Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Worapong_Janloy
Contributor

CheckPoint VPN with PaloAlto not working about invalid proxy id

Client(192.168.100.100) ----[CheckPoint](192.168.121.100)----(192.168.121.200)[PaloAlto]----Client(192.168.200.100)

On CheckPoint Side
VPN Domain : 192.168.100.0/24
Interoperable Device VPN Domain : 192.168.200.0/24
VPN Tunnel Share : already config both per subnet and per gateway but have the same result.
user.def.FW1 :
subnet_for_range_and_peer = {
<192.168.121.200, 192.168.100.1, 192.168.100.254; 255.255.255.0>
};

On PaloAlto Side
Proxy ID : Local : 192.168.200.0/24 and Remote : 192.168.100.0/24

ERROR message from Palo : description contains 'IKE phase-2 negotiation failed when processing proxy ID. cannot find matching phase-2 tunnel for received proxy ID. received local id: 192.168.121.200/32 type IPv4_address protocol 0 port 0, received remote id: 192.168.100.0/24 type IPv4_subnet protocol 0 port 0.

The Result: Client from PaloAlto side can access to client on Checkpoint side but on CheckPoint side can't access client on palo side.

4 Replies
Danny
Champion Champion
Champion

Palo's error message shows a received local id: 192.168.121.200/32 while the configured local proxy id is 192.168.200.0/24.

0 Kudos
Worapong_Janloy
Contributor

The 192.168.121.200/32 is ip address of Interoperable Device (Main IP) I not sure why checkpoint propose this ip to PaloAlto.

0 Kudos
Danny
Champion Champion
Champion

Because Check Point handles the external or Main IPs of both VPN gateways as part of the VPN encryption domain. Exclude them via crypt.def or adjust your Palo configuration accordingly and you should be fine.

0 Kudos
Matthias_Haas
Advisor

Do they do a NAT on the PaloAlto Side before encapsulating the IP packet in the IPSec Tunnel, so the IP of the Client is actually the 192.168.121.200 ?

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events