RE: VPN Problems between WatchGuard Firebox 700 and Netscreen 5

["David Kison" <garetjax () keester com>]

Thanks to all that replied with suggestions/additional questions.  It turned
to be a fairly simple fix of changing the Outbound rule order and
restricting the originating network for the inside any to outside any on the
Netscreen 5.  Thanks for all the help/suggestions.

Dave

-----Original Message-----
From: David Kison [mailto:garetjax () keester com] 
Sent: Tuesday, March 02, 2004 9:29 AM
To: firewall-wizards () honor icsalabs com
Subject: [fw-wiz] VPN Problems between WatchGuard Firebox 700 and Netscreen
5


Good Morning.

I am currently experiencing getting a IPSEC VPN between a WatchGuard Firebox
700 and a Netscreen 5 functioning in both directions.  I am able to pass
traffic from behind the Firebox to the remote network and get a return but
if I am attempt to pass traffic from behind the Netscreen 5, I am 100%
unsuccessful.  In the traffic logs on the WatchGuard, I am seeing denies
related to spoofed source packets on the IPSEC "interface".  It appears that
the Netscreen is passing the public address of the firewall instead of the
private address of the initiating system behind the Netscreen.  Both
firewalls are NATing private Class C networks.

I am out of ideas on the issue.  Has anyone seen a similar issue?  Any
solutions?

Thanks in advance.

Dave

_______________________________________________
firewall-wizards mailing list firewall-wizards () honor icsalabs com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards

_______________________________________________
firewall-wizards mailing list
firewall-wizards () honor icsalabs com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards