Question

Remote Access Configuration

Asked by: primesolutions

I caanot seem to get my netscreen remote to make a connection.  It's like trying to connect to the CIA.  I followed instructions from articles, step-by-step instructions ... you name it I read it.  I do not understand this firewall and I need help.  The following is the message from the log viewer of Netscreen Remote:  (Following this is the log from the hardware)

5-20: 10:49:49.700
 5-20: 10:49:49.700 My Connections\Work - Initiating IKE Phase 1 (IP ADDR=1.1.1.1)
 5-20: 10:49:49.840 My Connections\Work - SENDING>>>> ISAKMP OAK AG (SA, KE, NON, ID, VID 6x)
 5-20: 10:50:05.041 My Connections\Work - message not received! Retransmitting!
 5-20: 10:50:05.041 My Connections\Work - SENDING>>>> ISAKMP OAK AG (Retransmission)
 5-20: 10:50:21.038 My Connections\Work - message not received! Retransmitting!
 5-20: 10:50:21.038 My Connections\Work - SENDING>>>> ISAKMP OAK AG (Retransmission)
 5-20: 10:50:37.019 My Connections\Work - message not received! Retransmitting!
 5-20: 10:50:37.019 My Connections\Work - SENDING>>>> ISAKMP OAK AG (Retransmission)
 5-20: 10:50:53.016 My Connections\Work - Exceeded 3 IKE SA negotiation attempts
 5-20: 10:51:46.344
 5-20: 10:51:46.344 My Connections\Work - Initiating IKE Phase 1 (IP ADDR=1.1.1.1)
 5-20: 10:51:46.500 My Connections\Work - SENDING>>>> ISAKMP OAK AG (SA, KE, NON, ID, VID 6x)
 5-20: 10:52:01.935 My Connections\Work - message not received! Retransmitting!
 5-20: 10:52:01.935 My Connections\Work - SENDING>>>> ISAKMP OAK AG (Retransmission)
 5-20: 10:52:17.916 My Connections\Work - message not received! Retransmitting!
 5-20: 10:52:17.916 My Connections\Work - SENDING>>>> ISAKMP OAK AG (Retransmission)
 5-20: 10:52:33.897 My Connections\Work - message not received! Retransmitting!
 5-20: 10:52:33.897 My Connections\Work - SENDING>>>> ISAKMP OAK AG (Retransmission)
 5-20: 10:52:49.878 My Connections\Work - Exceeded 3 IKE SA negotiation attempts
 5-20: 10:56:00.872
 5-20: 10:56:00.872 My Connections\Work - Initiating IKE Phase 1 (IP ADDR=1.1.1.1)
 5-20: 10:56:00.997 My Connections\Work - SENDING>>>> ISAKMP OAK AG (SA, KE, NON, ID, VID 6x)
 5-20: 10:56:16.650 My Connections\Work - message not received! Retransmitting!
 5-20: 10:56:16.650 My Connections\Work - SENDING>>>> ISAKMP OAK AG (Retransmission)
 5-20: 10:56:32.631 My Connections\Work - message not received! Retransmitting!
 5-20: 10:56:32.631 My Connections\Work - SENDING>>>> ISAKMP OAK AG (Retransmission)
 5-20: 10:56:48.612 My Connections\Work - message not received! Retransmitting!
 5-20: 10:56:48.612 My Connections\Work - SENDING>>>> ISAKMP OAK AG (Retransmission)
 5-20: 10:57:04.593 My Connections\Work - Exceeded 3 IKE SA negotiation attempts
 5-20: 10:58:25.545
 5-20: 10:58:25.545 My Connections\Work - Initiating IKE Phase 1 (IP ADDR=1.1.1.1)
 5-20: 10:58:25.779 My Connections\Work - SENDING>>>> ISAKMP OAK AG (SA, KE, NON, ID, VID 6x)
 5-20: 10:58:35.096 This is a GA version of NetScreen-Remote.
 5-20: 10:58:35.252 Filter table loaded (1 entries).


Here is the log from the Firewall hardware log:

2008-05-20 11:13:44 warn Admin user "netscreen" logged in for Web(http) management (port 80) from 206.47.254.242:2744
2008-05-20 10:49:53 notif No NTP server could be contacted.
2008-05-20 10:28:34 notif DNS has been refreshed.
2008-05-20 10:28:34 info DNS entries have been automatically refreshed.
2008-05-20 10:23:21 info IKE<10.10.20.105> Phase 1: Main mode negotiations have failed.
2008-05-20 10:23:21 info IKE<10.10.20.105> Phase 1: Cannot use a preshared key because the peer gateway <VPNDynamic> has a dynamic IP address and negotiations are in Main mode.
2008-05-20 10:23:21 info IKE<10.10.20.105> Phase 1: Responder starts MAIN mode negotiations.
2008-05-20 10:19:05 info System configuration saved by netscreen via web from host 206.47.254.242 to 206.47.254.242:80 by netscreen.
2008-05-20 10:18:35 info System configuration saved by netscreen via web from host 206.47.254.242 to 206.47.254.242:80 by netscreen.
2008-05-20 10:16:32 info System configuration saved by netscreen via web from host 206.47.254.242 to 206.47.254.242:80 by netscreen.
2008-05-20 10:16:32 notif VPN monitoring for VPN VPNHome has been disabled.
2008-05-20 10:16:32 notif VPN VPNHome with gateway VPNDynamic and P2 proposal nopfs-esp-aes128-sha has been added by netscreen via web from host 206.47.254.242 to 206.47.254.242:80.
2008-05-20 10:15:37 info System configuration saved by netscreen via web from host 206.47.254.242 to 206.47.254.242:80 by netscreen.
2008-05-20 10:15:37 notif Gateway VPNDynamic at 0.0.0.0 in main mode with ID email@email.ca has been added by netscreen via web from host 206.47.254.242 to 206.47.254.242:80.
2008-05-20 10:12:08 info System configuration saved by netscreen via web from host 206.47.254.242 to 206.47.254.242:80 by netscreen.
2008-05-20 10:12:08 notif VPN dialupvpn1 with gateway vpngateway1 and P2 proposal nopfs-esp-des-sha has been modified by netscreen via web from host 206.47.254.242 to 206.47.254.242:80.
2008-05-20 10:12:08 notif Gateway vpngateway1 at 0.0.0.0 in aggressive mode with ID [default peer id] has been modified by netscreen via web from host 206.47.254.242 to 206.47.254.242:80.
2008-05-20 09:58:03 warn Admin user "Admin" logged in for Web(http) management (port 80) from 206.47.254.242:1418
2008-05-20 09:54:38 info Rejected an IKE packet on bgroup0 from 10.10.20.105:500 to 10.10.20.1:500 with cookies f379aa31246304f9 and 0000000000000000 because an initial Phase 1 packet arrived from an unrecognized peer gateway.
2008-05-20 09:54:22 info Rejected an IKE packet on bgroup0 from 10.10.20.105:500 to 10.10.20.1:500 with cookies f379aa31246304f9 and 0000000000000000 because an initial Phase 1 packet arrived from an unrecognized peer gateway.


I folowed the step-by-step instructions to the letter.

This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.

Subscribe now for full access to Experts Exchange and get

Instant Access to this Solution

  • Plus...
  • 30 Day FREE access, no risk, no obligation
  • Collaborate with the world's top tech experts
  • Unlimited access to our exclusive solution database
  • Never be left without tech help again

Subscribe Now

Asked On
2008-05-20 at 08:10:19ID23417456
Tags

Netscreen Remote

,

Juniper Firewall SSG5

Topics

Enterprise Firewalls

,

Virtual Private Networking (VPN)

Participating Experts
1
Points
500
Comments
6

Trusted by hundreds of thousands everyday for fast, accurate and reliable tech support.

  • "The time we save is the biggest benefit of Experts Exchange to Warner Bros. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange." Mike Kapnisakis, Warner Bros.
  • "Our team likes having a resource that is more secure than just using Google and most experts using this service really know their stuff. It's nice to look here first versus using Google." Dayna Sellner, Lockheed Martin
  • "Anytime that I've been stumped with a problem, 9 out of 10 times Experts Exchange has either the accepted solution or an open discussion of the potential solution to the problem." Kenny Red, eBay Inc.

See what Experts Exchange can do for you.

Got a question?

We've got the answer.

Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.

Screenshot of Experts Exchange Knowledgebase

Need individual assistance?

Our experts are ready to help.

If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.

Screenshot of Experts Exchange Knowledgebase

Want to learn from the best?

Read articles from industry experts.

Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.

Screenshot of an Article

Working on a long term project?

Store your work and research.

Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.

Screenshot of Experts Exchange Knowledgebase

Access the answers to your technology questions today.

Subscribe Now

30-day free trial. Register in 60 seconds.

What Makes Experts Exchange Unique?

Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.

Trusted by the world's most respected brands.

image of each brand's logo

Faithfully serving IT professionals since 1996.

Experts Exchange Logo

Try it out and discover for yourself.

Subscribe Now

30-day free trial. Register in 60 seconds.

Related Solutions

  1. isakmp key - pix 501 s
    Hi all, Forgive my ignorance, i have been looking and reading about setting up site to site VPNS between multiple PIX 501s to a PIX 506E. How is the isakmp key generated that i see in the configs? (isakmp key ****** ) . Do i need to purchase a certificate from an authority t...
  2. PIX to PIX VPN - ISAKMP Failing
    I had a VPN running between two PIX 501 firewalls and yesterday for some unknown reason it simply stopped working. It appears as though ISAKMP is failing. I changed out the certs in early December and it has worked up until yesterday. I've also verified that the times on t...
  3. PIx  ISAKMP Configuration issues
    We are in the process of allowing a site to site connection for one vendow using a Pix 515E. We have a PIX 515 E on our site and configured the site to site vpn as we have in the past. Our vendor is unable to connect. Here is the router config and debug. We have verified the ...
  4. VPN Remote peer not responding
    I am using remote access VPN, i have tested from my home, my friends home its working fine. When a user tries to connect from my overseas office he is getting error remote peer not responding. Here is the debug output. Can u please help me. I am using DES-MD5 crypto_isakmp_p...
  5. Cisco VPN Connectivity Issues "DEL_REASON_PEER_N…
    I am having an issue getting some VPN clients to connect to the VPN concentrator and actually establish the connection. I am using the following: Cisco 3000 series VPN concentrator Cisco VPN Client Version 4.0 (REL) Authentication is done via PKI authentication (Entrust/Ente...
  6. Cisco PIX 501 cannot establish tunnel with peer - VPN P…
    I have a PIX 501 that was working great. The tunnel dropped and it will not reconnect to the peer. There have been no changes to this PIX or the remote PIX(peer). The error I am getting when I do a debug is: VPN Peer:ISAKMP: Peer Info for x.x.x.x/500 not found - peers:0. I...

Free Tech Articles

  1. WARNING: 5 Reasons why you should NEVER fix a computer for free.
    It is in our nature to love the puzzle. We are obsessed. The lot of us. We love puzzles. We love the challenge. We thrive on finding the answer. We hate disarray. It bothers us deep in our soul. W...
  2. SCCM OSD Basic troubleshooting
    SCCM 2007 OSD is a fantastic way to deploy operating systems, however, like most things SCCM issues can sometimes be difficult to resolve due to the sheer volume of logs to sift through and the dispe...
  3. Migrate Small Business Server 2003 to Exchange 2010 and Windows 2008 R2
    This guide is intended to provide step by step instructions on how to migrate from Small Business Server 2003 to Windows 2008 R2 with Exchange 2010. For this migration to work you will need the fo...
  4. Create a Win7 Gadget
    This article shows you how to create a simple "Gadget" -- a sort of mini-application supported by Windows 7 and Vista. Gadgets can be dropped anywhere on the desktop to provide instant information, ...
  5. Outlook continually prompting for username and password
    There have been a lot of questions recently regarding Outlook prompting for a username and password whilst using Exchange 2007. There are a few reasons why this would happen and I will try to cover t...
  6. Backup Exchange 2010 Information Store using Windows Backup
    There seems to be quite a lot of confusion around the ability to backup Exchange 2010 using the built in Windows Backup feature. This stems from the omission of this feature prior to Exchange 2007 s...

Cloud Class Webinars

  1. Avoiding Bugs in Microsoft Access
    Alison Balter takes and in-depth look at avoiding bugs in Access. In this webinar you will learn about using the immediate window to debug your applications, invoking the debugger, using breakpoints to troubleshoot, stepping through code, setting the next statement to execute, ...
  2. Top 10 Best New Features in Visio 2010
    Scott Helmers gives live demonstrations of the top 10 new features in Visio 2010. This webinar will teach you how to create compelling diagrams by adding shapes to the page with a single click, linking the shapes in a diagram to data in Excel (or SQL Server, or SharePoint), ...
  3. IT Consultant Business Secrets Revealed
    Michael Munger, Experts Exchange tech pro and IT consultant, pulls back the curtain on his very successful businesses and answers question on every IT consultant and business owner should know about. He shares secrets on what he did to solve the 5 most common problems in IT, ...
  4. Disaster Recovery and Business Continuity
    Quest CTO, Mike Billon, gives an overview of the steps involved in building a dunamic disaster recovery plan. Through case studies and an examination of software/hardware tooles for monitoring and testing, you'll gain a better understandin of where you are, where you want ...
  5. Organize Your Visio Diagrams with Containers and Lists
    Scott Helmers uses cross functional flowcharts, wireframe diagrams, data graphic legends and seating charts to teach you: how to ustilize all three new structured diagram components in Visio 2010, the best practices for organizeing shapes in previous version of Visio, how to organize ...
  6. How to Us Objects, Properties, Events and Methods in Microsoft Access
    Alison Dalter gives an in-depbth look at objects, properties, events and methods in Microsoft Access. In this webinar you will learn about using the object browser, referring to objects, working with properties and methods, working with object variables, understanding the ...

Join the Community

Give a Little. Get a Lot.

Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.

Join the Community

Answers

 

by: dpk_walPosted on 2008-05-21 at 00:38:49ID: 21612798

Ok, I see the problem upfront:

>>SENDING>>>> ISAKMP OAK AG (SA, KE, NON, ID, VID 6x)

>> <VPNDynamic> has a dynamic IP address and negotiations are in Main mode.

The remote clients always use aggressive mode because the remote cilent has DHCP or dynamic IP and main mode cannot be used; but on the firewall you have configured main mode; change this to aggressive mode and then observe the results.

Please implement and update.

I really appreciate you posting logs from both ends as it gives a quick insight as to what is happening.

Thank you.

 

by: primesolutionsPosted on 2008-05-21 at 10:15:06ID: 21617087

Juniper Log:

2008-05-21 11:56:26   system   warn  00519  Admin user "netscreen" logged in for Web(http) management (port 80) from 206.47.254.242:2275
2008-05-21 11:28:29   system   info  00536  IKE<206.47.254.242> Phase 1: Aborted negotiations because the time limit has elapsed. (0000/8460303)
2008-05-21 11:27:26   system   info  00536  IKE<206.47.254.242> Phase 1: Responder starts AGGRESSIVE mode negotiations.
2008-05-21 11:11:21   system   warn  00519  Admin user "n******n" logged in for Web(http) management (port 80) from 206.47.254.242:1992
2008-05-21 11:00:44   system   info  00767  System configuration saved by netscreen via web from host 10.10.20.105 to 10.10.20.1:80 by netscreen.
2008-05-21 11:00:44   system  notif  00017  VPN VPNHome with gateway VPNDynamic and P2 proposal nopfs-esp-aes128-sha has been modified by netscreen via web from host 10.10.20.105 to 10.10.20.1:80.
2008-05-21 11:00:44   system  notif  00017  Gateway VPNDynamic at 0.0.0.0 in main mode with ID markm@tsi-cn.ca has been modified by netscreen via web from host 10.10.20.105 to 10.10.20.1:80.
2008-05-21 10:58:12   system   warn  00519  Admin user "netscreen" logged in for Web(http) management (port 80) from 10.10.20.105:2016
2008-05-21 10:53:36   system  notif  00531  No NTP server could be contacted.
2008-05-21 10:28:17   system  notif  00029  DNS has been refreshed.
2008-05-21 10:28:17   system   info  00004  DNS entries have been automatically refreshed.
2008-05-21 10:25:46   system   info  00767  System configuration saved by netscreen via web from host 10.10.20.105 to 10.10.20.1:80 by netscreen.
2008-05-21 10:25:38   system   info  00767  System configuration saved by netscreen via web from host 10.10.20.105 to 10.10.20.1:80 by netscreen.
2008-05-21 10:25:29   system   info  00767  System configuration saved by netscreen via web from host 10.10.20.105 to 10.10.20.1:80 by netscreen.
2008-05-21 10:25:20   system   info  00767  System configuration saved by netscreen via web from host 10.10.20.105 to 10.10.20.1:80 by netscreen.
2008-05-21 10:18:08   system   warn  00519  Admin user "netscreen" logged in for Web(http) management (port 80) from 10.10.20.105:1861
2008-05-21 10:04:07   system   warn  00519  Admin user "netscreen" logged in for Web(http) management (port 80) from 10.10.20.105:1831
2008-05-21 08:08:37   system  notif  00564  Wireless station event: station 00164470975d is associated, SSID: TSICNAP1.
2008-05-21 08:08:36   system  notif  00564  Wireless station event: Station 00164470975d Open authentication passed, SSID: TSICNAP1.
2008-05-21 08:08:07   system  notif  00564  Wireless station event: station 001f3a29b455 is associated, SSID: TSICNAP1.
2008-05-21 08:08:07   system  notif  00564  Wireless station event: Station 001f3a29b455 Open authentication passed, SSID: TSICNAP1.
2008-05-21 07:45:45   system  notif  00564  Wireless station event: station 001c2639e343 is associated, SSID: TSICNAP1.
2008-05-21 07:45:45   system  notif  00564  Wireless station event: Station 001c2639e343 Open authentication passed, SSID: TSICNAP1.
2008-05-21 06:28:40   system  notif  00029  DNS has been refreshed.
2008-05-21 06:28:40   system   info  00004  DNS entries have been automatically refreshed.
2008-05-21 02:28:03   system  notif  00029  DNS has been refreshed.
2008-05-21 02:28:03   system   info  00004  DNS entries have been automatically refreshed.


Netscreen Remote Log:

 5-21: 11:56:02.778 My Connections\Work - message not received! Retransmitting!
 5-21: 11:56:02.778 My Connections\Work - SENDING>>>> ISAKMP OAK AG (Retransmission)
 5-21: 11:56:18.757 My Connections\Work - message not received! Retransmitting!
 5-21: 11:56:18.757 My Connections\Work - SENDING>>>> ISAKMP OAK AG (Retransmission)
 5-21: 11:56:34.736 My Connections\Work - message not received! Retransmitting!
 5-21: 11:56:34.736 My Connections\Work - SENDING>>>> ISAKMP OAK AG (Retransmission)
 5-21: 11:56:50.715 My Connections\Work - Exceeded 3 IKE SA negotiation attempts
 5-21: 11:57:06.866
 5-21: 11:57:06.866 My Connections\Work - Initiating IKE Phase 1 (IP ADDR=1.1.1.1)
 5-21: 11:57:07.007 My Connections\Work - SENDING>>>> ISAKMP OAK AG (SA, KE, NON, ID, VID 6x)
 5-21: 11:57:22.674 My Connections\Work - message not received! Retransmitting!
 5-21: 11:57:22.674 My Connections\Work - SENDING>>>> ISAKMP OAK AG (Retransmission)
 5-21: 11:57:24.843 My Connections\Work - Disconnecting IPSec SA
 5-21: 11:57:24.843 My Connections\Work - Disconnecting IKE SA negotiation
 5-21: 11:57:25.810
 5-21: 11:57:25.810 My Connections\Work - Initiating IKE Phase 1 (IP ADDR=1.1.1.1)
 5-21: 11:57:26.013 My Connections\Work - SENDING>>>> ISAKMP OAK AG (SA, KE, NON, ID, VID 6x)



OK ... I know there must be something simple I'm missing.  I changed the setting to AGGRESSIVE MODE as you said.  Something is still not right.  I know it's me doing something wrong here.  I included today's logs as well as screen shots of Netscreen Remote settings.

I will also try to get some shots of the Juniper Appliance settings as well.

 

by: dpk_walPosted on 2008-05-21 at 10:49:54ID: 21617365

I am sorry but the current log set does not have much details about VPN, the only log which is useful is below:

>> IKE<206.47.254.242> Phase 1: Responder starts AGGRESSIVE mode negotiations.

So, it appears that the device is also now configured to receive connections using aggressive mode in phase I; after that we do not have any more details.

The screenshots are fine for client configuration; I do not see any problem. Client logs are same as first post and do not give any information why the negotiations failed.

You can either attach screenshots of device configuration; or you can do:
get config
from device CLI and paste the output. Always remember to sanitize the screenshots, logs and get config output; DO NOT leave any hashed passwords either; always replace them; replace two octets of public IP with x.

Thank you.

 

by: primesolutionsPosted on 2008-06-05 at 13:16:20ID: 31459648

I found the problem in the phase 2 negotiations ... simple ... it was set for MAIN MODE.  Once set to aggressive ... it connected

 

by: dpk_walPosted on 2008-06-05 at 17:45:59ID: 21725349

Good to know that the problem is resolved,

Thank you.

 

by: primesolutionsPosted on 2008-06-06 at 10:42:36ID: 21731187

Yes, the issue plagued me for  a while ... it's always something simple.  Thanks for your help ... it was REALLY APPRECIATED!!!

20120131-EE-VQP-002

3 Ways to Join

30-Day Free Trial

The Experts

98% positive feedback on 31,087 answers since March 2000. angeliii is a Microsoft Most Valuable Professional for his work with MS SQL Server & Develoment.

He has also proven his knowledge of Visual Basic Programming, PHP Scripting and Oracle Databases.

The Experts

97% positive feedback on 10,752 answers since July 2000. lrmoore has more than 18 years experience in the networking industry.

The six-time Mircosoft MVPs specialties include firewalls, virtual private networking, and network management.

Testimonials

"...and excellent source for support... Kind of like having your very own IT dept." Electriciansnet

Testimonials

"I was apprehensive at signing up at first. However... it has already made my life as an IT administrator much easier." JaCrews

Testimonials

"WOW! You guys have great, active, and knowledgeable people on here." moore50

Business Clients

Business Clients

In the Press

"If you’ve got a question... Experts Exchange can supply an answer.”

In the Press

"...an invaluable aid for both IT professionals and those who require tech support."

In the Press

"where IT professionals provide quick answers on just about any topic"

Business Account Plans

Loading Advertisement...