I am not sure what version you are at - whatever it is, please install the latest HFA relevant to your feature pack and your first issue should be resolved, if not the second one too. In VRRP configuration, the table 'MSPI_cluster_update' does not update the VPN kernel causing the connections to fail upon failover. This is a known issue for both R54 and R55 (could be relevant to FP3 or earlier versions also) and is fixed when you apply the latest HFA.
Does the second issue happen upon policy installation? If so, please ensure the following: 'In your firewall object advanced properties, please make sure, you have 'Keep all connections' selected under Connection persistence.' Please also check to see that you have not excluded any object - network or host or service from being a part of your encryption domain or rule. hth, Rajeev -----Original Message----- From: Mailing list for discussion of Firewall-1 [mailto:[EMAIL PROTECTED] On Behalf Of Chandraprakash Suryawanshi Sent: Thursday, January 13, 2005 7:17 AM To: [email protected] Subject: [FW-1] IPSEC no valid SA's and clear text recieved in encrypted packet Dear Gurus. I am having some issue with VPN. We have some 28 firewall modules running in different countries and they all have VPN's with our central VRRP UK-Firewall. Users internal network on their respective network is their VPN domain. Running in traditional mode. Some time my France firewall users are not able to access servers behind UK-Firewall and seeing the logs says that there is no valid SA's, clearing the tunnel and deleting SA's is not helping and then we have to restart the france firewall and then everything comes up. What is the root cause of this issue and what is the solution. Second issue is regarding a firewall having VPN with UK-Firewall and sometimes again the users are not able to connect the servers and on logs it says clear text packet received in VPN tunnel. Can anyone help? regards Chandra Prakash Sr. Engineer- IT Security CISSP, MCSE, CCNA, CCSA TNS India Plot no 17, Vanenberg IT Park Madhavpur, Hyderabad Mobile---98852-84071 040-55758000 ext.584 ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] ================================================= ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
