For the Curious ...

If your company uses Cisco ASA firewall and allow remote access through it (Using Cisco VPN Client). Also, If your company uses 2FA (Two Factor Authentication), using RSA Secure ID and have given you a Soft token, they are now integrated, which means when you try to connect you are only prompted for the PIN of the RSA Token and not the entire Pass code (Look at the below, prompting for PIN and Not Pass code) Neat isn’t it ? But consider this, You are a consultant working for more than one company, and just two or more companies, one using the RSA, and the other NOT using it. Or both using RSA, but different How do you take care of that ? Cause, normally, it will pick one token and just blast away the pass-code with the pin you enter. Which means you can login to one company but not the others. This is a problem isn't it ? Fortunately for us, there is a solution You need to remember the following SDIUseHardwareToken ( Enables a connection entry to avoid using RSA soft token.)...

I ran into this issue where the Checkpoint R65 IPSec tunnel kept on dropping with Cisco ASA. I actually had faced an issue in the past like this and I thought it will be a good idea to document the solution. I had tough time digging up the solution which I used some time back. Fortunately I had a badly written OneNote document which came to my rescue. To troubleshoot the issue and to make sure you need the below solution here is what you need to do. Kernel Debug IKE Debug Both the above need to be done on the Checkpoint end (Honestly, debugging Cisco will give no results. Kernel Debug The Kernel debug is simple to execute. Make sure you execute this when the tunnel is down. Log into the enforcement module (The security gateway) and execute the below command fw ctl zdebug You may also choose to use other commands like fw ctl debug –buf 12288 Once you execute, it will start spitting out errors like vpn_ipsec_decrypt Reason: decryption failure: Could not get SAs from packet T...