topic Re: CheckPoint VPN with PaloAlto not working about invalid proxy id in General Topics

CheckPoint VPN with PaloAlto not working about invalid proxy id

Worapong_Janloy — Wed, 26 Sep 2018 07:09:32 GMT

Client(192.168.100.100) ----[CheckPoint](192.168.121.100)----(192.168.121.200)[PaloAlto]----Client(192.168.200.100)

On CheckPoint Side
VPN Domain : 192.168.100.0/24
Interoperable Device VPN Domain : 192.168.200.0/24
VPN Tunnel Share : already config both per subnet and per gateway but have the same result.
user.def.FW1 :
subnet_for_range_and_peer = {
<192.168.121.200, 192.168.100.1, 192.168.100.254; 255.255.255.0>
};

On PaloAlto Side
Proxy ID : Local : 192.168.200.0/24 and Remote : 192.168.100.0/24

ERROR message from Palo : description contains 'IKE phase-2 negotiation failed when processing proxy ID. cannot find matching phase-2 tunnel for received proxy ID. received local id: 192.168.121.200/32 type IPv4_address protocol 0 port 0, received remote id: 192.168.100.0/24 type IPv4_subnet protocol 0 port 0.

The Result: Client from PaloAlto side can access to client on Checkpoint side but on CheckPoint side can't access client on palo side.

Re: CheckPoint VPN with PaloAlto not working about invalid proxy id

Danny — Wed, 26 Sep 2018 07:24:32 GMT

Palo's error message shows a received local id: 192.168.121.200/32 while the configured local proxy id is 192.168.200.0/24.

Re: CheckPoint VPN with PaloAlto not working about invalid proxy id

Worapong_Janloy — Wed, 26 Sep 2018 07:57:25 GMT

The 192.168.121.200/32 is ip address of Interoperable Device (Main IP) I not sure why checkpoint propose this ip to PaloAlto.

Re: CheckPoint VPN with PaloAlto not working about invalid proxy id

Danny — Wed, 26 Sep 2018 08:40:02 GMT

Because Check Point handles the external or Main IPs of both VPN gateways as part of the VPN encryption domain. Exclude them via crypt.def or adjust your Palo configuration accordingly and you should be fine.

Re: CheckPoint VPN with PaloAlto not working about invalid proxy id

Matthias_Haas — Wed, 26 Sep 2018 13:17:39 GMT

Do they do a NAT on the PaloAlto Side before encapsulating the IP packet in the IPSec Tunnel, so the IP of the Client is actually the 192.168.121.200 ?