Altostratus
NimbostratusHi Leonardo,
I recently have met the similar situation, here is the info: user -- checkpoint -- LC-- Internet -- checkpoint -- Other site users I have created the VS with destination VPN public IP、pool CP private IP with all protocol; VS with outbound 0.0.0.0、pool pool_gateway with all protocol. Through wireshark, phase I has been established, however there were no phase II packets. From CP, we always see the error that the pre-share-key mismatch even the key is so the same. CP TAC suggest that we deleted all VS and just created a NAT on NAT list in LC, that can work. However we just want to use VS to narrow down the public IP with related port in order to avoid attack, so any suggestion? thx in advance
CirrocumulusHave you tried to use destination address persistence? This is to make sure traffic go out via the same ISP when doing the VPN.
NimbostratusThx for your reply!
Could you list the detail VS config for reference? As after setting up the inbound and outbound VS, sometime ICMP packet will be dropped by ping tool. If we just created a NAT on NAT list, it seems that it is stable.
CirrocumulusSNAT default setting is to allow only TCP and UDP. Check the setting in System -> Configuration -> Local Traffic -> SNAT Packet Forwarding.