A few things to keep in mind when doing IPSec between checkpoint and Pix devices: 1) Checkpoint tends to "suppernet" the network so be careful about this because this will cause problem and Quick Mode (aka phase II) will fail. To fix this, set "IKE_largest_possible_subnet" via gui-dbedit from true to false. Furthermore, you can modify the file $FWDIR/lib/user.def and include every network on the checkpoint side to prevent the suppernet situation 2) make sure that you have the timeout setting match on both CP and Cisco Pix. The default timeout for CP is 86400 sec and 3600 sec for phase I and phase II, respectively. On the pix, the default timeout setting is 86400 and 28800 for phase I and phase II, respectively. To change this on the Pix, do this: crypto map xxx set security-association lifetime seconds 3600 Other than that, you site-to-site VPN should work without issues regardless, you have Nokia or SPLAT. HTH cisco4ng CCIE Security
Edouard Zorrilla <[EMAIL PROTECTED]> wrote: Hi Alan, I have done it before with a NG AI and Cisco PIX 6.3 IOS, so I guess it should work in a SPLAT like yours, Regards ----- Original Message ----- From: "Alan Choyna" To: Sent: Sunday, June 25, 2006 9:32 PM Subject: [FW-1] VPN tunnel between R55 simplified mode & Cisco Pix 515 possible? >l have been asked to investigate the potential of creating a VPN tunnel >between one of our SPLAT R55 (HFA09) firewall clusters and a Cisco Pix 515. > > The sys admin who manages the Cisco says it is not possible. Does anyone > know if it is possible? If so are there any gotcha's? Is the a standard > config l should use? > > Thanks in advance. > > Al > > > Alan C. Choyna > Director of Infrastructure > > Pathfinder Associates, LLC > > http://www.pathfinderassoc.com > Internet Strategy Business Consultants > mailto:[EMAIL PROTECTED] > Business telephone (312) 372-1058 ext 6003. Mobile (773) 255-6662 > > > ================================================= > To set vacation, Out-Of-Office, or away messages, > send an email to [EMAIL PROTECTED] > in the BODY of the email add: > set fw-1-mailinglist nomail > ================================================= > To unsubscribe from this mailing list, > please see the instructions at > http://www.checkpoint.com/services/mailing.html > ================================================= > If you have any questions on how to change your > subscription options, email > [EMAIL PROTECTED] > ================================================= > ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] ================================================= --------------------------------- How low will we go? Check out Yahoo! Messengers low PC-to-Phone call rates. ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
