- Products
- Learn
- Local User Groups
- Partners
- More
Check Point Jump-Start Online Training
Now Available on CheckMates for Beginners!
Why do Hackers Love IoT Devices so Much?
Join our TechTalk on Aug 17, at 5PM CET | 11AM EST
Welcome to Maestro Masters!
Talk to Masters, Engage with Masters, Be a Maestro Master!
ZTNA Buyer’s Guide
Zero Trust essentials for your most valuable assets
The SMB Cyber Master
Boost your knowledge on Quantum Spark SMB gateways!
As YOU DESERVE THE BEST SECURITY
Upgrade to our latest GA Jumbo
CheckFlix!
All Videos In One Space
Hi all,
Have a 5800 R80.40 to a ASA 9.6 VPN trying to get up.
Scenario is,
ASA LAN server A to Checkpoint LAN server B
On the checkpoint, ASA LAN server A source is being translated to server C IP. server B gets no nat/original.
Since this is transparent to the ASA, on the ASA the no nat rule says server A and B get no nat.
When initiating traffic on the Cisco side, the ASA debugs makes it seem Phase 1 is ok as far as the crypto and PSK.
On the Cisco debug shows that the correct DH group has been negotiated, NAT-T is in use 4500, PSK has been sent and ESP encapsulation is going on,
Then the ASA sends the traffic selector for the correct source ( server A ) to destination ( server B ) and resends a few times and times out.
On the Checkpoint side, it shows as UP Phase 1, but shows this error.
IKEv2 [NAT-T (IPv4)
auth exchange: sending notification to peer: traffic selectors unacceptable
MyTSi MyTSr:
<has the public IP of the ASA>
<224.0.0.0 - 224.0.0.255>
Peer TSi:
Peer TSr:
<server B IP address>
Do not why the Checkpoint is picking the " public outside " interface IP of the ASA firewall.
Does anyone have any ideas?
Thanks for the links. I had read them before, but didn't see anything exact to my scenario, but will try a few of the things in them.
I had read an article a while that mentioned the traffic selection on the Checkpoint side, being the ASA firewalls interface rather than the IP of the server in the VPN domain, but cannot find that article again.
On the ASA side, I see the traffic selector correct, Server A IP permit any to server B IP.
But on the checkpoint this error, where instead of IP of server A, it is the IP of the ASA interface and 224.0.0.0-224.0.0.255
What does 224.0.0.0-224.0.0.255 mean ?
IKEv2 [NAT-T (IPv4)
auth exchange: sending notification to peer: traffic selectors unacceptable
MyTSi MyTSr:
<has the public IP of the ASA>
<224.0.0.0 - 224.0.0.255>
Peer TSi:
Peer TSr:
<server B IP address>
About CheckMates
Learn Check Point
Advanced Learning
YOU DESERVE THE BEST SECURITY