VPN traffic issues caused by devices with Dynamically Assigned IP (DAIP)

Support Center > Search Results > SecureKnowledge Details

Technical Level

Solution ID	sk103523
Technical Level
Product	IPSec VPN
Version	R75 (EOL), R76 (EOL), R77 (EOL), R77.10 (EOL), R77.20, R77.30 (EOL), R80.10 (EOL)
OS	Gaia, SecurePlatform
Platform / Model	All
Date Created	27-Nov-2014
Last Modified	13-Mar-2019

Symptoms

Central Gateway is not able to initiate traffic to one of the devices with Dynamically Assigned IP (DAIP).
Security Gateway with Dynamically Assigned IP (DAIP) initiates VPN tunnel successfully with the Central Gateway, sends and receives traffic.
Central Gateway does not use the already existing VPN tunnel that was created by the device with Dynamically Assigned IP (DAIP).
VPN IKE debug on Central Gateway shows (in $FWDIR/log/ike.log) attempts to initiate Main mode Packet 1 simultaneously with Quick mode packet 1. No reply from the device with Dynamically Assigned IP (DAIP).

Cause

When a device with Dynamically Assigned IP (DAIP) is created (either Interoperable Device, or Check Point object), it is "allocated" with a demo IP address 0.0.0.X.

If more than one device with Dynamically Assigned IP (DAIP) is created, the same demo IP address might be allocated to more than one of these DAIP devices.
In such case, after policy installation completes, the following warning appears:
"...have same main IP address: 0.0.0.X . This can cause abnormal behavior to your network. Please change the IP address of one of these objects."

Solution

Follow these steps:

(For R77.30) Connect with SmartDashboard to Security Management Server / Domain Management Server.
(For R77.30) Go to 'File' menu - click on 'Database Revision Control...' - create a revision snapshot.
(For R80.10, start here) Close all SmartConsole windows (SmartDashboard, SmartView Tracker, SmartView Monitor, etc.).
Connect with GuiDBedit Tool to Security Management Server / Domain Management Server.
In the upper left pane, go to 'Table' - 'Global Properties' - 'properties'.
In the upper right pane, select the 'firewall_properties'.
Press CTRL+F (or go to 'Search' menu - 'Find') - paste ike_allow_unusual_id_types - click on 'Find Next'.
In the lower pane, right-click on the 'ike_allow_unusual_id_types' - select 'Edit...' - select "true" - click on 'OK'.
Save the changes: go to 'File' menu - click on 'Save All'.
Close the GuiDBedit Tool.
Connect with SmartDashboard to Security Management Server / Domain Management Server. (Connect with SmartConsole to Security Management Server / Domain Management Server. (in R80.x))
Install the policy.

This solution has been verified for the specific scenario, described by the combination of Product, Version and Symptoms. It may not work in other scenarios.

Give us Feedback

Please rate this document

[1=Worst,5=Best]

Comment
	Submitting rating