What version of PIX software are you using? If it's anything below 6.0.x
it won't support D/H group 2.
Jeffrey Shuron
Security Specialist- CCSA, GSEC, CCNA
MPR Technologies
315-345-3015
[EMAIL PROTECTED]
www.mprtech.com
|--------+---------------------------------------------->
| | Juan Concepcion |
| | <[EMAIL PROTECTED]> |
| | Sent by: Mailing list for discussion|
| | of Firewall-1 |
| | <[EMAIL PROTECTED]|
| | point.com> |
| | |
| | |
| | 12/10/2001 09:55 PM |
| | Please respond to Mailing list for |
| | discussion of Firewall-1 |
| | |
|--------+---------------------------------------------->
>------------------------------------------------------------------------------------------------------------------------|
|
|
| To: [EMAIL PROTECTED]
|
| cc:
|
| Subject: Re: [FW-1] Error by openig ipsec-tunnel between Checkpoint
VPN-1 and PIX |
>------------------------------------------------------------------------------------------------------------------------|
Disable the aggressive mode, I don't believe that the pix supports this
mode if I remember correctly. Also the error method indicates that the
shared secret between the pix and the firewall are not the same.
On Mon, 10 Dec 2001 14:45:47 +0100, Novak Martin
<[EMAIL PROTECTED]> wrote:
>Hello group,
>
>I have a problem by opening a ipsec-tunnel between a Check Point VPN-1
>firewall (our FW) and a Pix (other FW).
>By installing the tunnel I used the Check Point white paper "Check
Point
>VPN-1 and Cisco Pix Gateway to Gateway IKE VPN using Pre-Shared
Secrets"
>written by David Dietrich.
>But the tunnel only works in one direction (from PIX to VPN-1), in the
other
>direction there comes the following error message:
>"IKE Log: Sent Notification: authentication failed <phase1 stage2>
>Negotiation ID: c489b749c20f14c3-ba2454500058e774"
>
>VPN-1 settings:
> Object FW-VPN1
> ., Domain: other: Encrypt-Domain
> ., Encryption schemes defined: IKE
> ., Turn on Traffic Control Logging
> IKE Properties
> ., Support key exchange encryption with: DES
> ., Support data integrity with: SHA1
> ., Support authentication methods: Pre-Shared Secret
(vpn =
>abc)
> ., Supports Agressive Mode
> Support keys exchange for Subnets
>
> Object FW-PIX
> ., Domain: other: Encrypt-Domain
> ., Encryption schemes defined: IKE
> ., Turn on Traffic Control Logging
> IKE Properties
> ., Support key exchange encryption with: DES
> ., Support data integrity with: SHA1
> ., Support authentication methods: Pre-Shared Secret
(vpn =
>abc)
> ., Supports Agressive Mode
> Support keys exchange for Subnets
>
> general settings
> Policy/Properties/Encryption:
> ., Enable Exportable Skip
> ., Change SKIP Session Key every 120 seconds or every 10485760
Bytes
>
> ., Manual IPSEC: SPI allocation range from h100 to hffff
>
> ., IKE: Renegotiate IKE Security Associations every 1440
minutes
>
> ., IKE: Renegotiate IPSEC Security Assotiations every 1800
seconds
>
>
> encryption settings
> ., IKE
> ., Transform: Encryption + Data Integrity (ESP)
> ., Encryption Algorithm: DES
> ., Data Integrity Algorithm: SHA1
> ., Allowed Peer Gateway: Any
>
>PIX settings:
> .,crypto ipsec transform-set earne esp-des esp-sha-hmac
> .,crypto map cmap 10 ipsec-isakmp
> .,crypto map cmap 10 match address uta-billbyclick
> .,crypto map cmap 10 set peer 145.20.254.210
> .,crypto map cmap 10 set transform-set earne
> .,crypto map cmap interface outside
> .,isakmp enable outside
> .,isakmp key *** address 145.20.254.210 netmask
255.255.255.255
> .,isakmp identity address
> .,isakmp policy 10 authentication pre-share
> .,isakmp policy 10 encryption des
> .,isakmp policy 10 hash sha
> .,isakmp policy 10 group 2
> .,isakmp policy 10 lifetime 86400
>
>Thank you for your contribution.
>
>Martin
>
>
>
>
>
>=================================================
>To unsubscribe from this mailing list,
>please see the instructions at
>http://www.checkpoint.com/services/mailing.html
>=================================================
>To set vacation, Out Of Office, or away messages,
>send an email to [EMAIL PROTECTED]
>in the BODY of the email add:
>set fw-1-mailinglist nomail
>=================================================
>If you have any questions on how to change your
>subscription options, email Ron Alcatraz at:
>[EMAIL PROTECTED]
>=================================================
>
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
To set vacation, Out Of Office, or away messages,
send an email to [EMAIL PROTECTED]
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
If you have any questions on how to change your
subscription options, email Ron Alcatraz at:
[EMAIL PROTECTED]
=================================================
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
To set vacation, Out Of Office, or away messages,
send an email to [EMAIL PROTECTED]
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
If you have any questions on how to change your
subscription options, email Ron Alcatraz at:
[EMAIL PROTECTED]
=================================================
