topic Encryption domain mismatch even though its set it up correctly in General Topics

Encryption domain mismatch even though its set it up correctly

Blason_R — Mon, 22 Apr 2019 14:46:28 GMT

Hi Guys,

I have tunnel set it up between R80.20 and PAN, Phase 1 is up and is mismatching encryption domains. For CP its 10.1.3.0/24 while at remote end is 10.1.6.0/24.

When I done the debug found that CP is sending it as 10.1.6.128/25 and that is the reason my tunnel is not coming up.

What could be the issue?

Re: Encryption domain mismatch even though its set it up correctly

Jean_Rosario — Mon, 22 Apr 2019 15:12:52 GMT

Hi,

Do you have your VPN Domain set up as based on Topology or a manually defined group?

Re: Encryption domain mismatch even though its set it up correctly

PhoneBoy — Mon, 22 Apr 2019 15:39:31 GMT

Most likely scenario #1 here: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk108600

Re: Encryption domain mismatch even though its set it up correctly

Blason_R — Mon, 22 Apr 2019 16:01:33 GMT

nah, tried that already but didnt work.

Re: Encryption domain mismatch even though its set it up correctly

PhoneBoy — Mon, 22 Apr 2019 16:30:35 GMT

Clearly this points to a configuration error on one side or another.
How exactly do you have the encryption domain for the remote site defined
By that I mean, the specific objects that make it up?
What changes have you made to crypt.def and/or ike_use_largest_possible_subnets to support this?

Re: Encryption domain mismatch even though its set it up correctly

Timothy_Hall — Wed, 24 Apr 2019 02:00:07 GMT

PAN firewalls use route-based VPNs by default, and will propose/expect 0.0.0.0/0's in Phase 2 unless manual Proxy-IDs are configured on the PAN side to mimic a domain-based VPN. Has that been done on the PAN?

Re: Encryption domain mismatch even though its set it up correctly

Blason_R — Wed, 24 Apr 2019 03:46:48 GMT

Let me see if that was the issue. Well, the funny thing is; the tunnel was working fine when the appliances were on R77.30 and it broke as soon as those are upgraded to R80.20.

Re: Encryption domain mismatch even though its set it up correctly

Blason_R — Wed, 24 Apr 2019 08:08:09 GMT

Yep, that was the issue "ike_use_largest_possible_subnets" disabled it and from dbedit and it worked perfectly fine.

Thanks for the help.