fw1/vpn1 v4.1.2 SP3 site2site with netscreen

[nissim]

Hello all ,

I am trying to make a site to site vpn between old CHKP v4.1 2000 SP3
and a netscreen box with no luck .

I am getting phase1 completion , but no phase2 .
when I am getting phase2 it uses a weird subnet 0.0.0.0 for encryption .

I know there are some issues with setting up a vpn between these two ,
but I hope some of you will be able to help .

local gatway:
phase1 : IKE 3des-md5 support-subnets
phase2: IKE des-md5-pfs

remote gateway:
phase1: IKE 3des-md5 support-sunbet
phase2: IKE des-md5-fps


rule base :

local_encrypt_domain remote_encrypt_domain any encrypt
remote_enrypt_domain local_enrypt_domain any encrypt


nat rules :
local_enrypt_domain remote_encrypt_domain any nat_network orig
remote_encrypt_domain nat_network any orig local_encrypt_domain orig


I am using a src nat ontop of the vpn and it worked under v4.1 & ng setup
so why do I have a problem with the netscreen .

looks like I have a phase 1 completed successfully and phase 2 as well
but using a 0.0.0.0 & my local network , that looks strange .

did anyone setup that kind of vpn and can assist ?

[chillyjim]

This has to do with the way Check Point calculates it's encryption domain for subnet negotiation verses the way netscreen does it. Upgrade to at least R55. R60 will save you more headaches.

[nissim]

Hi ,

I solved the vpn problem and I have encrypted/decypted traffic between two sites
but still no icmp !!!

I solved my problem by adding the natted_local_area_network to my enryption
domain in addition to the local_area_network since I nat all my vpn traffic .

The only problem I have now against the netscreen is the icmp that doesn't work
, the netscreen recognize my local ip as my orginal ip instead of my natted ip which
is wrong .

I would like to mention that all other protocols traffic is natted and the vpn is workign and I have a bidirectional access .


any ideas accept for upgrade since I don't have checkpoint support available nor
software updates at the moment .