -----Original Message----- From: Schroeer, Waldemar [mailto:[EMAIL PROTECTED] Sent: 21 November 2003 13:10 To: [EMAIL PROTECTED] Subject: [FW-1] how to snoop Hi, i am currently trying to set up vpn between my checkpoint ng+ai, running on sparc solaris, and a cisco pix. it does not work at first go. so tried to use snoop to see whether there are any IKE related packets originated on my site or coming from the vpn endpoint. i tried the following (just assume 10.10.105.2 is the external nic of the fw): snoop -r -V from 10.10.105.2 or to 10.10.105.2 i did a telnet from outsite and snoop showed me this incoming packet correctly even if the rulebase is blocking such packets. when i try to make any connection from a host on my site to a host on the other site of the vpn tunnel, nothing happens. snoop remains mute and after a while, about a minute sometime a little bit more, i get the following error: -------------------------------------------------------- Number: 1091517 Date: 20Nov2003 Time: 17:43:31 Product: VPN-1 & FireWall-1 Interface: daemon Origin: eukey003 (10.10.105.2) Protocol: ip Action: Reject Type: Log Reject Reason: IKE failure Rule: 0 - Implied Rules Encryption Scheme: IKE VPN Peer Gateway: TX__VPN-Gateway (120.50.162.6) Information: encryption failure: no response from peer. -------------------------------------------------------- twenty seconds later i get: -------------------------------------------------------- Number: 1091523 Date: 20Nov2003 Time: 17:43:55 Product: VPN-1 & FireWall-1 Interface: hme1 Origin: eukey003 (10.1.102.31) Source: eukey003 (10.10.105.2) Destination: TX__VPN-Gateway (120.50.162.6) Protocol: udp Service: IKE (500) Action: Drop Type: Log Rule: 0 - Implied Rules Source Port: IKE (500) Destination Key ID: 0x00000000 Encryption Scheme: IKE VPN Peer Gateway: TX__VPN-Gateway (120.50.162.6) Encryption Methods: ESP: AES-128 + MD5 Community: TX_EU_VPN_2 Information: encryption fail reason: Packet is dropped because there is no valid SA - please refer to solution sk19423 in SecureKnowledge Database for more information -------------------------------------------------------- thanks, waldemar ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] ================================================= Please note that: 1. This e-mail may constitute privileged information. If you are not the intended recipient, you have received this confidential email and any attachments transmitted with it in error and you must not disclose, copy, circulate or in any other way use or rely on this information. 2. E-mails to and from the company are monitored for operational reasons and in accordance with lawful business practices. 3. The contents of this email are those of the individual and do not necessarily represent the views of the company. 4. The company does not conclude contracts by email and all negotiations are subject to contract. 5. The company accepts no responsibility once an e-mail and any attachments is sent. http://www.activis.com This annotation was added by the e-scan service. http://www.activis.com ---------------------------------------------------------------------------------- This message has been checked for all known viruses by e:)scan. For further information please contact [EMAIL PROTECTED] ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
