Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
rob99-99
Explorer

Checkpoint to ASA VPN traffic selection issue

Hi all,

Have a 5800 R80.40 to a ASA 9.6 VPN trying to get up.

Scenario is,
ASA LAN server A to Checkpoint LAN server B
On the checkpoint, ASA LAN server A source is being translated to server C IP. server B gets no nat/original.
Since this is transparent to the ASA, on the ASA the no nat rule says server A and B get no nat.

When initiating traffic on the Cisco side, the ASA debugs makes it seem Phase 1 is ok as far as the crypto and PSK.
On the Cisco debug shows that the correct DH group has been negotiated, NAT-T is in use 4500, PSK has been sent and ESP encapsulation is going on,
Then the ASA sends the traffic selector for the correct source ( server A ) to destination ( server B ) and resends a few times and times out.

On the Checkpoint side, it shows as UP Phase 1, but shows this error.

IKEv2 [NAT-T (IPv4)
auth exchange: sending notification to peer: traffic selectors unacceptable
MyTSi MyTSr:
<has the public IP of the ASA>
<224.0.0.0 - 224.0.0.255>
Peer TSi:
Peer TSr:
<server B IP address>
Do not why the Checkpoint is picking the " public outside " interface IP of the ASA firewall.
Does anyone have any ideas?

0 Kudos
2 Replies
G_W_Albrecht
Legend
Legend

rob99-99
Explorer

Thanks for the links. I had read them before, but didn't see anything exact to my scenario, but will try a few of the things in them.

I had read an article a while that mentioned the traffic selection on the Checkpoint side, being the ASA firewalls interface rather than the IP of the server in the VPN domain, but cannot find that article again.

On the ASA side, I see the traffic selector correct, Server A IP permit any to server B IP.
But on the checkpoint this error, where instead of IP of server A, it is the IP of the ASA interface and 224.0.0.0-224.0.0.255
What does 224.0.0.0-224.0.0.255 mean ?

IKEv2 [NAT-T (IPv4)
auth exchange: sending notification to peer: traffic selectors unacceptable
MyTSi MyTSr:
<has the public IP of the ASA>
<224.0.0.0 - 224.0.0.255>
Peer TSi:
Peer TSr:
<server B IP address>

0 Kudos