cancel
Showing results for 
Search instead for 
Did you mean: 
Post a Question

CheckPoint VPN with PaloAlto not working about invalid proxy id

Client(192.168.100.100) ----[CheckPoint](192.168.121.100)----(192.168.121.200)[PaloAlto]----Client(192.168.200.100)

On CheckPoint Side
VPN Domain : 192.168.100.0/24
Interoperable Device VPN Domain : 192.168.200.0/24
VPN Tunnel Share : already config both per subnet and per gateway but have the same result.
user.def.FW1 :
subnet_for_range_and_peer = {
<192.168.121.200, 192.168.100.1, 192.168.100.254; 255.255.255.0>
};

On PaloAlto Side
Proxy ID : Local : 192.168.200.0/24 and Remote : 192.168.100.0/24

ERROR message from Palo : description contains 'IKE phase-2 negotiation failed when processing proxy ID. cannot find matching phase-2 tunnel for received proxy ID. received local id: 192.168.121.200/32 type IPv4_address protocol 0 port 0, received remote id: 192.168.100.0/24 type IPv4_subnet protocol 0 port 0.

The Result: Client from PaloAlto side can access to client on Checkpoint side but on CheckPoint side can't access client on palo side.

4 Replies
Danny
Pearl

Re: CheckPoint VPN with PaloAlto not working about invalid proxy id

Palo's error message shows a received local id: 192.168.121.200/32 while the configured local proxy id is 192.168.200.0/24.

0 Kudos
Highlighted

Re: CheckPoint VPN with PaloAlto not working about invalid proxy id

The 192.168.121.200/32 is ip address of Interoperable Device (Main IP) I not sure why checkpoint propose this ip to PaloAlto.

0 Kudos
Danny
Pearl

Re: CheckPoint VPN with PaloAlto not working about invalid proxy id

Because Check Point handles the external or Main IPs of both VPN gateways as part of the VPN encryption domain. Exclude them via crypt.def or adjust your Palo configuration accordingly and you should be fine.

0 Kudos

Re: CheckPoint VPN with PaloAlto not working about invalid proxy id

Do they do a NAT on the PaloAlto Side before encapsulating the IP packet in the IPSec Tunnel, so the IP of the Client is actually the 192.168.121.200 ?

0 Kudos