This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Linksys ipsec vpn

Help.

I have a Linksy BEvp41 V1 with firmware v 1.41.1
I have followed the guide at darkpaws web site setting this up but I get INVALID_ID_INFORMATION errors.  The Darkpaws doc is for v4.2X of Astaro, I'm running Verison 5.

Any ideas?    I have called Linksys multiple time and am going to try with olderver firmware.

Here is a piece of the logs.
2004:06:08-21:48:23 gate pluto[2151]: | Notify Message Type: INVALID_ID_INFORMATION
2004:06:08-21:48:23 gate pluto[2151]: | emitting 0 raw bytes of spi into ISAKMP Notification Payload
2004:06:08-21:48:23 gate pluto[2151]: | spi
2004:06:08-21:48:23 gate pluto[2151]: | emitting length of ISAKMP Notification Payload: 12
2004:06:08-21:48:23 gate pluto[2151]: | emitting length of ISAKMP Message: 60
2004:06:08-21:48:23 gate pluto[2151]: | state transition function for STATE_QUICK_R0 failed: INVALID_ID_INFORMATION
2004:06:08-21:48:23 gate pluto[2151]: | next event EVENT_SHUNT_SCAN in 1 seconds

This thread was automatically locked due to age.

Parents

0 alasc over 21 years ago

Ok,

did you define the remote private net on ASL? Did you define the official IP from remote site on ASL?

Can you post your VPN settings, please

Alex
Cancel
Vote Up 0 Vote Down

Cancel
0 regal99 over 21 years ago in reply to alasc

I defined the office network  as the 192.168.5.0/24 network and the remote network as 192.168.1.0/24.

Policy  settings.

   Name:    moris

   Key Exchange:    IKE


   ISAKMP (IKE) Settings

     IKE Mode:    Main Mode

     Encryption Algorithm: 3DES 168bit

     Authentication Algorithm:  MD5 160bit

     IKE DH Group: DH Group 2 (modp1024)

     SA Lifetime (secs): 3600


   IPSec Settings

     IPSec Mode:   Tunnel

     IPSec Protocol: ESP

     Encryption Algorithm:   3DES-CBC 168 bit

     Enforce Algorithms: off

     Authentication Algorithm:   MD5 160bit

     SA Lifetime (secs): 3600

     PFS:    PFS Group 2 (Modp1024)

     Compression:  Off

Connections Settings.
Name:    Morris

   Type:   Standard

   IPSec Policy:   moris

   Auto packet filter: off

   Strict Routing: off


   Endpoint Definition

     Local Endpoint: EXT

     Remote Endpoint:   >>Dynamic IP Address
Cancel
Vote Up 0 Vote Down

Cancel
0 alasc over 21 years ago in reply to regal99

Seems something going wrong!!

Hi. This is the qmail-send program at slsupport.de.
I'm afraid I wasn't able to deliver your message to the following addresses.
This is a permanent error; I've given up. Sorry it didn't work out.

:
209.228.4.169 does not like recipient.
Remote host said: 550 User unknown
Giving up on 209.228.4.169.

My email is alex@slsupport.de

Bye soon

Alex
Cancel
Vote Up 0 Vote Down

Cancel
0 regal99 over 21 years ago in reply to alasc

Good news. The remote office has access to my home. Now I need to figure out how to get it to go both directions.

Thanks to Alex for all his help.
Cancel
Vote Up 0 Vote Down

Cancel
0 alasc over 21 years ago in reply to regal99

Hi,

your rules 13&14 are correctly set. They allow al traffic from yor net to office AND all traffic from office to your net.

Is there something going wrong? Check Packetfilter Livelog if something doesn´t work.

Bye Alex
Cancel
Vote Up 0 Vote Down

Cancel
0 regal99 over 21 years ago in reply to alasc

I don't see any errors in the packet filter live log.

I can ping home from the office.   I can't ping office from home.

Rules are in place in the packet filter.   I don't think the linksys has any option to drop traffic

One more oddity,

From the astaro system itself I can ping anything on the 192.168.1.X net.   However I'm not sure that I'm suppose to be able to either.

Any ideas?
Cancel
Vote Up 0 Vote Down

Cancel
0 regal99 over 21 years ago in reply to regal99

When doing a traceroute I get this in the packet filter
192.168.5.1 TTL exceeded -> 192.168.5.250 ICMP 28 92 64 [SRC=192.168.5.250 DST=192.168.1.100 TOS=0x00 PREC=0x00 TTL=1 ID=37478 PROTO=ICMP TYPE=8 CODE=0 ID=512 SEQ=46414 ]
08:55:58 192.168.5.1 TTL exceeded -> 192.168.5.250 ICMP 28 92 64 [SRC=192.168.5.250 DST=192.168.1.100 TOS=0x00 PREC=0x00 TTL=1 ID=37914 PROTO=ICMP TYPE=8 CODE=0 ID=512 SEQ=46670 ]
08:56:03 192.168.5.1 TTL exceeded -> 192.168.5.250 ICMP 28 92 64 [SRC=192.168.5.250 DST=192.168.1.100 TOS=0x00 PREC=0x00 TTL=1 ID=37940 PROTO=ICMP TYPE=8 CODE=0 ID=512 SEQ=46926 ]
Cancel
Vote Up 0 Vote Down

Cancel
0 alasc over 21 years ago in reply to regal99

Hi,

I can´t remember that you allow traceroute forward.
You can allow it in webadmin under packetfilter->ICMP.

Do you ping a host behind the linksys or the linksys itself?
Maybe the linksys drips ICMP...

Please tell more about.

You know you can contact me otherwise [:)]

Bye Alex
Cancel
Vote Up 0 Vote Down

Cancel
0 regal99 over 21 years ago in reply to alasc

ICMP settings look good to me.
I can ping from the linksys network anything on Astaro side.
I can't ping from astaro side to Linksys network.
I also tried web pages and other servers, nothing I've tried worked.
Cancel
Vote Up 0 Vote Down

Cancel
0 alasc over 21 years ago in reply to regal99

Hi,

did your portscan show any news?

@all
Has anybody a linksys VPN running. Are there any rules etc to set?

Alex
Cancel
Vote Up 0 Vote Down

Cancel
0 alasc over 21 years ago in reply to alasc

Hi,

new idea... Install the lastest Firmware version. From linksys its the 1.41e.

Can you check this out.

Alex
Cancel
Vote Up 0 Vote Down

Cancel
0 paulba2k over 21 years ago in reply to alasc

Hi alasc,
The only rules that I have are:
Remote_Network = 192.168.5.0 Mask 255.255.255.0
Internal_Network = 192.168.1.0 Mask 255.255.255.0
Remote_Network to Internal_Network Allow Any
Internal_Network to Remote_Network Allow Any
and it works fine.
These rule will only affect ping if Ping is turned off ie if ping turned off then the rules are neccessary if ping is still on then the rules will only affect data

hope it helps

Paul
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 paulba2k over 21 years ago in reply to alasc

Hi alasc,
The only rules that I have are:
Remote_Network = 192.168.5.0 Mask 255.255.255.0
Internal_Network = 192.168.1.0 Mask 255.255.255.0
Remote_Network to Internal_Network Allow Any
Internal_Network to Remote_Network Allow Any
and it works fine.
These rule will only affect ping if Ping is turned off ie if ping turned off then the rules are neccessary if ping is still on then the rules will only affect data

hope it helps

Paul
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 alasc over 21 years ago in reply to paulba2k

Yes

he has these two rules set correctly. I mean rules on the linksys site. I´m no specialist in linksys , so I´m looking for someone who has that linksys running with VPN

Thanks a lot
Cancel
Vote Up 0 Vote Down

Cancel
0 paulba2k over 21 years ago in reply to alasc

There are no rules on the Linksys end, only the config options for IPSEC VPN which are the same as http://www.freeswan.ca/docs/BEFVP41/
this config works fine in ASL 4.02x so there must be something different about ver 5.
Cancel
Vote Up 0 Vote Down

Cancel
0 alasc over 21 years ago in reply to paulba2k

Hi,

sorry but cannot access the site. Error 500....
Maybe you have another link or can you send me the doc by email. Would be great...

Thank you...

Alex
Cancel
Vote Up 0 Vote Down

Cancel
0 regal99 over 21 years ago in reply to alasc

I have brought up a IPcop system an I am at the same point I was with the Linksys

I get the tunnel up. I can ping from the remote (linksys or ipcop side) to the Astaro. I can't pass traffic in the other direction. (Astaro side to office)
Cancel
Vote Up 0 Vote Down

Cancel