VPN IKE NAT Traversal Problems

[#1]

Hello!

I'm testing and trying to create workable topology, when my Checkpoint 1530 firewall stands in front of the network with NAT WAN and behind it's the Cisco 800 which I need to do some a VLANs work, access-lists for the internal network etc. Also I do prefer to create a Site-to-Site VPN on it, because the Checkpoint 1530 doesn't have strong encryption methods, like only a DES method for IKE1 and IKE2.

So I configured the Main office and the Branch office Cisco on site-to-site ipsec (Screen). When I'm trying to ping the PC from Main Office to Branch (through Checkpoint) I have no problem: the tunnel opens and establish, packets reseived by Branch PCs. Logs showed me, that NAT-T on 1530 worked with no problemat this point.  

But if I stop the ping proccess from the Main Office or when I try to ping PC from the Branch Office to the Main, the tunnel don't open, because Checkpoint catch packets with IKE proporsal, think, that Cisco from Branch Office trying to establish the tunnel with it. You can see it on my screenshoot named "Log". 

So any ideas how can I skip an incoming VPN traffic through Checkpoint without it's accommodation?

[#2]

Hello!

I'm testing and trying to create workable topology, when my Checkpoint 1530 firewall stands in front of the network with NAT WAN and behind it's the Cisco 800 which I need to do some a VLANs work, access-lists for the internal network etc. Also I do prefer to create a Site-to-Site VPN on it, because the Checkpoint 1530 doesn't have strong encryption methods, like only a DES method for IKE1 and IKE2.

So I configured the Main office and the Branch office Cisco on site-to-site ipsec (Screen). When I'm trying to ping the PC from Main Office to Branch (through Checkpoint) I have no problem: the tunnel opens and establish, packets reseived by Branch PCs. Logs showed me, that NAT-T on 1530 worked with no problemat this point.  

But if I stop the ping proccess from the Main Office or when I try to ping PC from the Branch Office to the Main, the tunnel don't open, because Checkpoint catch packets with IKE proporsal, think, that Cisco from Branch Office trying to establish the tunnel with it. You can see it on my screenshoot named "Log". 

So any ideas how can I skip an incoming VPN traffic through Checkpoint without it's accommodation?

[#3]

Hello!

I'm testing and trying to create workable topology, when my Checkpoint 1530 firewall stands in front of the network with NAT WAN and behind it's the Cisco 800 which I need to do some a VLANs work, access-lists for the internal network etc. Also I do prefer to create a Site-to-Site VPN on it, because the Checkpoint 1530 doesn't have strong encryption methods, like only a DES method for IKE1 and IKE2.

So I configured the Main office and the Branch office Cisco on site-to-site ipsec (Screen). When I'm trying to ping the PC from Main Office to Branch (through Checkpoint) I have no problem: the tunnel opens and establish, packets reseived by Branch PCs. Logs showed me, that NAT-T on 1530 worked with no problemat this point.  

But if I stop the ping proccess from the Main Office or when I try to ping PC from the Branch Office to the Main, the tunnel don't open, because Checkpoint catch packets with IKE proporsal, think, that Cisco from Branch Office trying to establish the tunnel with it. You can see it on my screenshoot named "Log". 

So any ideas how can I skip an incoming VPN traffic through Checkpoint without it's accommodation?

[Somethig_Di]

It's a R80.20.01 and yes, it's Russia, but we doesn't have a problem with a DH group 2 or 5 in Cisco, for example. But Checkpoint give me only a group 1.

 

Also, if you ask me why I can't upgrade it - just because after upgrate I have several errors, with whom the support works, so thats why I need the working scheme with Cisco behind.

[Somethig_Di]

It's a R80.20.01 and yes, it's Russia, but we doesn't have a problem with a DH group 2 or 5 in Cisco, for example. But Checkpoint give me only a group 1.

 

Also, if you ask me why I can't upgrade it - just because after upgrate I have several errors, with whom the support works, so thats why I need the working scheme with Cisco behind.

[_Val_]

@Amir_Aliev can you please comment of SW here?

[_Val_]

@Amir_Aliev can you please comment of SW here?

[Amir_Aliev]

Fresh install (not upgrade) to latest firmware with USB flash should resolve limited encryption issue.

[Amir_Aliev]

Fresh install (not upgrade) to latest firmware with USB flash should resolve limited encryption issue.

[Somethig_Di]

Hello!

How can I do that? Where can I find a detailed manual or an instruction? All my current settings will erase?

[Somethig_Di]

Hello!

How can I do that? Where can I find a detailed manual or an instruction? All my current settings will erase?

[_Val_]

All releases and documentation are available on the product page. For the config, if it is a locally managed appliance, save config file before re-imaging. The appliance will be reset to factory defaults, but you can apply the saved config during the first time wizard.

[_Val_]

All releases and documentation are available on the product page. For the config, if it is a locally managed appliance, save config file before re-imaging. The appliance will be reset to factory defaults, but you can apply the saved config during the first time wizard.