VPN between SonicWall and NG AI

[chrisc]

Hi

I'm having problems configuring a site to site VPN working between a Checkpoint (NG AI 54, running on SPLAT) and a SonicWall (SonicOS Standard 3.1.0.2-62s) firewall. The Checkpoint is configured for traditional mode VPN.

The closest that I can get gives me an error "IKE: Main Mode No matching encryption methods between myself and the peer". What exactly does this mean?

Is there a way to debug IKE, something like the Cisco IOS command 'debug crypto isakmp'? I've tried a tcpdump -vv filtering on the remote gateway, but it doesn't show me anything useful.

Thanks in advance for your help.
Chris

[maurox]

Try with this:
http://www.vpn-technology.com/Intero...eckPointNG.pdf
Maurox

[Peter]

The command to begin IKE debug is 'vpn debug ikeon'. To stop debugging use 'vpn debug ikeoff'. Log file is ike.elg. To see it you need ikeview.exe (works under Windows).

In your case probably you have the problem of IKE Phase 1 negotiations. Check SA TTL and GH Group.

[jonas]

Where you able to build a tunnel with the SonicWall??

I'm undertaking the same thing - I'm seeing in tracker:

IKE: Main Mode Sent Notification: Responder Lifetime
IKE: Main Mode Received Notification from Peer: Initial Contact
IKE: Main Mode completion.
IKE: Phase1 Received Notification from Peer: invalid cookie
IKE: Quick Mode Received Notification from Peer: invalid id information

The peer (SonicWall) is seeing "invalid cookie"

What I'm going to try next is copy the document that maurox recommends.(
http://www.vpn-technology.com/Inter...heckPointNG.pdf)

Any other recommendations will be appreciated!



Thanks
ADV

[philofish]

Its definitley Phase 1 of IPSEC that isn't correctly setup

Make sure that all SA's are configured correctly

[Lackie]

Make sure that you are not Natting when going through the tunnel. If you are using communities, you can do this with the checkbox Disable nat within the community or if you are using traditonal mode then you can put in a 'no-nat' rule at the top of your address translation page.

[jonas]

Philofish / Lackie

Thank you for the response!

I’m using a Star Community, I tried the Traditional mode and I was getting nothing, seems like using Simplified I get something.

Anyway, I’m setting IKE (Phase 1) to renegotiate IKE security associations every 30 minutes. - Do you have any suggestions?

I Disable NAT inside the VPN community and I have no Address Translation going on with this gateway.


Getting back to the Phase 1 issue – I did start playing with the renegotiate time, but nothing!

At this point, I look like my 2 year old in front of a keyboard.


Thanks,
ADV

[2Legit]

Where can I get IKEView.exe to view ike.elg files?

[chillyjim]

Originally Posted by 2Legit

Where can I get IKEView.exe to view ike.elg files?

From TAC or your Check Point SE. It is a tool that is normaly restricted to CSP's for reasons I've never understood.