Showing results for 
Search instead for 
Did you mean: 

L2L issue

Level 1
Level 1

I'm troubleshooting a L2L tunnel on a pix 515e to a checkpoint. I including a ipsec and isakmp debug - I can't figure out where it is failing. any help is appreciated.


2 Replies 2

Level 5
Level 5

If the IPsec tunnel is not UP, check that the ISAKMP policies match with the remote peers. This ISAKMP policy is applicable to both the Site-to-Site (L2L) and Remote Access IPsec VPN.

If the Cisco VPN Clients or the Site-to-Site VPN are not able establish the tunnel with the remote-end device, check that the two peers contain the same encryption, hash, authentication, and Diffie-Hellman parameter values and when the remote peer policy specifies a lifetime less than or equal to the lifetime in the policy that the initiator sent. If the lifetimes are not identical, the security appliance uses the shorter lifetime. If no acceptable match exists, ISAKMP refuses negotiation, and the SA is not established.

If the Cisco VPN Client is unable to connect the head-end device, the problem can be the mismatch of ISAKMP Policy. The head-end device must match with one of the IKE Proposals of the Cisco VPN Client.

Cisco Employee
Cisco Employee

Based upon on the debug, it looks like the UDP Port 500 is being blocked in the path between the Pix and Checkpoint.

crypto_isakmp_process_block:src:, dest: spt:500 dpt:500

ISAKMP: phase 1 packet is a duplicate of a previous packet

Also, I notice that you have, which is a private IP on the public interface and I am sure that its getting NATTed somewhere. So, you may want to check the NATTing device to make sure that its not blocking any traffic.



** Please rate all helpful posts **