3des vs. 3des-cbc

[seagordo]

I'm trying to troubleshoot a PIX to Checkpoint site2site VPN tunnel. The IKE proposals don't appear to be matching. Based on the debug output, the PIX is operating 3des in CBC mode. We've got the Checkpoint configed for 3des.

My question:

Will the PIX in 3DES-Cipher Block Chaining (CBC) mode work with a Checkpoint in 3DES mode? Haven't found anything specific via google so I though I'd ask the experts.

Thanks,

Sean

[Patrick Iseli]

Yes it will but:

1.) Configure the PIX on CheckPoint as en Embedded device.

2.) DH Group 2 seens to bug with Cisco Try DH Group 1

3.) Keepalive timers must be the same

4.) The access-list in the PIX that should correspond to the encryption domain on the checkpoint firewall. Exactly the same subnet maks.

PIX(config)# access-list VPN permit ip Internalnet ISubnet Externalnet ESubnet

PIX(config)# crypto map REMOTE 10 match address VPN

sincerely

Patrick