About nitesharbale

@aleksandar.astardzhiev Finally after a week of troubleshooting, it started working. Thanks for your valuable suggestion, it wont be possible without your help. I will put the changes i made in steps below, so that it would help other folks as well. First read 4-B here: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk101219. Below are snaps.   Step 1: changed from "true to "false"   Step 2: changed to false   Step3: changed to false     On PA: Go to Network TAB-->IPSec Tunnel-->Open the tunnel-->inside proxy ID i defined 200.1.1.1(PA local NAT IP, earlier it was 10.172.0.0/24, while troubleshooting i changed to 200.1.1.x) and remote as 10.168.1.1(CP IP). Earlier it was whole subnet i.e 200.1.1.0/24 and 10.168.1.0/24     @aleksandar.astardzhiev because i have static nat, do i always need to define /32 as proxy ID ? Thanks ... View more

@aleksandar.astardzhiev Thankyou.. though the issue is not completely resolved. Ping from PA to CP worked fine, but CP to PA is failing. I have static NAT (like i did in PA) and have correct security policy as well. phase 2 shows like this.    2 SAs of all instances: Peer 10.12.1.1 , SITEB-PA-GATEWAY SAs: IKE SA <fef1591def15bc75,e45b67b52d88ed60> (No IPSec SAs)     [Expert@SITEA-GW:0]# fw ctl zdebug + drop | grep "10.168.1.1" @;45251;[vs_0];[tid_2];[fw4_2];fw_log_drop_ex: Packet proto=1 10.168.1.1:2048 -> 10.172.0.10:50919 dropped by fw_ipsec_encrypt_on_tunnel_instance Reason: No error - tunnel is not yet established; @;45251;[vs_0];[tid_2];[fw4_2];fw_log_drop_ex: Packet proto=1 10.168.1.1:2048 -> 10.172.0.10:676 dropped by fw_ipsec_encrypt_on_tunnel_instance Reason: No error - tunnel is not yet established; @;45252;[vs_0];[tid_2];[fw4_2];fw_log_drop_ex: Packet proto=1 10.168.1.1:2048 -> 10.172.0.10:27231 dropped by fw_ipsec_encrypt_on_tunnel_instance Reason: No error - tunnel is not yet established; @;45252;[vs_0];[tid_2];[fw4_2];fw_log_drop_ex: Packet proto=1 10.168.1.1:2048 -> 10.172.0.10:59929 dropped by fw_ipsec_encrypt_on_tunnel_instance Reason: No error - tunnel is not yet established;   I am waiting for their reply and let me see what new comes up in checkpoint now to resolve this. Again thanks for the help sir. ... View more

@aleksandar.astardzhiev Finally it is working now. Checkpoint is really tricky.    On CP i added both local and original subnet under object group     Thankyou very much for helping and making me this understand. On youtube i found simple S2S vpn. This LAB helped me understand the concept in much better way.  ... View more

Below is what i got   Info: VPN Domain for Gateway Communities are currently not displayed correctly by this tool! VPN Gateway > 10.12.1.1 Encryption domain 10.12.1.1 - 10.12.1.1 10.172.0.0 - 10.172.0.255 VPN Gateway > 192.168.1.1 Encryption domain 10.11.1.0 - 10.11.1.0 10.11.1.1 - 10.11.1.1 10.11.1.2 - 10.11.1.63 192.168.0.253 - 192.168.0.253 192.168.1.0 - 192.168.1.0 192.168.1.1 - 192.168.1.1 192.168.1.2 - 192.168.1.255 Info: VPN Domain for Gateway Communities are currently not displayed correctly by this tool! [Expert@SITEA-GW:0]#     ... View more

Have you tried to run this - https://community.checkpoint.com/t5/Security-Gateways/One-liner-to-show-VPN-topology-on-gateways/td-...   -->No i am afraid to run that, all my configs and troubleshooting done along with you guys would go in vain. And have to start new troubleshooting on CP if any thing goes wrong after running this command. ... View more

@aleksandar.astardzhiev Sorry there is misconfigured def gw on pc. I am almost close to achieve this now.   On CP it is dropping. I am going through their post related to below issue and hope to find solution soon.   Though traffic reaching to CP, but NAT hits are not increasing   Thanks ... View more

@aleksandar.astardzhiev  I was looking again at your screenshots I and for me the route, nat and rule on the palo alto are fine. This means you should see at least "pkt encap" counter to increase in the details for phase2 ---> I made few changes in security policy and NAT rule. PSB NAT RULE: i am initiating traffic from both end so i configured below rule        If you try to send ping from the DMZ network behind the palo alto: do you see traffic logs? can you show the details? what about the "pkt encap", does this counter increase? --> I dont see any packet encap/decap counter increasing, so first i checked if PA can reach DMZ server or not and yes it is able to ping. admin@SITE-B-FIREWALL> ping source 172.16.4.254 host 172.16.4.10 PING 172.16.4.10 (172.16.4.10) from 172.16.4.254 : 56(84) bytes of data. 64 bytes from 172.16.4.10: icmp_seq=1 ttl=64 time=0.916 ms 64 bytes from 172.16.4.10: icmp_seq=2 ttl=64 time=0.827 ms 64 bytes from 172.16.4.10: icmp_seq=3 ttl=64 time=0.902 ms 64 bytes from 172.16.4.10: icmp_seq=4 ttl=64 time=1.00 ms 64 bytes from 172.16.4.10: icmp_seq=5 ttl=64 time=0.715 ms ^C --- 172.16.4.10 ping statistics --- 5 packets transmitted, 5 received, 0% packet loss, time 4001ms rtt min/avg/max/mdev = 0.715/0.873/1.008/0.103 ms   While i was pinging from DMZ server(172.16.4.10 to NAT IP of CP side 10.168.1.1, which i was unable to ping) , i dont see any packet encap/decap counter increasing not any security logs as well. Do i need to reconfigure NAT rule if packet encap counter not increasing ??       ... View more

On PA after issuing this command tunnel seems up.    PHASE1: PHASE2:         ON CP (below output is when i initiated tunnel from PA) SITEA-GW> vpn tu ********** Select Option ********** (1) List all IKE SAs (2) * List all IPsec SAs (3) List all IKE SAs for a given peer (GW) or user (Client) (4) * List all IPsec SAs for a given peer (GW) or user (Client) (5) Delete all IPsec SAs for a given peer (GW) (6) Delete all IPsec SAs for a given User (Client) (7) Delete all IPsec+IKE SAs for a given peer (GW) (8) Delete all IPsec+IKE SAs for a given User (Client) (9) Delete all IPsec SAs for ALL peers and users (0) Delete all IPsec+IKE SAs for ALL peers and users * To list data for a specific CoreXL instance, append "-i <instance number>" to your selection. (Q) Quit ******************************************* 1 Peer 10.12.1.1 , SITEB-PA-GATEWAY SAs: IKE SA <3b9a97149bc884dd,edfb6f9b1501ee78>   2 SAs of all instances: Peer 10.12.1.1 , SITEB-PA-GATEWAY SAs: IKE SA <1586026f8eeeba33,bdafb0a3bbc94399> (No IPSec SAs)   But ping didn't work from either end. ... View more

@aleksandar.astardzhiev local proxy changed now to local and remote NAT, no luck. https://pdf.ac/rbySN   URL contains .docx file which has CP and PA configs.   Thankyou ... View more

@aleksandar.astardzhiev @upelister  Thankyou for taking out your precious time. I have made required changes. I have Phase 1 & 2 setting same on CP, still tunnel is not up. Underlay routing is also in place. I am checking on CP community as well. Just wanted to know do i need any other changes on PA ? 10.168.1.0/24 --> NAT Subnet of CP side. (Original Subnet: 192.168.1.0/24) 10.172.0.0/24 -->NAT Subnet of PA side   (Original Subnet: 172.16.4.0/24) ROUTING TABLE:   Tunnel is Still not up       Interfaces & Zone:     IKE Gateway: Phase 1: Phase 2:   NAT Policy:   Security Policy:     Thanks ... View more

@BPry I downloaded PA VM image from some random site. Now i want to activate free trail license to start practise. I am trying to create account from my organisation email address. But dont have serial no/Auth code to mention there. ... View more

@reaperI ordered it on amazon, and waiting to be delivered. Looking forward to master PA. Thankyou. ... View more

@MP18 Thankyou for suggesting those useful links. But what do you think about the book i mentioned? Because I had to write down every imp points from videos/forums which will take lot of time. Thats why i prefer book.   Thankyou. ... View more