Guest User!

You are not Sophos Staff.

Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 4 replies
  • Answers 1 answer
  • Subscribers 25 subscribers
  • Views 984 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Problem site to site between Sophos XG V18 and Fritzbox 749 V7.21

Bernd Greiner1

Hallo,

 urgent help for VPN- Site to site connection between a fritzbox 7490 V7.21 and Sophos XG home V18.0.4. I cannot establish the VPN.

A short overview:

Config file of the Fritzbox:

enabled = yes;
editable = yes;
conn_type = conntype_out;
name = "Buttenhausen Plochingen";
boxuser_id = 0;
always_renew = no;
reject_not_encrypted = no;
dont_filter_netbios = no;
localip = 0.0.0.0;
local_virtualip = 0.0.0.0;
remoteip = 0.0.0.0;
remote_virtualip = 0.0.0.0;
remotehostname = "fw-greiner-pl01.myfirewall.co";
keepalive_ip = 192.168.0.1;
localid {
key_id = "$$$$3RIQ4SWQN4QTNDLGZMTISOESJ1VNTVMFUBRMRBYQD35ZPTL4CKMITRQKGV4LN33KD3ZMX5XYT6FHYAAA";
}
mode = phase1_mode_aggressive;
phase1ss = "all/all/all";
keytype = connkeytype_pre_shared;
key = "$$$$B4XPAPG6TY2MBP2A3NJPXELFK3AIR14URHLGOPM5EPTZJE23OZ1EENATV5EPKEOTYGUO6SYNL5BWUAAA";
cert_do_server_auth = no;
use_nat_t = yes;
use_xauth = no;
use_cfgmode = yes;
phase2localid {
ipnet {
ipaddr = 0.0.0.0;
mask = 0.0.0.0;
}
}
phase2remoteid {
ipnet {
ipaddr = 0.0.0.0;
mask = 0.0.0.0;
}
}
phase2ss = "esp-all-all/ah-none/comp-all/no-pfs";
accesslist = "permit ip any 192.168.w.w 255.255.252.0"

app_id = 0;



This thread was automatically locked due to age.
  • FormerMember
    0 FormerMember

    Hello ,

    Thank you for reaching out to Sophos Community.

    Are local and remote networks of the same subnet? If not please disable NAT from tunnel configuration.

    Also, request to share strongswan.log output by following the below steps.

    ==> Login to SSH > 5. Device Management > 3. Advanced Shell

    18.0.4 MR-4# tail -f /log/strongswan.log

    ==> Try to activate IPsec tunnel and share session output here or via PM.

  • 0 in reply to FormerMember

    Hello,

    the Nat is disable, otherwise I have to put the relationship between for the subnet.

     the log of the connection is as followed: 

    2021-03-23 19:58:42 08[NET] <189648> received packet: from 77.182.12.196[500] to 95.208.76.27[500] (720 bytes)

    2021-03-23 19:58:42 08[ENC] <189648> parsed AGGRESSIVE request 0 [ SA KE No ID V V V V V V ]

    2021-03-23 19:58:42 08[IKE] <189648> received XAuth vendor ID

    2021-03-23 19:58:42 08[IKE] <189648> received DPD vendor ID

    2021-03-23 19:58:42 08[IKE] <189648> received NAT-T (RFC 3947) vendor ID

    2021-03-23 19:58:42 08[IKE] <189648> received draft-ietf-ipsec-nat-t-ike-02\n vendor ID

    2021-03-23 19:58:42 08[IKE] <189648> received draft-ietf-ipsec-nat-t-ike-03 vendor ID

    2021-03-23 19:58:42 08[ENC] <189648> received unknown vendor ID: a2:22:6f:c3:64:50:0f:56:34:ff:77:db:3b:74:f4:1b

    2021-03-23 19:58:42 08[IKE] <189648> 77.182.12.196 is initiating a Aggressive Mode IKE_SA

    2021-03-23 19:58:42 08[IKE] <189648> Aggressive Mode PSK disabled for security reasons

    2021-03-23 19:58:42 08[ENC] <189648> generating INFORMATIONAL_V1 request 215035122 [ N(AUTH_FAILED) ]

    2021-03-23 19:58:42 08[NET] <189648> sending packet: from 95.208.76.27[500] to 77.182.12.196[500] (56 bytes)

    2021-03-23 19:58:42 32[NET] <VPNButtenhausen-1|189647> received packet: from 77.182.12.196[500] to 95.208.76.27[500] (56 bytes)

    2021-03-23 19:58:42 32[ENC] <VPNButtenhausen-1|189647> parsed INFORMATIONAL_V1 request 4032525331 [ N(INVAL_ID) ]

    2021-03-23 19:58:42 32[IKE] <VPNButtenhausen-1|189647> informational: received INVALID_ID_INFORMATION error notify

    2021-03-23 19:58:42 32[IKE] <VPNButtenhausen-1|189647> IKE_SA INVALID_ID_INFORMATION set_condition COND_START_OVER

    2021-03-23 19:58:42 32[IKE] <VPNButtenhausen-1|189647> ### destroy: 0x7fea8c001770

    2021-03-23 19:58:42 32[IKE] <VPNButtenhausen-1|189647> IKE_SA has_condition COND_START_OVER retry initiate in 60 sec

    2021-03-23 19:58:47 23[NET] <189649> received packet: from 77.182.12.196[500] to 95.208.76.27[500] (720 bytes)

    2021-03-23 19:58:47 23[ENC] <189649> parsed AGGRESSIVE request 0 [ SA KE No ID V V V V V V ]

    2021-03-23 19:58:47 23[IKE] <189649> received XAuth vendor ID

    2021-03-23 19:58:47 23[IKE] <189649> received DPD vendor ID

    2021-03-23 19:58:47 23[IKE] <189649> received NAT-T (RFC 3947) vendor ID

    2021-03-23 19:58:47 23[IKE] <189649> received draft-ietf-ipsec-nat-t-ike-02\n vendor ID

    2021-03-23 19:58:47 23[IKE] <189649> received draft-ietf-ipsec-nat-t-ike-03 vendor ID

    2021-03-23 19:58:47 23[ENC] <189649> received unknown vendor ID: a2:22:6f:c3:64:50:0f:56:34:ff:77:db:3b:74:f4:1b

    2021-03-23 19:58:47 23[IKE] <189649> 77.182.12.196 is initiating a Aggressive Mode IKE_SA

    2021-03-23 19:58:47 23[IKE] <189649> Aggressive Mode PSK disabled for security reasons

    2021-03-23 19:58:47 23[ENC] <189649> generating INFORMATIONAL_V1 request 2755937760 [ N(AUTH_FAILED) ]

    2021-03-23 19:58:47 23[NET] <189649> sending packet: from 95.208.76.27[500] to 77.182.12.196[500] (56 bytes)

    2021-03-23 19:58:52 30[NET] <189650> received packet: from 77.182.12.196[500] to 95.208.76.27[500] (720 bytes)

    2021-03-23 19:58:52 30[ENC] <189650> parsed AGGRESSIVE request 0 [ SA KE No ID V V V V V V ]

    2021-03-23 19:58:52 30[IKE] <189650> received XAuth vendor ID

    2021-03-23 19:58:52 30[IKE] <189650> received DPD vendor ID

    2021-03-23 19:58:52 30[IKE] <189650> received NAT-T (RFC 3947) vendor ID

    2021-03-23 19:58:52 30[IKE] <189650> received draft-ietf-ipsec-nat-t-ike-02\n vendor ID

    2021-03-23 19:58:52 30[IKE] <189650> received draft-ietf-ipsec-nat-t-ike-03 vendor ID

    2021-03-23 19:58:52 30[ENC] <189650> received unknown vendor ID: a2:22:6f:c3:64:50:0f:56:34:ff:77:db:3b:74:f4:1b

    2021-03-23 19:58:52 30[IKE] <189650> 77.182.12.196 is initiating a Aggressive Mode IKE_SA

    2021-03-23 19:58:52 30[IKE] <189650> Aggressive Mode PSK disabled for security reasons

    2021-03-23 19:58:52 30[ENC] <189650> generating INFORMATIONAL_V1 request 297490808 [ N(AUTH_FAILED) ]

    2021-03-23 19:58:52 30[NET] <189650> sending packet: from 95.208.76.27[500] to 77.182.12.196[500] (56 b

  • FormerMember
    0 FormerMember in reply to Bernd Greiner1

    Thank you for sharing the log events.

    2021-03-23 19:58:42 08[IKE] <189648> received NAT-T (RFC 3947) vendor ID
    2021-03-23 19:58:42 08[IKE] <189648> received draft-ietf-ipsec-nat-t-ike-02\n vendor ID
    2021-03-23 19:58:42 08[IKE] <189648> received draft-ietf-ipsec-nat-t-ike-03 vendor ID
    2021-03-23 19:58:42 08[ENC] <189648> received unknown vendor ID: a2:22:6f:c3:64:50:0f:56:34:ff:77:db:3b:74:f4:1b
    2021-03-23 19:58:42 08[IKE] <189648> 77.182.12.196 is initiating a Aggressive Mode IKE_SA
    2021-03-23 19:58:42 08[IKE] <189648> Aggressive Mode PSK disabled for security reasons
    2021-03-23 19:58:42 08[ENC] <189648> generating INFORMATIONAL_V1 request 215035122 [ N(AUTH_FAILED) ]
    2021-03-23 19:58:42 08[NET] <189648> sending packet: from 95.208.76.27[500] to 77.182.12.196[500] (56 bytes)
    2021-03-23 19:58:42 32[NET] <VPNButtenhausen-1|189647> received packet: from 77.182.12.196[500] to 95.208.76.27[500] (56 bytes)
    2021-03-23 19:58:42 32[ENC] <VPNButtenhausen-1|189647> parsed INFORMATIONAL_V1 request 4032525331 [ N(INVAL_ID) ]
    2021-03-23 19:58:42 32[IKE] <VPNButtenhausen-1|189647> informational: received INVALID_ID_INFORMATION error notify
    2021-03-23 19:58:42 32[IKE] <VPNButtenhausen-1|189647> IKE_SA INVALID_ID_INFORMATION set_condition COND_START_OVER
    2021-03-23 19:58:42 32[IKE] <VPNButtenhausen-1|189647> ### destroy: 0x7fea8c001770

    Events indicates that the responder does not accept the ID payloads sent by XG.

    ==> At Fritzbox end you just have set up local-id, not remote-id.

    Bernd Greiner1 said:
    localid {
    key_id = "$$$$3RIQ4SWQN4QTNDLGZMTISOESJ1VNTVMFUBRMRBYQD35ZPTL4CKMITRQKGV4LN33KD3ZMX5XYT6FHYAAA";
    }

    ==> I'd suggest changing it to fqdn or IP address

    ==> Apply same changes at XG end.

    ==> Also please confirm the pre-shared key.

    ==> In IPsec policy at XG end lease disable 'Pass data in compressed format' and 'SHA2 with 96-bit truncation'.

    You may refer to the links below for reference.

    https://community.sophos.com/xg-firewall/f/discussions/76424/site-to-site-connection-between-sophos-xg-and-fritzbox-no-ping

    https://blog.webernetz.net/fritzos-ab-06-23-ipsec-p2-proposals-erweitert/

    https://blog.webernetz.net/ipsec-site-to-site-vpn-fortigate-fritzbox/

  • 0 in reply to FormerMember

    Hello Yash, thanks for your input, now I have successfully setup the VPN connection and it'S running. It seems it was a problem with the fqdn and the other point the data compressed setup.  I place also the pre-shared key I modify too. hopefully  the VPN will be stable