This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Roadwarrior

If i create a Roadwarrior accsess to my ASL 4.0
(PSK, AES_PFS)
i can connect and everything works fine!
If i add a second PSK to identify a other User, ASL don't let me connect (both connections doesn't work!)
When i create a second Roadwarrior connection with 1 PSK for each user, i have the same thing! --> Very strange!!

Is there anyone that use this configuration?
1 Roadwarrior connection with more then 1 PSK, X509.... for identification?

Thanks for help

This thread was automatically locked due to age.

0 cyclops over 21 years ago

afaik this setup isn't working. You should consider to autrhenticate your roadwarriors with X.509 certificates.

Greeetings
cyclops
Cancel
Vote Up 0 Vote Down

Cancel
0 medic over 21 years ago in reply to cyclops

Yes, i tried to authenticate with x509 Cert -> same thing there!!
Cancel
Vote Up 0 Vote Down

Cancel
0 cyclops over 21 years ago in reply to medic

uupps I have overlooked that you have tried it alreday, sorry. ASL is designed to serve (in theorie) an unlimited number of simultaneous roadwarriors - provide some debug information Logfiles->IPSEC...

Greetings
cyclops
Cancel
Vote Up 0 Vote Down

Cancel
0 medic over 21 years ago in reply to cyclops

yeahh
thats what i mean ( in theory)
But ist there anyone that actualy use this option??
Cancel
Vote Up 0 Vote Down

Cancel
0 LoosInt over 21 years ago in reply to medic

yes we use this option.
and it works fine.

asl has problems with different users using psk (dynamic ips).
but with x509 it works.

Greetings
Thomas
Cancel
Vote Up 0 Vote Down

Cancel
0 medic over 21 years ago in reply to LoosInt

Thanks for your answer!
Did you have defined only one Roadwarrior connection and added any Users (Cert.) to this connection?
Cancel
Vote Up 0 Vote Down

Cancel
0 LoosInt over 21 years ago in reply to medic

no i defined for every roadwarrior a seperate connection with a own certificate.

Tom
Cancel
Vote Up 0 Vote Down

Cancel
0 medic over 21 years ago in reply to LoosInt

OK
but make this sense?

it sould also work with one definition and many users!
I mean, this is for me the basic difference between Roadwarrior and standard connection!

Have you expirience with this?
Cancel
Vote Up 0 Vote Down

Cancel
0 LoosInt over 21 years ago in reply to medic

for me it makes sense.
of course you can create one connection and assign many users to it.
For me the the advantages with my conifg are:
- different policies for each connection
- different subnet-access for each connection
- seperate enabling/disabling a user (disabling/enabling user "a" affects not user "b")
- filter-rules for user "a" may be different from those for user "b"

Greetings
Tom
Cancel
Vote Up 0 Vote Down

Cancel
0 medic over 21 years ago in reply to LoosInt

I'm sorry
my post should no attack your ASL settings!
If you have different policies, the only way is to create
a new connection - OK!

Many thanks for your answer and time!

Medic
Cancel
Vote Up 0 Vote Down

Cancel