some time ago I worked with a customer at a similar problem with a cisco concentrator 4000. seems that this bug at ciscos was is causing the tunnel- failure: * CSCea04137 There is a problem with IPSEC SAs reestablishing after checkpoint initiates a soft reset. maybe its possible that the pix has the same behaviour.
try to clear the ike-sa's at the pix instead of recompiling the fw-1 policy. this should also work. a solution would be to modify the ike-sa-renegotiation-timeouts on both sites... let's say 70000 min ;-)
/markus
At 19:59 09.10.2003, you wrote:
Hello all,
We have a really strange phenomenon in a VPN between a PIX and a Checkpoint module (NG/FP3).
>From time to time, the VPN stops working. IPSEC packets come in, but are dropped (reason : "No valid SA"). And for each packet being dropped, a packet "Delete IPSEC SA" is sent from the Checkpoint.
Fortunately, the solution is not really difficult : recompiling. But every times, the guy at the other site rings like hell ...
Any idea ?
JF
-- Jean-Francois Gobin - Administrateur gobinjf.be http://www.gobinjf.be mailto:[EMAIL PROTECTED]
================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
-- Markus Hofbauer, IT-Service / Security Bacher Systems EDV GmbH, Wienerbergstr. 11B, A-1101 Wien, Austria phone: +43 (1) 60 126-34 | fax: +43 (1) 60 126-4 e-mail: [EMAIL PROTECTED] | web: www.bacher.at
================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
