topic Checkpoint to ASA VPN traffic selection issue in Firewall and Security Management

Checkpoint to ASA VPN traffic selection issue

rob99-99 — Mon, 14 Mar 2022 23:39:40 GMT

Hi all,

Have a 5800 R80.40 to a ASA 9.6 VPN trying to get up.

Scenario is,
ASA LAN server A to Checkpoint LAN server B
On the checkpoint, ASA LAN server A source is being translated to server C IP. server B gets no nat/original.
Since this is transparent to the ASA, on the ASA the no nat rule says server A and B get no nat.

When initiating traffic on the Cisco side, the ASA debugs makes it seem Phase 1 is ok as far as the crypto and PSK.
On the Cisco debug shows that the correct DH group has been negotiated, NAT-T is in use 4500, PSK has been sent and ESP encapsulation is going on,
Then the ASA sends the traffic selector for the correct source ( server A ) to destination ( server B ) and resends a few times and times out.

On the Checkpoint side, it shows as UP Phase 1, but shows this error.

IKEv2 [NAT-T (IPv4)
auth exchange: sending notification to peer: traffic selectors unacceptable
MyTSi MyTSr:
<has the public IP of the ASA>
<224.0.0.0 - 224.0.0.255>
Peer TSi:
Peer TSr:
<server B IP address>
Do not why the Checkpoint is picking the " public outside " interface IP of the ASA firewall.
Does anyone have any ideas?

Re: Checkpoint to ASA VPN traffic selection issue

G_W_Albrecht — Tue, 15 Mar 2022 08:35:34 GMT

See sk108600: VPN Site-to-Site with 3rd party and sk157473: Site to Site using IKEv2 fails with "None of the traffic selectors match the conection"

Re: Checkpoint to ASA VPN traffic selection issue

rob99-99 — Tue, 15 Mar 2022 17:47:55 GMT

Thanks for the links. I had read them before, but didn't see anything exact to my scenario, but will try a few of the things in them.

I had read an article a while that mentioned the traffic selection on the Checkpoint side, being the ASA firewalls interface rather than the IP of the server in the VPN domain, but cannot find that article again.

On the ASA side, I see the traffic selector correct, Server A IP permit any to server B IP.
But on the checkpoint this error, where instead of IP of server A, it is the IP of the ASA interface and 224.0.0.0-224.0.0.255
What does 224.0.0.0-224.0.0.255 mean ?

Re: Checkpoint to ASA VPN traffic selection issue

ClauberTeles — Thu, 15 Dec 2022 20:09:18 GMT

Hey, G_W_Albrecht, thank you, it helped me.

I've just changed the Tunnel Mode of the VPN Community from"One Tunnel Per Subnet Pair" to "One Tunnel Per Gateway Pair" and all worked, thank you again for posting the sk157473

Best.

Re: Checkpoint to ASA VPN traffic selection issue

Greifenstein — Mon, 19 Aug 2024 09:22:01 GMT

Thanks!

That helped me configuring a site-to-site VPN with a Fortigate on the peer side with the same errors in the log!

Christian