July 24, 2008 09:11pm pdt

Member Login

Top Experts

Yearly

1RobWill 299,672
2batry_boy 233,234
3lrmoore 135,928
4arnold 115,903
5mwecom... 65,324
6dpk_wal 61,145
7mkielar 42,800
8ebjers 41,050
9MrHusy 39,470
10Voltz-dk 32,970
11Cyclops3... 32,340
12TechSoEasy 28,114
13keith_ala... 27,046
14trinak96 26,165
15Qlemo 23,933

null

	[x] Attachment Details

Netscreen Remote VPN - Problems during IKE Phase 2

Zone: Virtual Private Networking (VPN)

Tags: netscreen, vpn, phase

I have never setup a VPN connection using Auto IKE before and am having problems getting through Phase 2. The Error Message I am getting from the remote router is "Phase 2: No policy exists for the proxy ID received". Any suggestions, I am stumpped. Below is the log file from the Netscreen router and the Netscreen VPN client.

Netscreen 5GT (5.3.0r3.0) Event Log

2006-06-06 16:37:30      info      IKE<XXX.XXX.XXX.XXX> Phase 2 msg ID <eaaa0291>: Negotiations have failed.
2006-06-06 16:37:30      info      IKE<XXX.XXX.XXX.XXX> Phase 2: No policy exists for the proxy ID received: local ID (<YYY.YYY.YYY.YYY>/<255.255.255.255>, <0>, <0>) remote ID (<ZZZ.ZZZ.ZZZ.ZZZ>/<255.255.255.255>, <0>, <0>).
2006-06-06 16:37:30      info      Rejected an IKE packet on untrust from XXX.XXX.XXX.XXX:2066 to YYY.YYY.YYY.YYY:500 with cookies 96a3eea36737798c and 0294a2245c99b1eb because the VPN does not have an application SA configured.
2006-06-06 16:37:30      info      IKE<XXX.XXX.XXX.XXX> Phase 2: No policy exists for the proxy ID received: local ID (<YYY.YYY.YYY.YYY>/<255.255.255.255>, <0>, <0>) remote ID (<ZZZ.ZZZ.ZZZ.ZZZ>/<255.255.255.255>, <0>, <0>).
2006-06-06 16:37:30      info      IKE<XXX.XXX.XXX.XXX> Phase 2 msg ID <eaaa0291>: Responded to the peer's first message.
2006-06-06 16:37:30      info      IKE<XXX.XXX.XXX.XXX>: Received initial contact notification and removed Phase 1 SAs.
2006-06-06 16:37:30      info      IKE<XXX.XXX.XXX.XXX> Phase 1: Completed Aggressive mode negotiations with a <28800>-second lifetime.
2006-06-06 16:37:30      info      IKE<XXX.XXX.XXX.XXX> Phase 1: Completed for user <Stacey Bivins>.
2006-06-06 16:37:30      info      IKE<XXX.XXX.XXX.XXX>: Received initial contact notification and removed Phase 2 SAs.
2006-06-06 16:37:30      info      IKE<XXX.XXX.XXX.XXX>: Received a notification message for DOI <1> <24578> <INITIAL-CONTACT>.
2006-06-06 16:37:30      info      IKE<XXX.XXX.XXX.XXX>: Received a notification message for DOI <1> <24577> <REPLAY-STATUS>.
2006-06-06 16:37:29      info      IKE<XXX.XXX.XXX.XXX> Phase 1: Responder starts AGGRESSIVE mode negotiations.

Netscreen-Remote VPN Client Software 8.0

6-06: 16:38:49.380 My Connections\CLSGroup - Initiating IKE Phase 1 (IP ADDR=XXX.XXX.XXX.XXX)
6-06: 16:38:49.652 My Connections\CLSGroup - SENDING>>>> ISAKMP OAK AG (SA, KE, NON, ID, VID 6x)
6-06: 16:38:49.812 My Connections\CLSGroup - RECEIVED<<< ISAKMP OAK AG (SA, VID 3x, KE, NON, ID, HASH)
6-06: 16:38:49.812 My Connections\CLSGroup - Peer supports Dead Peer Detection Version 1.0
6-06: 16:38:49.812 My Connections\CLSGroup - Dead Peer Detection enabled
6-06: 16:38:49.933 My Connections\CLSGroup - SENDING>>>> ISAKMP OAK AG *(HASH, NOTIFY:STATUS_REPLAY_STATUS, NOTIFY:STATUS_INITIAL_CONTACT)
6-06: 16:38:49.933 My Connections\CLSGroup - Established IKE SA
6-06: 16:38:49.943 MY COOKIE 96 a3 ee a3 67 37 79 8c
6-06: 16:38:49.943 HIS COOKIE 2 94 a2 24 5c 99 b1 eb
6-06: 16:38:50.123
6-06: 16:38:50.123 My Connections\CLSGroup - Initiating IKE Phase 2 with Client IDs (message id: EAAA0291)
6-06: 16:38:50.123 My Connections\CLSGroup - Initiator = IP ADDR=ZZZ.ZZZ.ZZZ.ZZZ, prot = 0 port = 0
6-06: 16:38:50.123 My Connections\CLSGroup - Responder = IP ADDR=YYY.YYY.YYY.YYY, prot = 0 port = 0
6-06: 16:38:50.123 My Connections\CLSGroup - SENDING>>>> ISAKMP OAK QM *(HASH, SA, NON, KE, ID 2x)
6-06: 16:39:05.895 My Connections\CLSGroup - QM re-keying timed out. Retry count: 1
6-06: 16:39:05.895 My Connections\CLSGroup - SENDING>>>> ISAKMP OAK QM *(Retransmission)
6-06: 16:39:21.085 My Connections\CLSGroup - QM re-keying timed out. Retry count: 2
6-06: 16:39:21.085 My Connections\CLSGroup - SENDING>>>> ISAKMP OAK QM *(Retransmission)
6-06: 16:39:36.154 My Connections\CLSGroup - QM re-keying timed out. Retry count: 3
6-06: 16:39:36.154 My Connections\CLSGroup - SENDING>>>> ISAKMP OAK QM *(Retransmission)
6-06: 16:39:51.263 My Connections\CLSGroup - Exceeded 3 re-keying attempts (message id: EAAA0291)
6-06: 16:39:51.293 My Connections\CLSGroup - Disconnecting IKE SA negotiation
6-06: 16:39:51.304 My Connections\CLSGroup - Deleting IKE SA (IP ADDR=XXX.XXX.XXX.XXX)
6-06: 16:39:51.304 MY COOKIE 96 a3 ee a3 67 37 79 8c
6-06: 16:39:51.304 HIS COOKIE 2 94 a2 24 5c 99 b1 eb
6-06: 16:39:51.304 My Connections\CLSGroup - SENDING>>>> ISAKMP OAK INFO *(HASH, DEL)

XXX.XXX.XXX.XXX = Remote IP
YYY.YYY.YYY.YYY = My Public IP
ZZZ.ZZZ.ZZZ.ZZZ = My LAN IP

Terry

Start your free trial to view this solution

[x]

The Solution Rating System

With so many solutions, how can you tell which solutions are most likely to help you and which ones are not? To provide you with a tool to use, we rate our solutions based on various elements that most accurately determine if a solution is a quality solution. To explain what factors affect the solution rating, here are the elements we take into consideration when formulating our solution rating.

The Grade of the Solution
The Zone Rank of the Expert Providing the Solution
The Number of Author and Expert Comments
The Number of Experts Contributing
The Feedback of the Community

Your Input Matters
Because of the way the system is set up, the most important variable in this equation is you. As a member of Experts Exchange, you are able to cast your vote on the quality of the solutions in regard to how complete, accurate, helpful and easy to understand each solution is. When you provide your feedback, each rating is adjusted accordingly. So, if you see a solution that has a poor rating that you think is a good solution, let us know by rating it. As you do, the rating will be adjusted and will become more accurate for other members of our site.

If you have any suggestions that you would like to make for our rating system, please ask a question in the Suggestions Zone of Community Support.

Thank you!

7.8

Question Stats

Zone: Networking

Question Asked By: thepner

Solution Provided By: jabiii

Participating Experts: 1

Solution Grade: A

Translate:

Loading Advertisement...

20080723-EE-VQP-34