Solved

Failed VPN on Sonicwall to Cisco

Posted on 2014-02-10
7
3,770 Views
Last Modified: 2014-02-19
I am getting an error I have never seen before on my firewall. I'm trying to establish a tunnel from my Sonicwall NSA 3500 to a Cisco ASA. It establishes Phase 1 fine but then it tries and immediately fails to connect to Phase 2. The message I get is:
Deleting IPsec SA (Phase 2) and then "Incompatible with older firmware" in the notes. Both devices are on the latest general firmware releases so I'm not sure why I would be getting this error. These devices were linked at one point in the past but that connection was removed. Now they need to be connected again. I have several other tunnels working properly on my device at this time.

Please see attached file for specific log error.
sonicwall.jpg
0
Comment
Question by:Tarkisal
  • 4
  • 3
7 Comments
 
LVL 25

Expert Comment

by:Diverse IT
ID: 39848554
Hi Tarkisal,

Most likely a mismatch of SA lifetime. The IPSEC is hardwired to an SA lifetime of 28800 seconds.

Reset the Lifetime value for both Phase 1 & 2 , in the Proposals tab of the GroupVPN Policy, to 28800, and let me know if that resolves the issue.

Also, make sure Enable Keep Alive is checked in the Advanced tab.
0
 

Author Comment

by:Tarkisal
ID: 39848575
Thanks for the response. I changed the lifetime down to 3600 and reset the tunnel but I'm still getting that same error. The other party's device has a default of something higher - I think it's like 86400 seconds. I had tried setting mine to that number but the error remained.
0
 
LVL 25

Expert Comment

by:Diverse IT
ID: 39848584
Has anything changed regarding the proposals on either end? The Lifetimes should definitely match so make them match either at 86400 or 28800. Also, make sure Enable Keep Alive is checked in the Advanced tab.
0
Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

 

Author Comment

by:Tarkisal
ID: 39854557
The proposals are the same. I believe it may have something to do with a NAT setup on the remote client's side. When they give me the NAT address starting with 172.30 I can't access it and I get that error message listed above. However, when he gives me a direct number starting with 10.88 the tunnel shows as up and I don't get that error.
0
 
LVL 25

Expert Comment

by:Diverse IT
ID: 39859791
Are you listing the Default Gateway correctly in both tunnels?
0
 

Accepted Solution

by:
Tarkisal earned 0 total points
ID: 39859800
We finally figured out the problem. The configuration was wrong on the remote site. It turned out to be built in the wrong order which caused the issue. The admin had built the cryptomap first and the static NAT after and for whatever reason this caused the error. By reversing this process it connected normally. I still don't know what the original firmware error was from - perhaps it was because it saw a problem with the configuration?

In any case thanks to everyone for their help.
0
 

Author Closing Comment

by:Tarkisal
ID: 39869815
Though the responses I got were very helpful they did not touch on the right solution. This was most likely due to not enough information available.
0

Featured Post

Enterprise Mobility and BYOD For Dummies

Like “For Dummies” books, you can read this in whatever order you choose and learn about mobility and BYOD; and how to put a competitive mobile infrastructure in place. Developed for SMBs and large enterprises alike, you will find helpful use cases, planning, and implementation.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Macbook Sierra OS OpenVPN issue 13 85
Website Issue 10 78
VIRTUAL NETWORKING 3 64
ASA configuration 2 30
Envision that you are chipping away at another e-business site with a team of pundit developers and designers. Everything seems, by all accounts, to be going easily.
I recently attended Cisco Live! in Las Vegas, a conference that boasted over 28,000 techies in attendance, and a week of hands-on learning hosted by a solid partner with which Concerto goes to market.  Every year, Cisco displays cutting-edge technol…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

831 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question