| Newsgroups |
gmane.comp.security.vpn |
| Message-ID |
<[email protected]> |
Hello all,
thank you for your help!! and sorry for my late answer...
the solution to my problem was
1/ the swap of the access-list to fix the NAT issue
2/ the change in the encryption domain group on the checkpoint FW-1 (because the 2 gateways share the same IP scope)
Thanks again.
> Rather than use the loopback routing hack a better solution would be to
> fix the existing "access-list 115" so that it does what's intended.
> Since access-lists are processed top-down on a first match basis, the
> "deny" line for the VPN traffic will never be reached because the
> previous "permit" line is more general. Swap the order of those two
> lines and that should fix the NAT issue.
>
> The loopback routing trick was needed when you had static one-to-one NAT
> translations and VPN configured because there was no other way to
> selectively apply the static NAT only to non-VPN traffic. However,
> recent versions of IOS support route-maps on static translations so the
> loopback trick should never be necessary in this case. In general,
> policy routing should only be used as a last resort, especially in cases
> where it will force the router to use the process switching path for
> packets (which loopback routing will do).
>
> HTH - Good luck!
>
> Dana
>
> Dana J. Dawson [email protected]
> Sr. Staff Engineer CCIE #1937
> Qwest Communications
> 600 Stinson Blvd., Suite 1S
> Minneapolis MN 55413-2620
>
> "Hard is where the money is."
>
>
> Jean-Francois Dive wrote:
> > hello matt,
> >
> > not sure you still need helps but your problem is that the traffic that
> > goes trough the ipsec tunnel should not be nated. This is classic
> > configuration problem with IOS. Have a look to
> > http://www.cisco.com/en/US/tech/tk583/tk372/technologies_configuration_example09186a008009475c.shtml
> >
> > the trick, in a nutshell is the following:
> >
> > - due to the order of operation, packet going out will be source nated
> > before beeing ipsec processed --> they dont match the ipsec policy.
> >
> > - So the goal is to not nat to_be_ipsec traffic.
> >
> > - For a packet to be nated, it must come from an interface with an
> > ip nat inside, and go out on an interface with an ip nat outside.
> >
> > - The thing is to reroute the packets to be routed trough the loopback
> > interface so they appear on the external interface not coming from
> > the lan one, so they dont get nated. This is done with a route map.
> >
> > This should solve your problem.
> >
> > J.
> >
> > On Wed, Apr 20, 2005 at 08:22:06PM +0200, matt wrote:
> >
> >>hello gurus,
> >>
> >>I try for a week to build a site-to-site VPN between a Checkpoint FW-1 and a cisco 837 router. I followed several docs from cisco and checkpoint to do that.
> >>Actually I only see incoming ping requests from the cisco in the FW logs, the error is : "encryption failure: Received a cleartext packet within an encrypted connection" ...
> >>So I ckecked again the cisco configuration (see below) and even with all debugging options I cannot see where the problem is.
> >>Perhaps it's a problem of compatibility? Maybe I should use Easy VPN "module"??
> >>Could anynone help me??
> >>
> >>
> >>Code:
> >>!
> >>version 12.3
> >>no service pad
> >>service timestamps debug datetime localtime show-timezone
> >>service timestamps log datetime localtime show-timezone
> >>service password-encryption
> >>!
> >>hostname RouterESM_PRA
> >>!
> >>no logging console
> >>enable password 7 ****************
> >>!
> >>
> >>username monitor password 7 1*******
> >>clock timezone GMT 1
> >>clock summer-time GMT recurring last Sun Mar 2:00 last Sun Oct 2:00
> >>no aaa new-model
> >>ip subnet-zero
> >>!
> >>ip dhcp pool CLIENT
> >> import all
> >>!
> >>!
> >>no ip bootp server
> >>ip audit notify log
> >>ip audit po max-events 100
> >>vpdn enable
> >>!
> >>no ftp-server write-enable
> >>!
> >>!
> >>!
> >>!
> >>crypto isakmp policy 1
> >> encr 3des
> >> hash md5
> >> authentication pre-share
> >> group 2
> >> lifetime 3600
> >>crypto isakmp key 0 ***** address PUBLIC_IP_FW_CHECKPOINT
> >>!
> >>!
> >>crypto ipsec transform-set ts1 esp-3des esp-md5-hmac
> >>!
> >>crypto map EsmMap 10 ipsec-isakmp
> >> description specify IPSec policy for ESM
> >> set peer PUBLIC_IP_FW_CHECKPOINT
> >> set transform-set ts1
> >> match address 110
> >>!
> >>!
> >>!
> >>!
> >>interface Ethernet0
> >> description LAN_PRA
> >> ip address 10.3.48.1 255.255.240.0
> >> ip nat inside
> >> no cdp enable
> >> hold-queue 100 out
> >>!
> >>interface ATM0
> >> no ip address
> >> no atm ilmi-keepalive
> >> pvc 8/35
> >> encapsulation aal5mux ppp dialer
> >> dialer pool-member 1
> >> !
> >> dsl operating-mode auto
> >>!
> >>interface FastEthernet1
> >> no ip address
> >> duplex auto
> >> speed auto
> >>!
> >>interface FastEthernet2
> >> no ip address
> >> duplex auto
> >> speed auto
> >>!
> >>interface FastEthernet3
> >> no ip address
> >> duplex auto
> >> speed auto
> >>!
> >>interface FastEthernet4
> >> no ip address
> >> duplex auto
> >> speed auto
> >>!
> >>interface Dialer1
> >> description adslpro_wanadoo
> >> ip address negotiated
> >> no ip redirects
> >> no ip unreachables
> >> ip nat outside
> >> encapsulation ppp
> >> dialer pool 1
> >> dialer-group 1
> >> no cdp enable
> >> ppp authentication chap pap callin
> >> ppp chap hostname ****
> >> ppp chap password 7 ****
> >> ppp pap sent-username *** password 7 ***
> >> crypto map EsmMap
> >>!
> >>ip nat inside source route-map nonat4vpn interface Dialer1 overload
> >>ip classless
> >>ip route 0.0.0.0 0.0.0.0 Dialer1
> >>no ip http server
> >>no ip http secure-server
> >>!
> >>access-list 1 permit 10.3.48.0 0.0.15.255
> >>access-list 110 remark define an ACL for the traffic to be encrypted
> >>access-list 110 permit ip 10.3.48.0 0.0.15.255 10.50.0.0 0.0.255.255
> >>access-list 115 remark traffic between the sites does not get natted
> >>access-list 115 permit ip 10.3.48.0 0.0.15.255 any
> >>access-list 115 deny ip 10.3.48.0 0.0.15.255 10.50.0.0 0.0.255.255
> >>no cdp run
> >>route-map nonat4vpn permit 1
> >> match ip address 115
> >>!
> >>!
> >>line con 0
> >> exec-timeout 120 0
> >> no modem enable
> >> stopbits 1
> >>line aux 0
> >>line vty 0 4
> >> access-class 23 in
> >> exec-timeout 120 0
> >> login local
> >> length 0
> >>!
> >>scheduler max-task-time 5000
> >>!
> >>end
> >>
> >
> >
> >>_______________________________________________
> >>VPN mailing list
> >>[email protected]
> >>http://lists.shmoo.com/mailman/listinfo/vpn
> >
> >
Accédez au courrier électronique de La Poste : www.laposte.net ;
3615 LAPOSTENET (0,34/mn) ; tél : 08 92 68 13 50 (0,34/mn)
_______________________________________________
VPN mailing list
[email protected]
http://lists.shmoo.com/mailman/listinfo/vpn