Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 5 replies
  • Subscribers 1 subscriber
  • Views 1705 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Vpn Asg7 - Asg6

Johannes Hiby
Hi,

i have a Site2Site vpn tunnel between ASL v7.001 and ASL v6.303 and it works fine
but the ASL7 shows:
Site2Site VPN is active with 0 of 1 online tunnels

the ASL6 shows the vpn tunnel correct.

any idea?

Johannes


This thread was automatically locked due to age.
  • 0
    Hi Johannes,

    I have same configuration (ASG V7.001 and ASG V6.303) but in my dashboard I see " Site2Site is active with 1 of 1 online tunnels ".

    Do you see on Site-to-Site VPN screen parameters for VPN tunnel ? 

    See attached file !

    Alda
  • 0 in reply to alda
    Hi,

    no i see only:

     Site-to-Site IPSec tunnel status  
     There is no IPSec Site-to-Site status information available 

    but the Tunnel works fine and is shown correcly on the ASL6.303
     
    I have tested it with x.509 Certificate and RSA KEY, every time the tunnel works fine
    but asl7 says:  Site-to-Site IPSec tunnel status  
     There is no IPSec Site-to-Site status information available 

    Johannes
  • 0 in reply to Johannes Hiby
    Johannes,

    Could you please send me the output of the following commands:

    chroot /var/chroot-ipsec /usr/local/sbin/ipsec whack --statusall

    ipsec_status.pl

    Thanks a lot,
    Stephan
  • 0 in reply to Stephan_Scholz
    Hi,

    this is the output form the ASL7.0001 (als.home.tld):
    the other side ist ASL 6.303 (gate.office.tld)

    asl:/home/login # chroot /var/chroot-ipsec /usr/local/sbin/ipsec whack --statusall
    000 interface ipsec0/eth1 192.168.99.254:4500
    000 interface ipsec0/eth1 192.168.99.254:500
    000 %myid = (none)
    000 debug none
    000
    000 "S_REF_rLHqtgfhxb_0": 192.168.23.0/24===192.168.99.254:4500[@asl.home.tld]...212.168.***.212:4500[@gate.office.tld]===10.2.120.0/24; erouted; eroute owner: #279
    000 "S_REF_rLHqtgfhxb_0":   CAs: 'C=de, L=SW, O=home, CN=home VPN CA, E=astaro@hiby.eu'...'C=de, ST=Bayern, L=Schweinfurt, O=Verwaltung, OU=-, CN=CA_office, E=jhiby@office.tld'
    000 "S_REF_rLHqtgfhxb_0":   ike_life: 7800s; ipsec_life: 3600s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0
    000 "S_REF_rLHqtgfhxb_0":   dpd_action: restart; dpd_delay: 30s; dpd_timeout: 120s;
    000 "S_REF_rLHqtgfhxb_0":   policy: RSASIG+ENCRYPT+TUNNEL+UP; prio: 24,24; interface: eth1;
    000 "S_REF_rLHqtgfhxb_0":   newest ISAKMP SA: #277; newest IPsec SA: #279;
    000 "S_REF_rLHqtgfhxb_0":   IKE algorithms wanted: 7_256-1-5,
    000 "S_REF_rLHqtgfhxb_0":   IKE algorithms found:  7_256-1_128-5,
    000 "S_REF_rLHqtgfhxb_0":   IKE algorithm newest: AES_CBC_256-MD5-MODP1536
    000 "S_REF_rLHqtgfhxb_0":   ESP algorithms wanted: 12_128-1,
    000 "S_REF_rLHqtgfhxb_0":   ESP algorithms loaded: 12_128-1_128,
    000 "S_REF_rLHqtgfhxb_0":   ESP algorithm newest: AES_128-HMAC_MD5; pfsgroup=
    000
    000 #279: "S_REF_rLHqtgfhxb_0" STATE_QUICK_I2 (sent QI2, IPsec SA established); EVENT_SA_REPLACE in 1886s; newest IPSEC; eroute owner; DPD active
    000 #279: "S_REF_rLHqtgfhxb_0" esp.24b39e07@212.168.***.212 esp.15989137@192.168.99.254; tunnel
    000 #278: "S_REF_rLHqtgfhxb_0" STATE_QUICK_I2 (sent QI2, IPsec SA established); EVENT_SA_EXPIRE in 10s; DPD active
    000 #278: "S_REF_rLHqtgfhxb_0" esp.24b39e03@212.168.***.212 esp.15989136@192.168.99.254; tunnel
    000 #277: "S_REF_rLHqtgfhxb_0" STATE_MAIN_I4 (ISAKMP SA established); EVENT_SA_REPLACE in 956s; newest ISAKMP;
     DPD active
    000
    asl:/home/login # ipsec_status.pl
    $VAR1 = {};                            


    Johannes
  • 0 in reply to Johannes Hiby
    Johannes,

    Thank you for reporting this bug. The fix is finished and will be released as Up2Date.

    Stephan
Cookie Information Banner