We are using the second method with specific proxy ID's (we also have One tunnel per gateway pair set).
Per-community VPN domains would be ideal rather than the way CheckPoint does one global section for VPN domains but it seems to be fine and we can see the PaloAlto proxy-id subnets match and the tunnel comes up:
Tunnel negotiation Log from PaloAlto (no logs available from Checkpoint as no Monitoring blade licence):
IKE phase-1 negotiation is started as initiator, main mode. Initiated SA: <public IP of peer PA>-<public IP of local CP> cookie:XXXXXXXXXXXXX:0000000000000000.
IKE phase-1 negotiation is succeeded as initiator, main mode. Established SA: <public IP of peer PA>-<public IP of local CP> cookie:XXXXXXXXXXXXXXXXXXX lifetime 86400 Sec.
IKE phase-2 negotiation is succeeded as initiator, quick mode. Established SA: <public IP of peer PA>-<public IP of local CP> message id:0xXXXXXXXX, SPI:0xXXXXXXXXXXXX.' )
IPSec key installed. Installed SA: <public IP of peer PA>-<public IP of local CP> SPI:0xXXXXXXXXXXXXXX lifetime 3600 Sec lifesize unlimited.
CheckPoint "vpn tu" option 2 also shows tunnel up:
Peer <public IP of peer PA> , VPN-TO-PALOALTO SAs:
IKE SA <XXXXXXXXXXXXXXXXXXXXXX>
1. 0xXXXXXX (i: 1)
1. 0xXXXXXX (i: 1)
Looks good and the tunnel is up according to both PaloAlto and CP
Send a ping down it from the peer side 192.168.0.1 to our local network 10.0.0.1 gives this log in the PaloAlto:
Source 192.168.0.1 Dest 10.0.0.1 Interface: Tunnel.10 Bytes Sent: 74; packets 1; Action: Allow; Session Ended, Reason: Aged-out
-PaloAlto is sending it but not getting a reply.
CheckPoint fw monitor shows:
[vs_0][fw_0] eth0:O: 192.168.0.1 -> 10.0.0.1 (ICMP) len=60 id=31312
ICMP: type=8 code=0 echo request id=1 seq=19550
[vs_0][fw_0] eth0:i: 10.0.0.1 -> 192.168.0.1 (ICMP) len=60 id=8733
ICMP: type=0 code=0 echo reply id=1 seq=19550
-We can see the peer packet coming in and the local packet replying. But the reply is not getting back to the PaloAlto
and the CheckPoint fw.log shows:
Blade: VPN; Action: Decrypt; Source: 192.168.0.1; Dest: 10.0.0.1; Service: echo-request; Description: Decrypted in community VPN-TO-PALOALTO
-fw.log also shows the the peer packet coming in and decrypting.
Next try ping the other direction from our local to the peer:
-Nothing showing up.
CheckPoint fw monitor:
[vs_0][fw_0] eth8:O: 10.0.0.1 -> 192.168.0.1 (ICMP) len=60 id=9077
ICMP: type=8 code=0 echo request id=1 seq=62856
-That's it, no echo reply coming back from 192.168.0.1.
Blade: VPN; Action: Encrypt; Source: 10.0.0.1; Dest: 192.168.0.1; Service: echo-request; Description: Encrypted in community VPN-TO-PALOALTO
-Checkpoint is sending the packet to the tunnel but PaloAlto not receiving it.
Tunnel is up and the PaloAlto peer is sending packets across fine. The local CP is sending across but PaloAlto not receiving.