Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted

SMB host based (dynamic) IKEv2 S2S - Global Identifier bug

Dear Abby,

In trouble shooting a hostname to hostname site to site vpn on a self manged 730, I found a typical strange checkpoint vpn issue. If the remote starts the connection the tunnel comes up fine. If the local 730 start the tunnel we get phase II failure. I checked and double checked the networks via ikeview (geez when can i stop using this?) and compared working to not working. What I found was the checkpoint would accept its name as listed in the global identified of the s2s config, but when the checkpoint initiates the tunnel it would advertise its name as its external IP address. I tried the override global identifier option with the correct name as well. Made no difference. Firewall is still ignoring this setting at sticking the external IP address as the identifier.

 

 I don't have a support contract on this firewall but we have 3 CP1550s on the way so we'll check it out again then.

 

BTW this is a 730 running - R77.20.86 - Build 855

0 Kudos
1 Reply
Highlighted
Admin
Admin

This is most likely a bug that TAC would have to investigate.
Maybe updating to the latest firmware version would help also?
0 Kudos