PIX to Checkpoint VPN not completing phase 2 IKE

I can't get a a LAN-LAN VPN tom complete phase 2 IKE.

My side PIX 515E 6.1(2). Their side CheckPoint FW-1 NG FP3 firewall.

xxx.xxx.xxx.xxx = their public IP
yyy.yyy.yyy.yyy = my public IP

I've opened up isakmp on my outside from their network:
access-list 100 permit udp host xxx.xxx.xxx.xxx host yyy.yyy.yyy.yyy eq isakmp
access-list 100 permit esp host xxx.xxx.xxx.xxx host yyy.yyy.yyy.yyy

We've made sure the pre-shared key is correct on both ends.

There is a policy on their end that matches my highest priority policy:
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption 3des
isakmp policy 10 hash md5
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400  

I try to ping them and it looks like is completes phase 1 but phase 2 keeps re-trying. I don't see any obvious error in the PIX debug.

ISAKMP (0): beginning Main Mode exchange
crypto_isakmp_process_block: src xxx.xxx.xxx.xxx, dest yyy.yyy.yyy.yyy
OAK_MM exchange
ISAKMP (0): processing SA payload. message ID = 0
 
ISAKMP (0): Checking ISAKMP transform 1 against priority 10 policy
ISAKMP:      encryption 3DES-CBC
ISAKMP:      hash MD5
ISAKMP:      default group 2
ISAKMP:      auth pre-share
ISAKMP:      life type in seconds
ISAKMP:      life duration (VPI) of  0x0 0x1 0x51 0x80
ISAKMP (0): atts are acceptable. Next payload is 0
ISAKMP (0): SA is doing pre-shared key authentication using id type ID_IPV4_ADDR
return status is IKMP_NO_ERROR
crypto_isakmp_process_block: src xxx.xxx.xxx.xxx, dest yyy.yyy.yyy.yyy
OAK_MM exchange
ISAKMP (0): processing KE payload. message ID = 0
 
ISAKMP (0): processing NONCE payload. message ID = 0
 
ISAKMP (0): ID payload
        next-payload : 8
        type         : 1
        protocol     : 17
        port         : 500
        length       : 8
ISAKMP (0): Total payload length: 12
return status is IKMP_NO_ERROR
crypto_isakmp_process_block: src xxx.xxx.xxx.xxx, dest yyy.yyy.yyy.yyy
OAK_MM exchange
ISAKMP (0): processing ID payload. message ID = 0
ISAKMP (0): processing HASH payload. message ID = 0
ISAKMP (0): SA has been authenticated
 
ISAKMP: Created a peer node for xxx.xxx.xxx.xxx
ISAKMP (0:0): Need XAUTH
ISAKMP/xauth: request attribute XAUTH_TYPE
ISAKMP/xauth: request attribute XAUTH_USER_NAME
ISAKMP/xauth: request attribute XAUTH_USER_PASSWORD
ISAKMP (0:0): initiating peer config to xxx.xxx.xxx.xxx. ID = xxxxxxxxxx (zzzzzzzzzz
)modecfg: sa: qqqqqqqq, new mess id= pppppppp
 
return status is IKMP_NO_ERROR
ISAKMP (0): sending INITIAL_CONTACT notify
ISAKMP (0): sending NOTIFY message 24578 protocol 1
ISAKMP (0): retransmitting phase 2...IPSEC(key_engine): request timer fired: cou
nt = 1,
  (identity) local= yyy.yyy.yyy.yyy, remote= xxx.xxx.xxx.xxx,
    local_proxy= 172.21.1.0/255.255.255.0/0/0 (type=4),
    remote_proxy= 172.25.9.0/255.255.255.0/0/0 (type=4)
 
ISAKMP (0): retransmitting phase 2...
ISAKMP (0): retransmitting phase 2...IPSEC(key_engine): request timer fired: cou
nt = 2,
  (identity) local= yyy.yyy.yyy.yyy, remote= xxx.xxx.xxx.xxx,
    local_proxy= 172.21.1.0/255.255.255.0/0/0 (type=4),
    remote_proxy= 172.25.9.0/255.255.255.0/0/0 (type=4)
 
ISAKMP (0): retransmitting phase 2...



Start Free Trial