In Addition for the second problem i found out that it has maybe to do with the encryption domain. In my theorie the connection attempt goes through the master firewall and will be decrypted (displayed in fw-log) and then forwarded to the backup machine(destination). but it will drop the packet because it only accepts encrypted packets from this source because of encryption domain...
so how can we avoid this? Thomas -----Urspr�ngliche Nachricht----- Von: Mailing list for discussion of Firewall-1 [mailto:[EMAIL PROTECTED] Auftrag von Kunz, Thomas Gesendet: Montag, 9. Februar 2004 17:40 An: [EMAIL PROTECTED] Betreff: [FW-1] trouble with connection via VPN if the destination is the remote firewall We got a VPN-Connection between two Nokia Cluster (with VRRP) here and have some trouble getting a connection directly to the remote module. wenn i try to connect via snmp from a host in LAN behind Central-Cluster to the Master-Module of the Remote Cluster, the connection is displayed dropped at the way back. Maybe there are some errors with stateful-inspection, but the timeout is 90 seconds at all. when i manually accept the back-connection from snmp-read to higher-ports it works. anyone seen the same?? second problem is, that the backup-module of the remote cluster cannot be reached from the same source. maybe it is a routing problem, because the VPN-Tunnel is established from Master-Module. the drop-message in log says: "encryption failure: received a cleartext packet within a encrypted connection". can anybody give me a hint here too? Regards Thomas Kunz T-Systems International GmbH Global Network Factory, Network & Service Operations Munich Fon: +49 89 54754 416 ; Fax: +49 89 54754 491 E-Mail: [EMAIL PROTECTED] Wichtiger Hinweis: Diese E-Mail und etwaige Anlagen k�nnen Betriebs- oder Gesch�ftsgeheimnisse, dem Anwaltsgeheimnis unterliegende oder sonstige vertrauliche Informationen enthalten. Sollten Sie diese E-Mail irrt�mlich erhalten haben, ist Ihnen der Status dieser E-Mail bekannt. Bitte benachrichtigen Sie uns in diesem Fall sofort durch Antwort-Mail und l�schen Sie diese E-Mail nebst etwaigen Anlagen von Ihrem System. Ebenso d�rfen Sie diese E-Mail oder seine Anlagen nicht kopieren oder an Dritte weitergeben. Vielen Dank. Important Note: This e-mail and any attachment are confidential and may contain trade secrets and may well also be legally privileged or otherwise protected from disclosure. If you have received it in error, you are on notice of its status. Please notify us immediately by reply e-mail and then delete this e-mail and any attachment from your system. If you are not the intended recipient please understand that you must not copy this e-mail or any attachment or disclose the contents to any other person. Thank you for your cooperation. ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] ================================================= ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
