VPN: Site to Site and Remote Access VPN AND SENTINEL IKE PROBLEM

UTM Firewall requires membership for participation - click to join

Thread Info

State Not Answered
Locked Locked
Replies 4 replies
Subscribers 1 subscriber
Views 781 views
Users 0 members are here

Options

Suggested

This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

VPN AND SENTINEL IKE PROBLEM

ecservice over 22 years ago

I configured VPN - x509 to host dynamic
as in http://docs.astaro.org/older_versions/ASL-V3.2/docs_v3/vpn/X509_Host_to_Net_Dynamic.pdf
but when I establish a connection phase 1 is ok
in phase 2 Sentinel write IKE PHASE 2 EXCHANGING IPSEC PROPOSALS FAILED can you help me ? Thanks

This thread was automatically locked due to age.

0 Volker over 22 years ago

Have you adjusted all the different Values for the IKE Proposal ? You should use the same timeout values and encryption on both ends. Unfortunatly, the AES / DES Policies in the Astaro do not match the Values in the Sentinel Client.

So you need to add your own policy int the Astaro, to match the default values in the Sentinel Client or you have to adjust the values for each sentinel Installation.
Cancel
Vote Up 0 Vote Down

Cancel
0 tony_01 over 22 years ago in reply to Volker

I have the same timeout and encryption on the client and the ASL but im still getting the phase 2 error, any ideas what might be wrong?

Regards, Tony
Cancel
Vote Up 0 Vote Down

Cancel
0 Andreas Steffen over 22 years ago in reply to tony_01

Have you activated or de-activated "Perfect Forward Security" (PFS) on both sides? Are the subnet definitions the same on both sides?

Regards

Andreas
Cancel
Vote Up 0 Vote Down

Cancel
0 Simon Shaw over 22 years ago in reply to Andreas Steffen

I thought this was a virtual IP issue ? Assign a virtual IP to the client..
Cancel
Vote Up 0 Vote Down

Cancel