Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted

CheckPoint VPN with PaloAlto not working about invalid proxy id

Client(192.168.100.100) ----[CheckPoint](192.168.121.100)----(192.168.121.200)[PaloAlto]----Client(192.168.200.100)

On CheckPoint Side
VPN Domain : 192.168.100.0/24
Interoperable Device VPN Domain : 192.168.200.0/24
VPN Tunnel Share : already config both per subnet and per gateway but have the same result.
user.def.FW1 :
subnet_for_range_and_peer = {
<192.168.121.200, 192.168.100.1, 192.168.100.254; 255.255.255.0>
};

On PaloAlto Side
Proxy ID : Local : 192.168.200.0/24 and Remote : 192.168.100.0/24

ERROR message from Palo : description contains 'IKE phase-2 negotiation failed when processing proxy ID. cannot find matching phase-2 tunnel for received proxy ID. received local id: 192.168.121.200/32 type IPv4_address protocol 0 port 0, received remote id: 192.168.100.0/24 type IPv4_subnet protocol 0 port 0.

The Result: Client from PaloAlto side can access to client on Checkpoint side but on CheckPoint side can't access client on palo side.

4 Replies
Highlighted
Pearl

Palo's error message shows a received local id: 192.168.121.200/32 while the configured local proxy id is 192.168.200.0/24.

0 Kudos
Highlighted

The 192.168.121.200/32 is ip address of Interoperable Device (Main IP) I not sure why checkpoint propose this ip to PaloAlto.

0 Kudos
Highlighted
Pearl

Because Check Point handles the external or Main IPs of both VPN gateways as part of the VPN encryption domain. Exclude them via crypt.def or adjust your Palo configuration accordingly and you should be fine.

0 Kudos
Highlighted

Do they do a NAT on the PaloAlto Side before encapsulating the IP packet in the IPSec Tunnel, so the IP of the Client is actually the 192.168.121.200 ?

0 Kudos