This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

stumped on VPN problem

Can somebody please tell me what is wrong with this? I am doing VPN using RSA between two sites running ASL 5.210.
Thanks for the help.

000 "S_BPI_VPN_0": 192.168.xxx.0/24===10.0.0.1...203.xxx.xxx.130===192.168.xxx.0/24
000 "S_BPI_VPN_0":   CAs: '%any'...'%any'
000 "S_BPI_VPN_0":   ike_life: 7800s; ipsec_life: 3600s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0
000 "S_BPI_VPN_0":   policy: RSASIG+ENCRYPT+TUNNEL+PFS; interface: eth1; unrouted
000 "S_BPI_VPN_0":   newest ISAKMP SA: #0; newest IPsec SA: #0; eroute owner: #0
000 "S_BPI_VPN_0":   IKE algorithms wanted: 5_000-1-5, flags=-strict
000 "S_BPI_VPN_0":   IKE algorithms found:  5_192-1_128-5,
000 "S_BPI_VPN_0":   ESP algorithms wanted: 12_128-1, ; pfsgroup=5; flags=-strict
000 "S_BPI_VPN_0":   ESP algorithms loaded: 12_128-1_128,
000
000 #2: "S_BPI_VPN_0" STATE_MAIN_I1 (sent MI1, expecting MR1); EVENT_RETRANSMIT in 8s
000

The other end is using a router that has a local address 10.0.0.1, which the router ranslates to the public static IP.

This thread was automatically locked due to age.

0 notoriousiroc over 19 years ago

Check that you are using the same policy at each site and that the settings in the policies are the same. Also, check your subnet definitions at each site and ensure they are correct.
Cancel
Vote Up 0 Vote Down

Cancel
0 Andreas Steffen over 19 years ago

Either the ASL on the other side does not receive IKE message MI1 or the
reply MR1 gets lost on the way back. Make sure that you use a static
NAT rule that maps 203.x.x.130:udp/500 to 10.0.0.1:udp/500.

Andreas
Cancel
Vote Up 0 Vote Down

Cancel