Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have two servers:

  1. Checkpoint Safe@Office 500 with ip x.x.x.x and local network a.a.a.a/24
  2. Cisco ASA5505 with ip y.y.y.y and local network b.b.b.b/28

Before setting up a vpn I was able to ping y.y.y.y from any machine on a.a.a.a/24.

My issue is that after setting up a vpn between the 2 servers in question I'm no longer able to ping y.y.y.y from a.a.a.a/24. Does anyone know why this might be?

My guess is that a ping to y.y.y.y is needlessly being routed through the vpn tunnel but I'm not sure how to prevent that from happening. Also, if it is going through the vpn then why doesn't the vpn allow it.. a clue to this might be in the asa5505 logs which state:

Group = x.x.x.x, IP = x.x.x.x, Rejecting IPSec tunnel: no matching crypto map entry for remote proxy a.a.a.a/ local proxy y.y.y.y/ on interface Outside

Once again my issue is that I'm incapable of interpreting this error.

share|improve this question
up vote 1 down vote accepted

If this is a lan to lan vpn with a topology something like this:

               x.x.x.x                y.y.y.y

You are unable to ping the ASA when the VPN is up because Check Point firewalls include themselves in the local encryption domain whilst ASA does not.

The easiest solution would be to add the ASA's external address to it's local encryption domain, so the crypto acl on the ASA should be something along the lines of:

access-list asa-checkpoint-vpn_acl permit ip host y.y.y.y host x.x.x.x
access-list asa-checkpoint-vpn_acl permit ip host y.y.y.y a.a.a.a
access-list asa-checkpoint-vpn_acl permit ip host b.b.b.b a.a.a.a
share|improve this answer

In the case of a client vpn the vpn client is instructed to send all traffic through the VPN by default, ie anything on a network that isn't directly connected. Your routing table is ignored. You'll need to enable split tunneling on the ASA if you don't want all traffic to be sent down the VPN tunnel when you are connected.

Cisco split tunneling howto

share|improve this answer
Hi, thanks for your reply. The VPN is site-site rather than client, does this matter? – James Sep 15 '11 at 14:58
Ah, I see. You can ignore what I said about split tunneling then, that only applies to a client vpn. edit Serverfault won't let me put any kind of formatting in this comment - I'll write another answer! – paulos Sep 16 '11 at 8:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.