Hallo Leute,
bin neu hier und komme leider bei der Konfiguration meines Astaro VPNs nicht mehr weiter...Ich benutze die "Astaro Security Gateway Essential Firewall Edition", also die abgespeckte kostenlose Variante, die nur L2tp over IPSec unterstützt.
Mein Router ist eine Fritzbox 7570 hinter der einmal ein Webserver und zusätzlich um das externe Netz (DMZ) von meinem internen LAN zu trennen, eine Astaro mit 2 Netzwerkschnittstellen(eth0, eth1(WAN)). eth1 hängt also direkt an der Fritzbox.
Die Portweiterleitungen auf der Fritzbox müssten alle stimmen, da ich es mit den einzelnen Freigaben (UDP 1701,4500,500 sowie ESP) versucht habe, als auch mit "Exposed Host", dh, alle Ports werden an die Astaro weitergeleitet. Bei beiden Konfigurationen steht im Astaro IPSec Log folgendes:
2011:06:19-14:22:35 astaro pluto[6380]: packet from 80.187.97.38:500: received Vendor ID payload [RFC 3947]
2011:06:19-14:22:35 astaro pluto[6380]: packet from 80.187.97.38:500: ignoring Vendor ID payload [4df37928e9fc4fd1b3262170d515c662]
2011:06:19-14:22:35 astaro pluto[6380]: packet from 80.187.97.38:500: ignoring Vendor ID payload [8f8d83826d246b6fc7a8a6a428c11de8]
2011:06:19-14:22:35 astaro pluto[6380]: packet from 80.187.97.38:500: ignoring Vendor ID payload [439b59f8ba676c4c7737ae22eab8f582]
2011:06:19-14:22:35 astaro pluto[6380]: packet from 80.187.97.38:500: ignoring Vendor ID payload [4d1e0e136deafa34c4f3ea9f02ec7285]
2011:06:19-14:22:35 astaro pluto[6380]: packet from 80.187.97.38:500: ignoring Vendor ID payload [80d0bb3def54565ee84645d4c85ce3ee]
2011:06:19-14:22:35 astaro pluto[6380]: packet from 80.187.97.38:500: ignoring Vendor ID payload [9909b64eed937c6573de52ace952fa6b]
2011:06:19-14:22:35 astaro pluto[6380]: packet from 80.187.97.38:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03]
2011:06:19-14:22:35 astaro pluto[6380]: packet from 80.187.97.38:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02]
2011:06:19-14:22:35 astaro pluto[6380]: packet from 80.187.97.38:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]
2011:06:19-14:22:35 astaro pluto[6380]: packet from 80.187.97.38:500: received Vendor ID payload [Dead Peer Detection]
2011:06:19-14:22:35 astaro pluto[6380]: "S_REF_bQkRyNhxrL"[15] 80.187.97.38 #8: responding to Main Mode from unknown peer 80.187.97.38
2011:06:19-14:22:36 astaro pluto[6380]: "S_REF_bQkRyNhxrL"[15] 80.187.97.38 #8: NAT-Traversal: Result using RFC 3947: both are NATed
2011:06:19-14:22:36 astaro pluto[6380]: "S_REF_bQkRyNhxrL"[15] 80.187.97.38 #8: ignoring informational payload, type IPSEC_INITIAL_CONTACT
2011:06:19-14:22:36 astaro pluto[6380]: "S_REF_bQkRyNhxrL"[15] 80.187.97.38 #8: Peer ID is ID_IPV4_ADDR: '10.148.196.209'
2011:06:19-14:22:36 astaro pluto[6380]: "S_REF_bQkRyNhxrL"[16] 80.187.97.38 #8: deleting connection "S_REF_bQkRyNhxrL" instance with peer 80.187.97.38 {isakmp=#0/ipsec=#0}
2011:06:19-14:22:36 astaro pluto[6380]: | NAT-T: new mapping 80.187.97.38:500/11679)
2011:06:19-14:22:36 astaro pluto[6380]: "S_REF_bQkRyNhxrL"[16] 80.187.97.38:11679 #8: sent MR3, ISAKMP SA established
2011:06:19-14:22:37 astaro pluto[6380]: "S_REF_bQkRyNhxrL"[16] 80.187.97.38:11679 #8: cannot respond to IPsec SA request because no connection is known for 84.146.107.126/32===192.168.0.10:4500[192.168.0.10]:17/1701...80.187.97.38:11679[10.148.196.209]:17/%any==={10.148.196.209/32}
2011:06:19-14:22:37 astaro pluto[6380]: "S_REF_bQkRyNhxrL"[16] 80.187.97.38:11679 #8: sending encrypted notification INVALID_ID_INFORMATION to 80.187.97.38:11679
2011:06:19-14:22:41 astaro pluto[6380]: "S_REF_bQkRyNhxrL"[16] 80.187.97.38:11679 #8: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0x2b6f0ebd (perhaps this is a duplicated packet)
2011:06:19-14:22:41 astaro pluto[6380]: "S_REF_bQkRyNhxrL"[16] 80.187.97.38:11679 #8: sending encrypted notification INVALID_MESSAGE_ID to 80.187.97.38:11679
2011:06:19-14:22:44 astaro pluto[6380]: "S_REF_bQkRyNhxrL"[16] 80.187.97.38:11679 #8: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0x2b6f0ebd (perhaps this is a duplicated packet)
2011:06:19-14:22:44 astaro pluto[6380]: "S_REF_bQkRyNhxrL"[16] 80.187.97.38:11679 #8: sending encrypted notification INVALID_MESSAGE_ID to 80.187.97.38:11679
2011:06:19-14:22:46 astaro pluto[6380]: "S_REF_bQkRyNhxrL"[16] 80.187.97.38:11679 #8: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0x2b6f0ebd (perhaps this is a duplicated packet)
2011:06:19-14:22:46 astaro pluto[6380]: "S_REF_bQkRyNhxrL"[16] 80.187.97.38:11679 #8: sending encrypted notification INVALID_MESSAGE_ID to 80.187.97.38:11679
2011:06:19-14:22:50 astaro pluto[6380]: "S_REF_bQkRyNhxrL"[16] 80.187.97.38:11679 #8: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0x2b6f0ebd (perhaps this is a duplicated packet)
2011:06:19-14:22:50 astaro pluto[6380]: "S_REF_bQkRyNhxrL"[16] 80.187.97.38:11679 #8: sending encrypted notification INVALID_MESSAGE_ID to 80.187.97.38:11679
2011:06:19-14:22:53 astaro pluto[6380]: "S_REF_bQkRyNhxrL"[16] 80.187.97.38:11679 #8: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0x2b6f0ebd (perhaps this is a duplicated packet)
2011:06:19-14:22:53 astaro pluto[6380]: "S_REF_bQkRyNhxrL"[16] 80.187.97.38:11679 #8: sending encrypted notification INVALID_MESSAGE_ID to 80.187.97.38:11679
2011:06:19-14:22:56 astaro pluto[6380]: "S_REF_bQkRyNhxrL"[16] 80.187.97.38:11679 #8: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0x2b6f0ebd (perhaps this is a duplicated packet)
2011:06:19-14:22:56 astaro pluto[6380]: "S_REF_bQkRyNhxrL"[16] 80.187.97.38:11679 #8: sending encrypted notification INVALID_MESSAGE_ID to 80.187.97.38:11679
2011:06:19-14:22:59 astaro pluto[6380]: "S_REF_bQkRyNhxrL"[16] 80.187.97.38:11679 #8: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0x2b6f0ebd (perhaps this is a duplicated packet)
2011:06:19-14:22:59 astaro pluto[6380]: "S_REF_bQkRyNhxrL"[16] 80.187.97.38:11679 #8: sending encrypted notification INVALID_MESSAGE_ID to 80.187.97.38:11679
2011:06:19-14:23:01 astaro pluto[6380]: "S_REF_bQkRyNhxrL"[16] 80.187.97.38:11679 #8: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0x2b6f0ebd (perhaps this is a duplicated packet)
2011:06:19-14:23:01 astaro pluto[6380]: "S_REF_bQkRyNhxrL"[16] 80.187.97.38:11679 #8: sending encrypted notification INVALID_MESSAGE_ID to 80.187.97.38:11679
2011:06:19-14:23:05 astaro pluto[6380]: "S_REF_bQkRyNhxrL"[16] 80.187.97.38:11679 #8: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0x2b6f0ebd (perhaps this is a duplicated packet)
2011:06:19-14:23:05 astaro pluto[6380]: "S_REF_bQkRyNhxrL"[16] 80.187.97.38:11679 #8: sending encrypted notification INVALID_MESSAGE_ID to 80.187.97.38:11679
2011:06:19-14:23:08 astaro pluto[6380]: "S_REF_bQkRyNhxrL"[16] 80.187.97.38:11679 #8: received Delete SA payload: deleting ISAKMP State #8
2011:06:19-14:23:08 astaro pluto[6380]: "S_REF_bQkRyNhxrL"[16] 80.187.97.38:11679: deleting connection "S_REF_bQkRyNhxrL" instance with peer 80.187.97.38 {isakmp=#0/ipsec=#0}
2011:06:19-14:23:08 astaro pluto[6380]: ERROR: asynchronous network error report on eth1 for message to 80.187.97.38 port 11679, complainant 80.187.97.38: Connection refused [errno 111, origin ICMP type 3 code 3 (not authenticated)]
Vorallem der "cannot respond to IPsec SA" Part macht mir sorgen, was läuft hier falsch?
Ich habe einen VPN User angelegt, dieser darf laut Paketfilter in das interne Netz.
Das VPN selbst läuft nicht über Zertifikate sondern über Preshared Key, da ich es für mein iPhone etc so benötige...
Weis jemand einen Rat?
Schonmal danke in voraus!
Grüße
Daniel
edit: Die Fritzbox synct natürlich mit DynDNS, habe also keine Feste IP...
This thread was automatically locked due to age.
