On Wed, Dec 31, 2003 at 11:06:45PM +0100, Matthias Leu wrote: > I really thought, that I can build a VPN with my SmartCenter > and a VPN-1 Edge X... > Any hints? Maybe I missed a main thing?
Yes, don't put the profile in the policy target, just make sure your gateway knows there might be encrypted traffic coming from the network behind the Edge gateway and it'll do the rest. You tell main gateway about it by installing that rule on the main gateway. When you install the policy, a simple vpn topology file will be created for the Edge and it'll fetch it from the management. Since there's either a certificate or shared secret defined in the objects database and you've got both in a vpn community, in the end both the main gateway and the edge can talk to each other. It's explained in the PDFs. Apparently simplified mode is required because you can't define traditional mode properties for the Edge (unless you try hacking them in objects_5_0.C - probably wouldn't work even that way). I hate it because you just lost per rule control of SCV rules, but I guess you can't get it all... strange how simplified mode and SCV has had this restriction for ages. Another thing since you're running R55. If you have the main gateway on Linux, Solaris or something similar have you noticed how policy install wipes out the null device? $ pwd /opt/CPfwbc-41/bin $ grep null SofaWareTopology.sh /bin/rm "$1/tmp/$2.topo" 2>&1 /dev/null /bin/rm "$1/tmp/$2.tpz" 2>&1 /dev/null There should be a > before each /dev/null. -- (Mr.) Hannu Liljemark | Appelsiini Finland Oy | http://appelsiini.fi ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
