The problem was that the incoming policy on the Netscreen would not allow me to use groups of addresses!!
This is the same with a majority of other VPN device since Netscreen use the IP 0.0.0.0 when a group is used (and 0 for a service group) and lot of others will negociate IKE for each member of an IP group individualy.
It would only work when I specified individual addresses which corresponded exactly to the outgoing on the Checkpoint.
Another time, the proxy id must always exactly match with peer gateway.
I got around this by using a subnet mask on an individual address (luckily all the addresses i wanted to allow in were sequential and inside one small network!)
There is another thing to ntoe with NG. There is some behavior that change during IKE negociation between 4.1 and NG. A working VPN config with 4.1 is not working in one direction after NG upgrade.
if someone here has checkpoint skills, he can help to understand the change.
