Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 3 replies
  • Subscribers 1 subscriber
  • Views 1660 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

AStaro v9 > Checkpoint R77 one way firewall issue.

ShatterPoint
I am unable to get bidirectional traffic between an Astaro UTM v9 and a Checkpoint Firewall v R77.  The Traffic from the Astaro network is fine but the traffic to the Astaro network will not encryppt.  I am getting proper hase1 and phase2 negotiation.  Below is the log entries from the astaro for starting the vpn as well as for the traffic from Astaro side to Checkpoint side.

Astaro external ip is yy.yyyy.yyy.yyy
CheckPoint external ip is xx.***.***.***

2013:12:05-17:24:17 sigodsas-1 pluto[6835]: listening for IKE messages
2013:12:05-17:24:17 sigodsas-1 pluto[6835]: forgetting secrets
2013:12:05-17:24:17 sigodsas-1 pluto[6835]: loading secrets from "/etc/ipsec.secrets"
2013:12:05-17:24:17 sigodsas-1 pluto[6835]: loaded PSK secret for yy.yyy.yyy.yyy xx.***.***.***
2013:12:05-17:24:17 sigodsas-1 pluto[6835]: loaded private key from 'Local X509 Cert.pem'
2013:12:05-17:24:17 sigodsas-1 pluto[6835]: forgetting secrets
2013:12:05-17:24:17 sigodsas-1 pluto[6835]: loading secrets from "/etc/ipsec.secrets"
2013:12:05-17:24:17 sigodsas-1 pluto[6835]: loaded PSK secret for yy.yyy.yyy.yyy xx.***.***.***
2013:12:05-17:24:17 sigodsas-1 pluto[6835]: loaded private key from 'Local X509 Cert.pem'
2013:12:05-17:24:17 sigodsas-1 pluto[6835]: loading ca certificates from '/etc/ipsec.d/cacerts'
2013:12:05-17:24:17 sigodsas-1 pluto[6835]: loaded ca certificate from '/etc/ipsec.d/cacerts/VPN Signing CA.pem'
2013:12:05-17:24:17 sigodsas-1 pluto[6835]: loading aa certificates from '/etc/ipsec.d/aacerts'
2013:12:05-17:24:17 sigodsas-1 pluto[6835]: loading ocsp certificates from '/etc/ipsec.d/ocspcerts'
2013:12:05-17:24:17 sigodsas-1 pluto[6835]: loading attribute certificates from '/etc/ipsec.d/acerts'
2013:12:05-17:24:17 sigodsas-1 pluto[6835]: Changing to directory '/etc/ipsec.d/crls'
2013:12:05-17:24:17 sigodsas-1 pluto[6835]: added connection description "S_SecNoc_VPN"
2013:12:05-17:24:17 sigodsas-1 pluto[6835]: "S_SecNoc_VPN" #323: initiating Main Mode
2013:12:05-17:24:17 sigodsas-1 pluto[6835]: added connection description "S_SecNoc_VPN"
2013:12:05-17:24:17 sigodsas-1 pluto[6835]: added connection description "S_SecNoc_VPN"
2013:12:05-17:24:17 sigodsas-1 pluto[6835]: added connection description "S_SecNoc_VPN"
2013:12:05-17:24:18 sigodsas-1 pluto[6835]: "S_SecNoc_VPN" #323: Peer ID is ID_IPV4_ADDR: 'xx.***.***.***'
2013:12:05-17:24:18 sigodsas-1 pluto[6835]: "S_SecNoc_VPN" #323: ISAKMP SA established
2013:12:05-17:24:18 sigodsas-1 pluto[6835]: "S_SecNoc_VPN" #324: initiating Quick Mode PSK+ENCRYPT+TUNNEL+UP {using isakmp#323}
2013:12:05-17:24:18 sigodsas-1 pluto[6835]: "S_SecNoc_VPN" #325: initiating Quick Mode PSK+ENCRYPT+TUNNEL+UP {using isakmp#323}
2013:12:05-17:24:18 sigodsas-1 pluto[6835]: "S_SecNoc_VPN" #326: initiating Quick Mode PSK+ENCRYPT+TUNNEL+UP {using isakmp#323}
2013:12:05-17:24:18 sigodsas-1 pluto[6835]: "S_SecNoc_VPN" #327: initiating Quick Mode PSK+ENCRYPT+TUNNEL+UP {using isakmp#323}
2013:12:05-17:24:18 sigodsas-1 pluto[6835]: "S_SecNoc_VPN" #323: discarding duplicate packet; already STATE_MAIN_I4
2013:12:05-17:24:18 sigodsas-1 pluto[6835]: id="2203" severity="info" sys="SecureNet" sub="vpn" event="Site-to-site VPN up" variant="ipsec" connection="SecNoc_VPN" address="yy.yyy.yyy.yyy" local_net="172.16.1.0/24" remote_net="172.31.254.0/24"
2013:12:05-17:24:18 sigodsas-1 pluto[6835]: "S_SecNoc_VPN" #324: sent QI2, IPsec SA established {ESP=>0xdab92480 0x06c98a3d 0xf4939b19 0x8a114817 


This thread was automatically locked due to age.
  • 0
    I also have a log filling with the same message "Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0xf931e6d1 (perhaps this is a duplicated packet)" The tunnel seems to be working but I am interested to know what may be causing this message.
  • 0
    I see this message:
    2013:12:05-17:24:40 sigodsas-1 pluto[6835]: "S_SecNoc_VPN" #323: cannot respond to IPsec SA request because no connection is known for 0.0.0.0/0===yy.yyy.yyy.yyy[yy.yyy.yyy.yyy]...xx.***.***.***[xx.***.***.***]===172.31.254.0/24

    and a 0.0.0.0/0 network.
    I believe that's your problem. Maybe you haven't used the same VPN-ID type on both sites of the connection or one of the sites isn't translating it's public IP-address incorrectly.
    You could try to manually enter the public IP-address and see if that changes anything.

    What's also strange is that I only see this listed once in your log, you have configured 4 SA's, How many of these 4 are actually up (if any)?

    Managing several Sophos UTMs and Sophos XGs both at work and at some home locations, dedicated to continuously improve IT-security and feeling well helping others with their IT-security challenges.

    Sometimes I post some useful tips on my blog, see blog.pijnappels.eu/category/sophos/ for Sophos related posts.

  • 0
    Also, make sure the Checkpoint is configured with 172.16.3.0/22172.31.254.0/24 instead of  172.16.3.0/22.0.0.0.0/0.

    Cheers - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Share Feedback
×

Submitted a Tech Support Case lately from the Support Portal?

Unfiltered HTML