Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 7 replies
  • Subscribers 1 subscriber
  • Views 1900 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

VPN Net-to-Net ?!?!?

mdallagi
Hi,

I'm trying to establish a Net-to-Net VPN with IPSec with my 2 ASL boxes but this doesn't work.
My configuration is:
LAN_A---ASL---(NAT)Router---Internet---Router(NAT)---ASL---LAN_B
Each router is configured to forward all traffic to the ASL boxes.
ASL boxes have NAT-T activated.
Although that, VPN does not start!!

Someone Knows why?


This thread was automatically locked due to age.
  • 0 in reply to QVICIO
    Ok,

    ASL_A:

    000  
    000 "S_LAN__B_0": 192.168.20.0/24===192.168.1.2:4500...:4500===172.16.75.0/24
    000 "S_LAN__B_0":   CAs: '%any'...'%any'
    000 "S_LAN__B_0":   ike_life: 7800s; ipsec_life: 3600s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0
    000 "S_LAN__B_0":   policy: PSK+ENCRYPT+TUNNEL; interface: eth0; unrouted
    000 "S_LAN__B_0":   newest ISAKMP SA: #0; newest IPsec SA: #0; eroute owner: #0
    000 "S_LAN__B_0":   IKE algorithms wanted: 5_000-1-5, flags=-strict
    000 "S_LAN__B_0":   IKE algorithms found:  5_192-1_128-5, 
    000 "S_LAN__B_0":   ESP algorithms wanted: 12_128-1, flags=-strict
    000 "S_LAN__B_0":   ESP algorithms loaded: 12_128-1_128, 
    000  
    000 #1: "S_LAN__B_0"  STATE_MAIN_I3 (sent MI3, expecting MR3); EVENT_RETRANSMIT in 10s
    000

    ASL_B:

    000  
    000 "S_LAN__A_0": 172.16.75.0/24===192.168.100.20...===192.168.20.0/24
    000 "S_LAN__A_0":   CAs: '%any'...'%any'
    000 "S_LAN__A_0":   ike_life: 7800s; ipsec_life: 3600s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0
    000 "S_LAN__A_0":   policy: PSK+ENCRYPT+TUNNEL; interface: eth0; unrouted
    000 "S_LAN__A_0":   newest ISAKMP SA: #0; newest IPsec SA: #0; eroute owner: #0
    000 "S_LAN__A_0":   IKE algorithms wanted: 5_000-1-5, flags=-strict
    000 "S_LAN__A_0":   IKE algorithms found:  5_192-1_128-5, 
    000 "S_LAN__A_0":   ESP algorithms wanted: 12_128-1, flags=-strict
    000 "S_LAN__A_0":   ESP algorithms loaded: 12_128-1_128, 
    000  
    000 #1: "S_LAN__A_0"  STATE_MAIN_I1 (sent MI1, expecting MR1); EVENT_RETRANSMIT in 9s
    000
  • 0 in reply to mdallagi
    With tcpdump you see the packets of the other site in port 500 ?
  • 0 in reply to QVICIO
    These are the packet filter rules with counters.
    As you can see, there is not VPN traffic to side_B, while side_A accepts some packets...

    Packet filter rules side A:

    AUTO INPUT:
    0     0 ACCEPT     esp  --  *      *               192.168.1.2         esp spis:256:4294967295   
      1   168 ACCEPT     udp  --  *      *               192.168.1.2         udp spts:1:65535 dpt:500 
        1    92 ACCEPT     udp  --  *      *               192.168.1.2         udp spts:1024:65535 dpt:4500 

    AUTO OUTPUT:
        0     0 ACCEPT     esp  --  *      *       192.168.1.2                 esp spis:256:4294967295 
        0     0 ACCEPT     udp  --  *      *       192.168.1.2                 udp spt:500 dpts:1:65535 OWNER CMD match pluto 
        0     0 ACCEPT     udp  --  *      *       192.168.1.2                 udp spt:4500 dpts:1024:65535 OWNER CMD match pluto 

    Packet Filter rules side B:

    AUTO INPUT:
       0     0 ACCEPT     esp  --  *      *               192.168.100.20      esp spis:256:4294967295 
        0     0 ACCEPT     udp  --  *      *               192.168.100.20      udp spts:1:65535 dpt:500 
        0     0 ACCEPT     udp  --  *      *               192.168.100.20      udp spts:1024:65535 dpt:4500 

    AUTO OUTPUT:
       0     0 ACCEPT     esp  --  *      *       192.168.100.20              esp spis:256:4294967295 
        0     0 ACCEPT     udp  --  *      *       192.168.100.20              udp spt:500 dpts:1:65535 OWNER CMD match pluto 
        0     0 ACCEPT     udp  --  *      *       192.168.100.20              udp spt:4500 dpts:1024:65535 OWNER CMD match pluto
  • 0 in reply to mdallagi
    I solved my problem...
    Analyzing the content of ipsec.conf I have understood that for VPN Net-to-Net through NAT the IP address cannot be used as VPN-ID.
    So, it's possible with FQDN or email address.

    I hope that all this comes written in the official documentation!

    Bye.
  • 0 in reply to mdallagi
    yup, same in the past. ip-adress not work correctly!
  • 0 in reply to mdallagi
    yup, same in the past. ip-adress not work correctly!
Cookie Information Banner