🚀 go-pugleaf

-----BEGIN PGP SIGNED MESSAGE-----

Hi all;

We've got a bit of a wierd one and I'm somewhat puzzled as to what's
going on.

We have two routers, both running Cisco IOS 12.1; one is a 2621, and
the other is a 3640.

Between these routers, we have an only semi-trusted network, so
traffic between the routers is transported via IPSec.  Conceptually,
it looks somewhat like this:

- -------  LAN A
    |
 router1
    |    IPSec Link
 router2
    |
- -------  LAN B

So, traffic between LANs A and B will be transported via Cisco's
crypto.  Now, on LAN A we have a machine that runs Check Point's
Firewall-1 GUI software (Policy Manager, Log Viewer, etc).  On LAN B
we have a Check Point Firewall-1 Management server.  These two hosts
use TCP:258 to communicate between them.

Check Point's GUI protocol is itself encrypted in some way (I'm not
sure on the specifics, which could be something to do with the
problem :)

If we wrap up TCP:258 in our crypto map, the management client cannot
connect to the management server; it can connect to the point where
it advises that policies are being loaded, etc, but then will never
actually complete the process (and it's connected enough to note when
your authentication userID and passphrase are incorrect).  If we
exclude the TCP:258 from the crypto, it works 100% fine.

The boggle is that I thought Cisco's IPSec packaged up the payload,
without altering it, and unpackaged it at the other end.  My guess is
that it's in some way altering sequencing or other packet information
in the payload, and causing us pain (because the Check Point product
will not tolerate its packets been messed with).

What are people's thoughts as to why this might be happening, and if
there's a way to fix?

Kind regards

Richard Parry
- --
Richard Parry                          richard.parry@optimation.co.nz
Glue Guy: CCNA, CSE(SMB), MCP, makes pretty good coffee    Optimation
Phone: +64 4 470 5814 x 848    Pager: richardp.pager@optimation.co.nz

-----BEGIN PGP SIGNATURE-----
Version: PGP 7.0.4

iQEVAwUBOwGpmvVxtQ5VlW2tAQGYdQgAnOBZsjy0IKGkO5xHUt9NHMvT9ECDvdeg
uWHci7ZbFyp6v/dRvAUpucNkoDIkiLflhV7ZfANj6EE7y4nL0cpHZVlf/QpNwc04
7m1wpCuY/Rfhf812/ZcwX69nlNa07Pwr0tLn7AmWuVX0WnelCzTnPnU1ZwQp7GDy
1HwVMFzlZIfmzpQK1HBmHUyXk+Le5njSnUmU1lcYH8HRyPapNnaiPLkJTpxI5xe0
2Lc/xs2rimG7TTLk7OFqW0K6JAgcC8EYhg/jGfdXt68JQU3aUCCxVyTZphPu1iKR
RUDOe2PSjvpAlWQTic2U9jOQROvvg1ntroH68qKltmM3Gm0y+KCC1A==
=Bytu
-----END PGP SIGNATURE-----