I'm testing and trying to create workable topology, when my Checkpoint 1530 firewall stands in front of the network with NAT WAN and behind it's the Cisco 800 which I need to do some a VLANs work, access-lists for the internal network etc. Also I do prefer to create a Site-to-Site VPN on it, because the Checkpoint 1530 doesn't have strong encryption methods, like only a DES method for IKE1 and IKE2.
So I configured the Main office and the Branch office Cisco on site-to-site ipsec (Screen). When I'm trying to ping the PC from Main Office to Branch (through Checkpoint) I have no problem: the tunnel opens and establish, packets reseived by Branch PCs. Logs showed me, that NAT-T on 1530 worked with no problemat this point.
But if I stop the ping proccess from the Main Office or when I try to ping PC from the Branch Office to the Main, the tunnel don't open, because Checkpoint catch packets with IKE proporsal, think, that Cisco from Branch Office trying to establish the tunnel with it. You can see it on my screenshoot named "Log".
So any ideas how can I skip an incoming VPN traffic through Checkpoint without it's accommodation?