FireWall-1 FAQ: ISAKMP AddNegotiation: try to handle too many negotiations
Please note: This content was from when I was operating my FireWall-1 FAQ site, which I stopped operating in August 2005. For some reason people still have links to this stuff on the Internet that people are still clicking on.
I am making this information available again AS IS. Given how old this information is, it is likely wildly inaccurate. I have no plans to update this information.
If you're still running versions of Check Point VPN-1/FireWall-1 where this information is still relevant to you, do yourself a favor and upgrade to a more recent release. If you happen to be running a current release and the information is useful, it's by happenstance :)
FireWall-1 NG allows you to change the maximum number of IKE negotiations. If you know how, please let us know.
FireWall-1 4.0 and 4.1 can handle roughly 100 ISAKMP key negotiations at once (this limit can not currently be raised). A key negotiation occurs when a connection is first established from one host to another. If you see this message it means that FireWall-1 is handling this many key negotations. Connections that have this message associated with them in the log will fail.
FireWall-1 4.0 does not support subnet key negotiation, which means a key has to be exchanged for each host that communicates rather than for the entire subnet. This means FireWall-1 has to do far more key negotiations in 4.0 than in 4.1, which supports this.
If you can not upgrade to 4.1 (which is highly recommended if you use IKE), consider changing your encryption scheme to Manual IPSec or SKIP.
