Rays suggestion should solve the problem, but may also result in excessive SA negotiations (depending on your traffic) I would suggest that you give "ike_use_largest_possible_subnets" a try. You can change the value from true to false via dbedit or guidbedit install the policy ...
Regards Ulli
On Apr 12, 2004, at 4:33 PM, J. Ruff wrote:
I've got a L2L vpn that's been functioning just fine for quite some time now. All of a sudden, some of the networks at the remote site are not accessible. The error received in tracker is:
IKE: Quick Mode Received Notification from Peer: invalid id information
I've verified encryption domains on both ends. There have been no changes what so ever on either end. After running 'vpn debug ikeon' I can see in vpn.elg that "create_packet1phase2" information has the incorrect subnet mask specified in the "debugIDPayload" section for the destination network. It should be a /24 but instead is a /23. I checked the network objects and it is specified as /24.
Here's an overview of what's working and not. Remote Encryption Domain: X.X.215.0/24 - Working X.X.216.0/24 - Not Working X.X.217.0/24 - Not Working
When communication is attempted to the 216 & 217 nets is specifies the netmask as /23 in packet #1 of the IKE Phase2 negotiation.
Any ideas???
================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
