VPN between IOS and Checkpoint FW1

[somanabich]

I currently have a VPN setup with my IOS 3745 router and a FW-1 box of a business partner.

When I try to create an access list (for which traffic should be encrypted) that has a 32 bit subnet mask, ie I only want my hosts to send encrypted packets to a particlular host and not the whole destination subnet, the FW-1 box throws an error 'No Porposal chosen'. When I change my subnet mask back to 24 bit all works OK.

Can I get the administrator of the FW-1 box to make changes so that only traffic from my network to 1 particular host gets encrypted?

Any ideas?

[sachinraja]

Hello

The interesting traffic at both the ends (router & checkpoint) should match. You can configure traffic to go a a particular host, but the same has to be be configured on the checkpoint..

in PIX configure this access-list for interesting traffic:

access-list 110 permit ip 192.168.0.0 0.0.0.255 (ur network) host 10.1.1.1 (remote host)

On the checkpoint, configure the local/remote networks appropriately.. Select Manage->network objects -> New (or edit) -> network and specify the internet network as 10.1.1.1 netmask 255.255.255.255.

check the following URL for configuration examples..

http://www.cisco.com/en/US/tech/tk583/tk372/technologies_configuration_example09186a0080094ac4.shtml#config

[somanabich]

How I can stop some traffic, for instance e-mail from my netowrk from being encrypted, ie I would like all other traffic not destined for a particular host to not be encrypted.

Could I do this with 'deny' in my access-list?

Thanks for your assiatnce.

[sachinraja]

Hello.

The encryption is going to happen only for the traffic matching the access-list (interesting traffic). Any other traffic not matching the access-list will not be encrypted. You will define an extended access-list , specifying the source, destination, port etc for this.

If you want to deny encryption for a particular host which is on the same region as the interesting traffic, you can deny the same on the interesting traffic access-list and then permit the others...

example:

access-list 100 permit ip 10.1.1.0 0.0.0.255 192.168.1.0 0.0.0.255

In the above example, packets only from source 10.x to 192.x is encrypted. any other traffic is not encrypted. you can change this if you want to deny any traffic between 10.x & 192.x not to be encrypted..

hope you got it !!