[Last Call] Learn how to a build a cloud-first strategyRegister Now


VPN tunnel from PIX to CheckPoint (Behind F5 BigIP)

Posted on 2007-07-23
Medium Priority
Last Modified: 2013-11-16
Is there a way to setup a VPN tunnel from a PIX to a Checkpoint Firewall (with its external interface running with a private IP address) behind a F5 BigIP that is NATing a Public IP address to the private IP address.  

When debuging I get the following error message:
crypto_isakmp_process_block:src:152.200.x.x, dest: 129.41.x.x spt:500 dpt:500
ISAKMP: reserved not zero on payload 5!
ISAKMP: malformed payload

Question by:CeLLuS

Expert Comment

ID: 19553270

Check the time and date of  both boxes (pix and checkpoint) , need to be  equal.

LVL 14

Expert Comment

ID: 19838576
According to Cisco, this means that the ISAKMP keys do not match. Rekey/reset in order to ensure accuracy.

Accepted Solution

CLoz earned 1500 total points
ID: 19944656
You will need to configure both ends for NAT Traversal (NAT-T). NAT traversal makes both parties NAT aware, encapsulating IPsec within a UDP wrapper on port 4500 and correcting TCP or UDP header checksums that would otherwise be invalidated by translation.

Make sure you're not using Authentication Header (AH).  AH includes integrity protection over the IP header.  This means that changing the destination IP address (for example, when a virtual server translates the destination address from the virtual server address to the end point address) will cause a connection to fail.

Featured Post

Exciting career futures for women in IT

Education has the power to transform lives and open the door to new career opportunities. By earning an IT degree from WGU, you can become a highly skilled IT professional. Get the credentials and certifications you need to become a leader in this rewarding field.  

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Powerful tools can do wonders, but only in the right hands.  Nowhere is this more obvious than with the cloud.
This article explains the fundamentals of industrial networking which ultimately is the backbone network which is providing communications for process devices like robots and other not so interesting stuff.
Windows 10 is mostly good. However the one thing that annoys me is how many clicks you have to do to dial a VPN connection. You have to go to settings from the start menu, (2 clicks), Network and Internet (1 click), Click VPN (another click) then fi…
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…
Suggested Courses
Course of the Month18 days, 9 hours left to enroll

825 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question