Troubleshooting VPN Issues

[USF-Nealio]

My company was purchased by a corporation and we are in the process of interconnecting the different offices. So far I've connected 4 of the 5 offices, but the last on is proving to be quite the challenge.

My site has a Cisco VPN 3000 concentrator, and the remote offices has a Nokia Checkpoint IP390.

The network I'm attempting to share at my site is on the 172.16.x.x network, and they are attempting to share the 192.168.10.x network. The 192.168.10.x network already exists locally, so they put a NAT in place to change their network to 192.168.200.x. The tunnel builds properly, but that's when the trouble begins.

I can run an IP and Port scan across their entire network, and I am able to discover and connect to all of device on their network without trouble. But when they attempt to do the same, all ICMP requests fail, and they have a strange intermittent ability to connect to devices at our site.

Now they claim that their firewall rules for us are set to ANY ANY for our site, but I'm not seeing any of the ICMP requests that they are sending when I look in wireshark, and I do not have firewall after VPN concentrator that would be blocking that traffic. When they tracert to any device on our network, it only makes it as far as their default gateway before the timeouts begin, so I'm confident that they are not making it across the tunnel.

With that information, I'm assuming it's any combination of 3 things.
1. Routing: Traffic simply doesn't know how to get TO the tunnel, which seems a little strange considering it's an AIO device.
2. Firewall: Traffic simply isn't being allowed.
3. VPN Config: There is an error in the VPN config that is preventing it from passing the NATed traffic across the tunnel.

I do not have direct access to their device currently, and I'm completely unfamiliar with Nokias in general. Besides asking for access (which I'm currently working on), what suggestions or diagnostics can I perform to correct this?

 

[Tarrant64]

I bet this is an issue on the Checkpoint side.

Couple of things to check:

Make sure that whatever IPSec encryption you are using is supported on both devices (3DES, Diffe-Hillman types, etc.). Generally you shouldn't be able to get a tunnel established if they don't match but I've seen some funny things from Cisco devices (IOS bugs).

Also - look into NAT-T and whether that is enabled/disabled on either end. This feature basically allows IPSec VPN traffic to flow properly through a NAT configuration. I've personally had to disable this for some Cisco VPN tunnels to non Cisco devices.

Make sure you're NAT's are all in place correctly. I've had NAT exempt rules in place that I didn't think would impact VPN traffic and did.

Lastly, I would probably check the setup/order of your "interesting traffic" (meaning where you state in your VPN configuration what LANs are reachable through the tunnel). Not often, but can happen, if these aren't matched up exactly on both sides of the tunnel funny things like one-way traffic can occur.

 

[tangoseal]

IDo not like VPN 3000 devices. Too many troubles and compatibility issues it seems atleast in my experience. I would almost say you might want to look at getting some ASA 5510's on both ends with a VPN license as they are more than powerful enough to handle any midsize and large size business VPN needs and much more stable (well not sure about that statement).

 

[USF-Nealio]

UPDATE: I was given access to configure the checkpoint, and I was able to get basic 2 way connectivity between the 2 sites. Now I've just got to figure out why there still isn't 2 way ICMP so that they can setup monitoring. I was able to eventually figure out that they never added the NAT'd IP address pools to firewall rules. So my only guess is that traffic intended for my network was eventually getting caught in an implicit block rule because it wasn't listed anywhere else in the firewall rules.

The VPN 3000 isn't that terrible. We have 3 of them, and VPNs with nearly 100 clients. We've only ever had issues with 1 of our clients, and now this sister company. The 1 client was using a complete piece of crap that I was eventually able to connect to a PFsense box that we use as a backup.