topic Re: VPN issue between Cisco ASA and Checkpoint in Firewall and Security Management

VPN issue between Cisco ASA and Checkpoint

carl_t — Thu, 13 Oct 2022 08:32:24 GMT

Hi Guys

We have an issue creating a vpn between Checkpoint and Cisco ASA.

Each time we create a supernet as the domain, 172.16.0.0/12, and the user tries to connect to 172.30.1.1 for example, on the ASA we see a tunnel for 172.16.0.0 and 172.30.0.0 and the traffic never makes it.

The setting on Checkpoint vpn community is set to vpn per subnet pair.

I have checked gui dbedit and the setting ike_enable_supernet is enabled under global properties and also ike_use_largest possible subnets is also set to true.

What do we need to do to get the gateway to use the supernet? how do I check the setting is true on the gateway?

cheers

Re: VPN issue between Cisco ASA and Checkpoint

RS_Daniel — Thu, 13 Oct 2022 12:27:05 GMT

Hello,

When you say "Each time we create a supernet as the domain" do you mean adding that supernet to your local encryption domain (checkpoint)? or in the remote encryption domain (ASA)?

"and the user tries to connect to 172.30.1.1" where is the user? behind checkpoint or behind ASA?

"on the ASA we see a tunnel for 172.16.0.0 and 172.30.0.0" does ASA receive these ID's from checkpoint? or ASA send those ID's to checkpoint?

Easy answer would be sk108600 scenario 1, edit the user.def file to send your local encryption domain to the ASA peer as you need. If that is not the case more details are needed to understand your enviroment.

Regards

Re: VPN issue between Cisco ASA and Checkpoint

Abi — Thu, 13 Oct 2022 14:15:36 GMT

Which the version do you have on your Gateway ?

Re: VPN issue between Cisco ASA and Checkpoint

G_W_Albrecht — Fri, 14 Oct 2022 10:11:36 GMT

Better open a SR# with CP TAC !

Re: VPN issue between Cisco ASA and Checkpoint

carl_t — Fri, 14 Oct 2022 11:52:42 GMT

R81.10