topic Re: Phase -2 not working in the Ipsec tunnel in SASE and Remote Access

Phase -2 not working in the Ipsec tunnel

Brianpiraty_Ale — Mon, 14 May 2018 16:28:25 GMT

We have multiple sub nets in the local encryption domain(checkpoint firewall ) . and only one subnet for the remote peer encryption domain. Remote peer is a non checkpoint device.

Once we have initiated the ping from central gateway to remote gateway , I see that Phase 1 is up.

Phase2 not. Ike .elg file shows that P1 - main mode - all 6 packets good.

P2- quick mode , the first packet itself ( QM packet 1) itself failed. is the QM packet I see that IP address of central gateway and remote peer.

when I initiate a ping from the device behind the firewall , though the IP is listed in the subnet , it is not encrypted.

what could be wrong in configuration?

Re: Phase -2 not working in the Ipsec tunnel

PhoneBoy — Mon, 14 May 2018 17:25:11 GMT

I would start by looking at the logs in SmartLog/SmartConsole and seeing if there are any errors noted.

Re: Phase -2 not working in the Ipsec tunnel

Brianpiraty_Ale — Mon, 14 May 2018 19:22:31 GMT

no errors. should I see the central gateway IP and peer gateway IP of P2- message 1 or the IPs of both side encryption domain?

Re: Phase -2 not working in the Ipsec tunnel

PhoneBoy — Mon, 14 May 2018 20:48:27 GMT

Depends on the log message in question.

You should certainly see the VPN establish itself in the logs between the two gateways.

If you're not seeing errors in SmartLog, then the traffic is probably being accepted by a rule that doesn't involve encryption.

Do you see what log the traffic from the original (unencrypted) traffic is accepted on?

Re: Phase -2 not working in the Ipsec tunnel

Brianpiraty_Ale — Tue, 15 May 2018 14:49:00 GMT

I see that it is accepted by an explicit rule. only the thing is it is not encrypted

Re: Phase -2 not working in the Ipsec tunnel

Kim_Moberg — Tue, 15 May 2018 19:38:45 GMT

Did you exclude IPSEC group under vpn community?

Re: Phase -2 not working in the Ipsec tunnel

Brianpiraty_Ale — Wed, 30 May 2018 19:55:46 GMT

yes. that was one of the issue.

Re: Phase -2 not working in the Ipsec tunnel

Houssameddine_1 — Fri, 08 Jun 2018 21:14:14 GMT

Whenever you setup vpn tunnels and you test with icmp make sure to change the global properties for icmp traffic to be accepted before last, because any traffic matches implied rules will never get encrypted.

For phase 2 negotiation issue, your best friend is sk108600 scenario 1

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk108600&partition=Advanced&product=IPsec

Thanks