Hi,
My company has purchased a pair of 220s and I'd like to set up a certificate based VPN to take advantage of the dial-up failover feature of the ZyXEL routers but I cannot get the VPN to build using certificates, although it works fine when using a PSK.
Here's the procedure I followed:
Created a CSR on the router and saved it as a text file (the export options on the router do not match the import options on the 220 - The text file is PEM (Base 64) encoded format) - OK
Uploaded text file to 220 - OK
Generated CERT from CSR - OK
Imported CERT to router- OK
Changed the 220 setting "Authentication of remote Station(s) Key" to the X509 certificate generated from the CSR - OK
Changed ZyXEL Security protocol from PSK to the imported certificate -OK
But the VPN does not build - here is an example from the Astaro logfile:
2006:07:09-15:32:34 (none) pluto[17564]: "S_to__zyxel_0" #39: initiating Main Mode to replace #38
2006:07:09-15:32:35 (none) pluto[17564]: "S_to__zyxel_0" #39: ignoring unknown Vendor ID payload [625027749d5ab97f5616c1602765cf480a3b7d0b]
2006:07:09-15:32:35 (none) pluto[17564]: "S_to__zyxel_0" #39: transition from state STATE_MAIN_I1 to state STATE_MAIN_I2
2006:07:09-15:32:35 (none) pluto[17564]: "S_to__zyxel_0" #39: STATE_MAIN_I2: sent MI2, expecting MR2
2006:07:09-15:32:36 (none) pluto[17564]: "S_to__zyxel_0" #39: I am sending my cert
2006:07:09-15:32:36 (none) pluto[17564]: "S_to__zyxel_0" #39: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3
2006:07:09-15:32:36 (none) pluto[17564]: "S_to__zyxel_0" #39: STATE_MAIN_I3: sent MI3, expecting MR3
2006:07:09-15:32:36 (none) pluto[17564]: "S_to__zyxel_0" #39: next payload type of ISAKMP Hash Payload has an unknown value: 136
2006:07:09-15:32:36 (none) pluto[17564]: "S_to__zyxel_0" #39: malformed payload in packet
2006:07:09-15:32:36 (none) pluto[17564]: "S_to__zyxel_0" #39: sending notification PAYLOAD_MALFORMED to 88.96.109.206:500
2006:07:09-15:32:46 (none) pluto[17564]: "S_to__zyxel_0" #39: next payload type of ISAKMP Hash Payload has an unknown value: 153
2006:07:09-15:32:46 (none) pluto[17564]: "S_to__zyxel_0" #39: malformed payload in packet
2006:07:09-15:32:46 (none) pluto[17564]: "S_to__zyxel_0" #39: sending notification PAYLOAD_MALFORMED to 88.96.109.206:500
2006:07:09-15:33:06 (none) pluto[17564]: "S_to__zyxel_0" #39: next payload type of ISAKMP Hash Payload has an unknown value: 125
2006:07:09-15:33:06 (none) pluto[17564]: "S_to__zyxel_0" #39: malformed payload in packet
2006:07:09-15:33:06 (none) pluto[17564]: "S_to__zyxel_0" #39: sending notification PAYLOAD_MALFORMED to 88.96.109.206:500
2006:07:09-15:33:22 (none) pluto[17564]: pending Quick Mode with 88.96.109.206 "S_to__zyxel_0" took too long -- replacing phase 1
And from the ZyXEL:
1 07/10/2006 14:34:18 Send IKE
2 07/10/2006 14:34:18 ID type mismatch IKE
3 07/10/2006 14:34:18 Rule [1] Phase 1 ID mismatch IKE
4 07/10/2006 14:34:18 Recv IKE
5 07/10/2006 14:34:18 Send IKE
6 07/10/2006 14:34:17 Recv IKE
7 07/10/2006 14:34:17 Send IKE
8 07/10/2006 14:34:17 Recv IKE
9 07/10/2006 14:34:17 Recv Mode request from IKE
10 07/10/2006 14:34:17 Rule [1] Receiving IKE request IKE
Can anyone shed any light on what I'm doing wrong? Or at any documentation? I used the KB Net-to-Net VPN to ZyWall doc to create the PSK VPN.
Cheers,
Geoff
This thread was automatically locked due to age.
