Checkpoint R65 and Cisco ASA IPSec VPN Drop
I ran into this issue where the Checkpoint R65 IPSec tunnel kept on dropping with Cisco ASA. I actually had faced an issue in the past like this and I thought it will be a good idea to document the solution. I had tough time digging up the solution which I used some time back. Fortunately I had a badly written OneNote document which came to my rescue. To troubleshoot the issue and to make sure you need the below solution here is what you need to do. Kernel Debug IKE Debug Both the above need to be done on the Checkpoint end (Honestly, debugging Cisco will give no results. Kernel Debug The Kernel debug is simple to execute. Make sure you execute this when the tunnel is down. Log into the enforcement module (The security gateway) and execute the below command fw ctl zdebug You may also choose to use other commands like fw ctl debug –buf 12288 Once you execute, it will start spitting out errors like vpn_ipsec_decrypt Reason: decryption failure: Could not get SAs from packet T...