Vyatta & Adtran IPSEC VPN Help

LeviDaily
LeviDaily used Ask the Experts™
on
I have a Vyatta instance running in Amazon EC2. I have an Adtran router at our office on our Comcast internet connection. I am wanting to create a site to site vpn with the two.

My Adtran router public IP is 173.12.191.XXX & internal is 192.168.0.1
My Vyatta (Amazon Elastic IP) is 50.18.193.XXX & eth0 ip is 10.243.175.10

I have the site to site VPN configured and am getting the IKE UP and IPSEC down. I am not too sure where to start. On the Vyatta when I run "show vpn debug peer 173.12.191.XXX tunnel 1" and am getting the below error


vyatta@VyattaAMI:~$ show vpn debug peer 173.12.191.XXX tunnel 1
000 "peer-173.12.191.XXX-tunnel-1": 10.243.175.0/24===10.243.175.10[10.243.175.10]...173.12.191.XXX[173.12.191.XXX]===192.168.0.0/24; unrouted; eroute owner: #0
000 "peer-173.12.191.XXX-tunnel-1":   ike_life: 28800s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0
000 "peer-173.12.191.XXX-tunnel-1":   policy: PSK+ENCRYPT+TUNNEL+UP; prio: 24,24; interface: eth0;
000 "peer-173.12.191.XXX-tunnel-1":   newest ISAKMP SA: #0; newest IPsec SA: #0;
000 #67: "peer-173.12.191.XXX-tunnel-1" STATE_MAIN_I3 (sent MI3, expecting MR3); EVENT_RETRANSMIT in 13s
000 #67: pending Phase 2 for "peer-173.12.191.XXX-tunnel-1" replacing #0


Not too sure where to start, but feel like I am close?? If anyone can let me know what I need to do, I will gladly do it.
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Sr Manager Cloud Networking Ops
Commented:
It has been quite some time since I worked with a Vyatta router to get a VPN tunnel up, but it seems that you are not getting a response from the Vyatta. "keyingtries" are 0, "ISAKMP SA" and "IPsec SA" are 0. So it's as if your Adtran sent an ISAKMP request and is simply waiting for a response . . . that it doesn't get.

Looks like you are using preshared keys . . . so if the PSK matches and the policy matches on both ends, then I would be checking simple connectivity.

Good luck,
Steve
Turns out it was on the Adtran side. I had to add the public IP address of the router as the ID of the vyatta.

Author

Commented:
I had to figure it out. I do appreciate the additional help.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial