RE: [fw-wiz] Checkpoint VPN

From: David West (davidawest_at_gmail.com)
Date: 07/20/05

  • Next message: QTR: "Re: [fw-wiz] Checkpoint VPN" 
    To: tmwhitm@gmail.com
Date: Wed, 20 Jul 2005 15:39:17 +1000

    Sounds like your ike/udp is fragmenting somewhere between the client
    and your firewall. This almost always occurs with x.509 certificate
    authentication as the cert is too big for a standard Ethernet frame
    and dropeed by many cable/dsl routers. Try using ike/tcp. On your
    gateway(s) enable support IKE over TCP in global properties and by
    enable the following on in SecureClient for your sites profile:

    + Connectivity enhancements
    + Use NAT traversal tunneling
      - IKE over TCP
      - Force UDP encapsulation

    David

    -----Original Message-----
    From: QTR [mailto:tmwhitm@gmail.com]
    Sent: Wednesday, 13 July 2005 12:09 AM
    To: firewall-wizards@honor.icsalabs.com
    Subject: [fw-wiz] Checkpoint VPN

    Hello, I was wondering if someone could point me in the right
    direction. I have come off a long run of managing Cyberguard
    firewalls and am now in the Checkpoint realm, so forgive my ignorance.
     I am having an issue with secure client. I have several SoHo users
    whose default routers place them on a 172.16.0.0 network. These users
    cannot connect to the gateway. Dumps on the checkpoint fw gateway
    show no incoming packets and a dump on the client show udp 500 leaving
    the client, which leads me to the router/firewall @ the SoHo. Router
    makes vary, anywhere from 2wire to netgear, the result is the same. I
    initially thought it had something to do with the routing topology
    since our topology pushes a static route for a 172 network, but I had
    the SoHo router changed to a 10 network that is statically routed in
    the topology and that worked fine. At this point I am at a loss. Any
    suggestions would be appreciated.

    Thank you,
    _______________________________________________
    firewall-wizards mailing list
    firewall-wizards@honor.icsalabs.com
    http://honor.icsalabs.com/mailman/listinfo/firewall-wizards
    _______________________________________________
    firewall-wizards mailing list
    firewall-wizards@honor.icsalabs.com
    http://honor.icsalabs.com/mailman/listinfo/firewall-wizards

  • Next message: QTR: "Re: [fw-wiz] Checkpoint VPN"

    Relevant Pages

    • Re: Branch Office MVBASE network access
      ... We use Watchguard routers for VPN between sites, ... Accuterm or the bundled thin client ...
      (comp.databases.pick)
    • Re: How to show messagebox in other computer in a network?
      ... If you mean the TCP/IP send function, ... A "maislot client" opens a file called ... and it is designated as a "mailslot server" (your servers are clients and your clients are ... across routers and especially if the routers are going out to the general internet, ...
      (microsoft.public.vc.mfc)
    • Re: Unable to make VPN connection to ISA 2006 Standard
      ... routers in question are blocking this. ... This weekend I am going to remove ISA and see if I can make a PPTP ... What I'm really trying to do here is a site to site VPN. ... Thanks for your pointer about the AUtomatic client setting trying LT2P - I ...
      (microsoft.public.isa.vpn)
    • Re: Unable to make VPN connection to ISA 2006 Standard
      ... routers in question are blocking this. ... This weekend I am going to remove ISA and see if I can make a PPTP ... What I'm really trying to do here is a site to site VPN. ... Thanks for your pointer about the AUtomatic client setting trying LT2P - I ...
      (microsoft.public.isa.vpn)
    • Re: VPNs with DHCP endpoints? OT?
      ... The VPN routers I've tinkered with do NOT require a numeric IP address ... This is using their client. ... account is about to expire and then they turn it off. ... Apparently if the updates are no sufficiently often, ...
      (alt.internet.wireless)