September 6, 2008 09:10am pdt

Member Login

Hall of Fame

Yearly

1lrmoore 73,040
2batry_boy 64,460
3RobWill 23,050
4arnold 19,500
5dpk_wal 19,075
6Voltz-dk 14,920
7mkielar 12,500
8ebjers 12,130
9MrHusy 10,000
10Cyclops3... 8,900
11SteveH_UK 8,000
12mwecom... 7,985
13trinak96 7,865
14_jesper_ 7,375
15AugustTen 6,500
16PeteLong 5,975
17stuknhaw... 4,950
18keith_ala... 4,700
18from_exp 4,700
20rsivanandan 4,675
21robocat 4,250
22ahoffmann 4,000
222PiFL 4,000
22harbor235 4,000
22decoleur 4,000
22tfowles 4,000
22bkepford 4,000

	[x] Attachment Details

VPN RoadWarrior with Trustix enterprise firewall

Zones: IPSec Security Protocol, Virtual Private Networking (VPN)

Tags: ike, invalid_id_info, notify, roadwarrior, trustix

I Have a trouble with Roadwarrior VPN configurations between My Trustix enterprise firewall 4.7 and my Windows XP client. Here it is:

My roadwarrior XP pc
206.x.x.68 (it's my wan test)

My lan:
130.x.x.0 mask 255.255.255.0
my local gateway: 130.x.x.87

my wan gateway: 206.x.x.66 mask 255.255.255.248

On the server i've create a vpn roadwarrior host with the following settings:

Virtual ip: 130.x.x.50/32
our subnet: 130.x.x.0/24

on the NetScreen-Remote 10.7.2 build 12:

Connexion security: Secure

Remote party identity and adressing
ID Type: IP Address
130.x.x.50
Protocol: All
Use: Secure Gateway Tunnel (Check)
ID Type: Any, Gateway IP Address: 206.x.x.66

I chose to use my certificate
Disbled Virtual adapter
i specified my network card that uses the vpn

in phase 1
i let default settings: RSA sign, Triple DES, SHA-1, Diffie-Hellman Group 2
in phase 2
i let default settings: SA unspecified, no compress, Encap protocol, Encrypt Alg: Triple DES, Hash Alg: SHA-1, Encap: Tunnel

the log now:

6-15: 08:57:19.546 My Connections\hallecouture - Initiating IKE Phase 1 (IP ADDR=206.x.x.66)
6-15: 08:57:19.546 My Connections\hallecouture - SENDING>>>> ISAKMP OAK MM (SA, VID 2x)
6-15: 08:57:19.546 My Connections\hallecouture - RECEIVED<<< ISAKMP OAK MM (SA, VID 2x)
6-15: 08:57:19.953 My Connections\hallecouture - Peer supports Dead Peer Detection Version 1.0
6-15: 08:57:19.953 My Connections\hallecouture - Dead Peer Detection enabled
6-15: 08:57:20.000 My Connections\hallecouture - SENDING>>>> ISAKMP OAK MM (KE, NON, VID 4x)
6-15: 08:57:20.046 My Connections\hallecouture - RECEIVED<<< ISAKMP OAK MM (KE, NON, CERT_REQ)
6-15: 08:57:20.546 My Connections\hallecouture - Using auto-selected user certificate "hallefrro's CN=Hallecouture ID".
6-15: 08:57:20.609 My Connections\hallecouture - SENDING>>>> ISAKMP OAK MM *(ID, CERT, CERT_REQ 9x, SIG, NOTIFY:STATUS_REPLAY_STATUS, NOTIFY:STATUS_INITIAL_CONTACT)
6-15: 08:57:20.656 My Connections\hallecouture - RECEIVED<<< ISAKMP OAK MM *(ID, CERT, SIG)
6-15: 08:57:20.656 My Connections\hallecouture - Received certificate "hallefrro's CN=Hallecouture ID".
6-15: 08:57:20.703 My Connections\hallecouture - Established IKE SA
6-15: 08:57:20.703 My Connections\hallecouture - MY COOKIE 7 e0 f2 94 fd 22 2c fe
6-15: 08:57:20.703 My Connections\hallecouture - HIS COOKIE 43 25 4 88 ed 41 61 9
6-15: 08:57:20.750 My Connections\hallecouture - Initiating IKE Phase 2 with Client IDs (message id: 985BA5A2)
6-15: 08:57:20.750 My Connections\hallecouture - Initiator = IP ADDR=206.x.x.68, prot = 0 port = 0
6-15: 08:57:20.750 My Connections\hallecouture - Responder = IP ADDR=130.x.x.50, prot = 0 port = 0
6-15: 08:57:20.750 My Connections\hallecouture - SENDING>>>> ISAKMP OAK QM *(HASH, SA, NON, ID 2x)
6-15: 08:57:20.750 My Connections\hallecouture - RECEIVED<<< ISAKMP OAK INFO *(HASH, NOTIFY:INVALID_ID_INFO)
6-15: 08:57:20.750 My Connections\hallecouture - Discarding SA negotiation
6-15: 08:57:20.765 My Connections\hallecouture - Deleting IKE SA (IP ADDR=206.x.x.66)
6-15: 08:57:20.765 My Connections\hallecouture - MY COOKIE 7 e0 f2 94 fd 22 2c fe
6-15: 08:57:20.765 My Connections\hallecouture - HIS COOKIE 43 25 4 88 ed 41 61 9

Why this is not connecting????

Start your free trial to view this solution

[x]

The Solution Rating System

With so many solutions, how can you tell which solutions are most likely to help you and which ones are not? To provide you with a tool to use, we rate our solutions based on various elements that most accurately determine if a solution is a quality solution. To explain what factors affect the solution rating, here are the elements we take into consideration when formulating our solution rating.

The Grade of the Solution
The Zone Rank of the Expert Providing the Solution
The Number of Author and Expert Comments
The Number of Experts Contributing
The Feedback of the Community

Your Input Matters
Because of the way the system is set up, the most important variable in this equation is you. As a member of Experts Exchange, you are able to cast your vote on the quality of the solutions in regard to how complete, accurate, helpful and easy to understand each solution is. When you provide your feedback, each rating is adjusted accordingly. So, if you see a solution that has a poor rating that you think is a good solution, let us know by rating it. As you do, the rating will be adjusted and will become more accurate for other members of our site.

If you have any suggestions that you would like to make for our rating system, please ask a question in the Suggestions Zone of Community Support.

Thank you!

6.4

Question Stats

Zone: Networking

Question Asked By: dalton1976

Solution Provided By: Qlemo

Participating Experts: 1

Solution Grade: C

Translate:

Loading Advertisement...

20080723-EE-VQP-34