No ssh access to VPN peer outside IP

[Vlad_Voronko]

While testing a site-to-site VPN tunnel between CP80.10 and Cisco ASA, I noticed that right after I had configured the IPSec peer on CP80.10, I was no longer able to ssh to 10.0.14.101 (ASA outside IP) to manage the device. Then I looked into the logs on CP and found out that CP80.10 is trying to encrypt packets destined to ASA outside IP address 10.0.14.101. I wasn't able to find any info about this issue. Is there any way how I can disable or turn off this behavior? Screenshot of the logs in the attachment. Thanks.

[Marco_Valenti]

quick way to solve it ? use excluded service and add ssh there , definition ip of the remote peer is part of the remote enc domain

[Vlad_Voronko]

Hi Marco,

I considered that option but I guess enabling it would prevent me from establishing an ssh session to the equipment residing behind the ASA (which only reachable over the VPN tunnel).

[G_W_Albrecht · Accepted solution]

I would suggest to consult sk25675 Customizing VPN Domain to exclude IP Address and allow clear text and sk108600 VPN Site-to-Site with 3rd party Scenario 3 !

[Vlad_Voronko]

Günther and Brandon,

Thanks a lot I'll take a look into this.

[Brandon_Pace]

sk108600 Scenario 3 - Implied inclusion of Check Point Security Gateway's / 3rd party VPN Peer's interfaces

[Vlad_Voronko]

Brandon,

Thanks a lot I'll take a look into this.

[Kim_Moberg]

Did you try to exclude ssh in the vpn community? And then push policy?

Of course if you need to use ssh on Remote encryption domain, that might be a challange.