Thanks all. The field value change makes the most sense in this scenario because after removing the one X.X.217.0/24 from the dest encrypt-domain the X.X.216.0/24 net was masked properly in the IKE Phase2 packet.
So I used dbedit and issued the following command(sorry for line wrap): dbedit> modify properties firewall_properties ike_use_largest_possible_subnets flase I then installed policy, but the problem still exist. I verified the value of ike_use_largest_possible_subnets had changed (and it did) from 'true' to 'false'. The IKE Phase2 packet is still addressing both the X.X.216.0/24 & X.X.217.0/24 as one /23 net. Any ideas on what should be done now??? Thanks in advance. > Rays suggestion should solve the problem, but may also result in > excessive SA negotiations (depending on your traffic) > I would suggest that you give "ike_use_largest_possible_subnets" a try. > You can change the value from true to false via > dbedit or guidbedit install the policy ... > > Regards > Ulli > > On Apr 12, 2004, at 4:33 PM, J. Ruff wrote: > >> I've got a L2L vpn that's been functioning just fine for quite some >> time >> now. All of a sudden, some of the networks at the remote site are not >> accessible. The error received in tracker is: >> >> IKE: Quick Mode Received Notification from Peer: invalid id information >> >> I've verified encryption domains on both ends. There have been no >> changes >> what so ever on either end. After running 'vpn debug ikeon' I can see >> in >> vpn.elg that "create_packet1phase2" information has the incorrect >> subnet >> mask specified in the "debugIDPayload" section for the destination >> network. It should be a /24 but instead is a /23. I checked the >> network >> objects and it is specified as /24. >> >> Here's an overview of what's working and not. >> Remote Encryption Domain: >> X.X.215.0/24 - Working >> X.X.216.0/24 - Not Working >> X.X.217.0/24 - Not Working >> >> When communication is attempted to the 216 & 217 nets is specifies the >> netmask as /23 in packet #1 of the IKE Phase2 negotiation. >> >> Any ideas??? > > ================================================= > To set vacation, Out-Of-Office, or away messages, > send an email to [EMAIL PROTECTED] > in the BODY of the email add: > set fw-1-mailinglist nomail > ================================================= > To unsubscribe from this mailing list, > please see the instructions at > http://www.checkpoint.com/services/mailing.html > ================================================= > If you have any questions on how to change your > subscription options, email > [EMAIL PROTECTED] > ================================================= > ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
