See the findings.
Despite its humble beginnings, phishing has come a long way since those first crudely constructed emails. Today, phishing sites can appear and disappear in the length of a coffee break, and it takes more than a little know-how to keep your clients secure.
COURSE of the MONTH
8 days, 22 hours left to enrollBecome a Premium Member and unlock a new, free course in leading technologies each month.
Solved
Site to site VPN problem between Netgear FVG318 and Sonicwall TZ170
Posted on 2008-10-12
Hi, I am having problem to setup site to site VPN between a Netgear FVG318 box and Sonicwall TZ170.
I have followed the manuals of both appliances but failed all the time. I have also searched out a KB article of Sonicwall talking about the trick to setup VPN between Netgear FVS318 and Sonicwall box but that didnt fix my problem.
Any help would be much appreciated.
Please find following the details of my configuration and the error logs on both routers as well.
Please feel free to let me know if you need more information.
1. Settings on Sonicwall TZ170
Model: TZ 170 enhanced
Firmware version: SonicOS enhanced 3.1.0.11-30e
Basic network setting:
WAN IP: 60.x.x.147
LAN IP: 192.168.0.1/255.255.255.0
General VPN setting:
"NAT Traversal" disabled.
"IKE Dead Peer Detection" disabled.
"Enable Fragmented Packet Handling" enabled
Security Policy:
IPSec keying mode: IKE using preshared secret
Name: VPN-sonic
Ipsec Primary gateway name or address: 201.x.x.26
Ipsec Secondary gateway name or address: 0.0.0.0
Shared secret: 0123456789
Local IKE ID (optional):(I left it blank)
Peer IKE ID (optional): ( I left it blank)
Local network: 192.168.0.0/255.255.255.0
Remote network: 192.168.200.0/255.255.255.
IKE (Phase 1) Proposal:
Exchange: main mode
DH Group: group 2
Encryption: 3DES
Authentication: SHA1
Life time(seconds): 28800
Ipsec (phase 2) proposal
Protocol: ESP
Encryption: 3DES
Authentication: SHA1
DH group: group 2
Life time (seconds): 28800
Perfect Forward Secrecy: Enabled
Advanced settings:
Enable keep alive: enabled
2. Settings on Netgear FVG318 :
Model: I reckon this is a FVG318 V2 from the version of firmware
Firmware version: v2.1.2-67R
Basic network setting:
WAN IP: 201.x.x.26
LAN IP: 192.168.200.1
IKE Policy settings:
Direction type: both
Exchange mode: main
Local identifier type: local WAN IP
Local identifier: 201.x.x.26
Remote identifier type: remote WAN IP
Remote identifier: 60.x.x.147
IKE SA Parameters:
Encryption Algorithm: 3DES
Authentication Algorithm: SHA-1
Authentication method: Pre-shared key
Pre-shared Key: 0123456789
DH group: group 2
SA-lifetime (sec): 28800
VPN Policy:
Policy type: Auto policy
Remote endpoint: (IP address) 60.x.x.26
Local IP type: subnet
Local network: 192.168.200.0/255.255.255.
Remote IP type: subnet
Remote network: 192.168.0.0/255.255.255.0
Auto Policy Parameters:
SA lifetime 28800 seconds
Encryption Algorithm: 3DES
Intergirty Algorithm: SHA-1
PFS key group: DH group 2, enabled
3. VPN log on FVG318:
2008-10-13 : INFO: accept a request to establish IKE-SA: 60.x.x.26
2008-10-13 : INFO: Configuration found for 60.x.x.26.
2008-10-13 : INFO: Initiating new phase 1 negotiation: 201.x.x.147[500]<=>60.x.x.
2008-10-13 : INFO: Beginning Identity Protection mode.
2008-10-13 : ERROR: Invalid SA protocol type: 0
2008-10-13 : ERROR: Phase 2 negotiation failed due to time up waiting for phase1.
2008-10-13 : ERROR: Phase 1 negotiation failed due to time up for 60.x.x.26[500].
4.VPN log on TZ170
VPN IKE IKE Initiator: No response - remote party timeout
VPN IKE IKE Initiator: No response - remote party timeout
VPN IKE IKE Initiator: Start Main Mode negotiation (Phase 1)
VPN IKE IKE negotiation aborted due to timeout
I have followed the manuals of both appliances but failed all the time. I have also searched out a KB article of Sonicwall talking about the trick to setup VPN between Netgear FVS318 and Sonicwall box but that didnt fix my problem.
Any help would be much appreciated.
Please find following the details of my configuration and the error logs on both routers as well.
Please feel free to let me know if you need more information.
1. Settings on Sonicwall TZ170
Model: TZ 170 enhanced
Firmware version: SonicOS enhanced 3.1.0.11-30e
Basic network setting:
WAN IP: 60.x.x.147
LAN IP: 192.168.0.1/255.255.255.0
General VPN setting:
"NAT Traversal" disabled.
"IKE Dead Peer Detection" disabled.
"Enable Fragmented Packet Handling" enabled
Security Policy:
IPSec keying mode: IKE using preshared secret
Name: VPN-sonic
Ipsec Primary gateway name or address: 201.x.x.26
Ipsec Secondary gateway name or address: 0.0.0.0
Shared secret: 0123456789
Local IKE ID (optional):(I left it blank)
Peer IKE ID (optional): ( I left it blank)
Local network: 192.168.0.0/255.255.255.0
Remote network: 192.168.200.0/255.255.255.
IKE (Phase 1) Proposal:
Exchange: main mode
DH Group: group 2
Encryption: 3DES
Authentication: SHA1
Life time(seconds): 28800
Ipsec (phase 2) proposal
Protocol: ESP
Encryption: 3DES
Authentication: SHA1
DH group: group 2
Life time (seconds): 28800
Perfect Forward Secrecy: Enabled
Advanced settings:
Enable keep alive: enabled
2. Settings on Netgear FVG318 :
Model: I reckon this is a FVG318 V2 from the version of firmware
Firmware version: v2.1.2-67R
Basic network setting:
WAN IP: 201.x.x.26
LAN IP: 192.168.200.1
IKE Policy settings:
Direction type: both
Exchange mode: main
Local identifier type: local WAN IP
Local identifier: 201.x.x.26
Remote identifier type: remote WAN IP
Remote identifier: 60.x.x.147
IKE SA Parameters:
Encryption Algorithm: 3DES
Authentication Algorithm: SHA-1
Authentication method: Pre-shared key
Pre-shared Key: 0123456789
DH group: group 2
SA-lifetime (sec): 28800
VPN Policy:
Policy type: Auto policy
Remote endpoint: (IP address) 60.x.x.26
Local IP type: subnet
Local network: 192.168.200.0/255.255.255.
Remote IP type: subnet
Remote network: 192.168.0.0/255.255.255.0
Auto Policy Parameters:
SA lifetime 28800 seconds
Encryption Algorithm: 3DES
Intergirty Algorithm: SHA-1
PFS key group: DH group 2, enabled
3. VPN log on FVG318:
2008-10-13 : INFO: accept a request to establish IKE-SA: 60.x.x.26
2008-10-13 : INFO: Configuration found for 60.x.x.26.
2008-10-13 : INFO: Initiating new phase 1 negotiation: 201.x.x.147[500]<=>60.x.x.
2008-10-13 : INFO: Beginning Identity Protection mode.
2008-10-13 : ERROR: Invalid SA protocol type: 0
2008-10-13 : ERROR: Phase 2 negotiation failed due to time up waiting for phase1.
2008-10-13 : ERROR: Phase 1 negotiation failed due to time up for 60.x.x.26[500].
4.VPN log on TZ170
VPN IKE IKE Initiator: No response - remote party timeout
VPN IKE IKE Initiator: No response - remote party timeout
VPN IKE IKE Initiator: Start Main Mode negotiation (Phase 1)
VPN IKE IKE negotiation aborted due to timeout
[X]
Welcome to Experts Exchange
Add your voice to the tech community where 5M+ people just like you are talking about what matters.
- Help others & share knowledge
- Earn cash & points
- Learn & ask questions
-
4
3
9 Comments
1) make sure you have the latest firmware on both
2) make sure the public IPs are pingable.
3) It looks good from the config point, but it could be a minor item messing it up.
I hope this helps !
2) make sure the public IPs are pingable.
3) It looks good from the config point, but it could be a minor item messing it up.
I hope this helps !
Active 5 days ago
The logs you have posted indicate not even the phase I of the VPN negotiation is not going through.
This can possible mean mismatch of one of: pre-shared key; mode [main or aggressive]; incorrect public IP specification at one of the ends; hashing/authentication algorithm.
Further on sonicwall, you have:
>> Local IKE ID (optional):(I left it blank)
>> Peer IKE ID (optional): ( I left it blank)
For local IKE ID put the WAN IP of Sonicwall; for Peer put public IP of Netgear.
Please check and update.
Thank you.
This can possible mean mismatch of one of: pre-shared key; mode [main or aggressive]; incorrect public IP specification at one of the ends; hashing/authentication algorithm.
Further on sonicwall, you have:
>> Local IKE ID (optional):(I left it blank)
>> Peer IKE ID (optional): ( I left it blank)
For local IKE ID put the WAN IP of Sonicwall; for Peer put public IP of Netgear.
Please check and update.
Thank you.
Thanks lot for your reply.
Some more background:
The head office is using a static WAN IP which is 60.x.x.147. A ADSL modem is in front of the Sonicwall and it was configured as bridge mode.
The branch B is getting IP dynamicaly via PPPOE on the Netgear router, which is '201.x.x.26" at the moment. A cable modem is in front of the Netgear box. I am not able to access that modem but I think it was also configured as bridge mode because the Netgear is getting WAN IP via PPPOE directly.
To answer your questions:
Sysexpert:
The Sonicwall is pingable but not the Netgear one. I can remotely access Netgear box though.
Dpk wal:
I have done that before I posted the question but it didn't make any difference. So I just left it blank because they are "optional".
What warried me much is the error log on Netgear side: "ERROR: Invalid SA protocol type: 0" which indicates the mismatch of those things you mentioned. I have checked on both sites but could find any mismatch.
I am wondering if it's the dynamic IP problem on the Netgear side even though the IP address on Netgear has not been changed.
A question in my mind is: would it be possible that the VPN can detect the Netgear's IP type is dynamic?
Some more background:
The head office is using a static WAN IP which is 60.x.x.147. A ADSL modem is in front of the Sonicwall and it was configured as bridge mode.
The branch B is getting IP dynamicaly via PPPOE on the Netgear router, which is '201.x.x.26" at the moment. A cable modem is in front of the Netgear box. I am not able to access that modem but I think it was also configured as bridge mode because the Netgear is getting WAN IP via PPPOE directly.
To answer your questions:
Sysexpert:
The Sonicwall is pingable but not the Netgear one. I can remotely access Netgear box though.
Dpk wal:
I have done that before I posted the question but it didn't make any difference. So I just left it blank because they are "optional".
What warried me much is the error log on Netgear side: "ERROR: Invalid SA protocol type: 0" which indicates the mismatch of those things you mentioned. I have checked on both sites but could find any mismatch.
I am wondering if it's the dynamic IP problem on the Netgear side even though the IP address on Netgear has not been changed.
A question in my mind is: would it be possible that the VPN can detect the Netgear's IP type is dynamic?
The VPN is working now!
What I did is to change the WAN IP to FQDN name and the Netgear has been configured a ddns name so as to do this.
I'd like to assign the points to someone who can give some explanations on why it didn't work with IP address even if the IP didn't change on Netgear box. Because in my understanding, the dynamic IP can be treated as a static one as long as it keep the same.
Many thanks.
What I did is to change the WAN IP to FQDN name and the Netgear has been configured a ddns name so as to do this.
I'd like to assign the points to someone who can give some explanations on why it didn't work with IP address even if the IP didn't change on Netgear box. Because in my understanding, the dynamic IP can be treated as a static one as long as it keep the same.
Many thanks.
Active 5 days ago
As the IP address was dynamic; there is a possibility that the IP address changed between the time you configured the router and when the VPN tunnel was negotiated; as you have ddns this would mean that whatever the IP address it would always be reachable through the name.
Normally when you configure VPN with dynamic IP; the VPN would come up but would go down when the IP address changes,
Other than this I cannot think of any other reason.
Thank you.
Normally when you configure VPN with dynamic IP; the VPN would come up but would go down when the IP address changes,
Other than this I cannot think of any other reason.
Thank you.
Hi Dpk wal,
The IP address hasn't been changed on the Netgear box since after the configuration done as the modem has been running with no reboot since then.
The IP address hasn't been changed on the Netgear box since after the configuration done as the modem has been running with no reboot since then.
Featured Post
MSPs: Get the facts you need to protect your clients.
The 2017 Webroot Threat Report provides a uniquely insightful global view into the analysis and discoveries made by the Webroot® Threat Intelligence Platform to provide insights on key trends and risks as seen by our users.
Question has a verified solution.
If you are experiencing a similar issue, please ask a related question
Overview
Often, we set up VPN appliances where the connected clients are on a separate subnet and the company will have alternate internet connections and do not use this particular device as the gateway for certain servers or clients. In this case…
I recently attended Cisco Live! in Las Vegas, a conference that boasted over 28,000 techies in attendance, and a week of hands-on learning hosted by a solid partner with which Concerto goes to market. Every year, Cisco displays cutting-edge technol…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Suggested Courses
Course of the Month8 days, 22 hours left to enroll
764 members asked questions and received personalized solutions in the past 7 days.
Join the community of 500,000 technology professionals and ask your questions.