Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 22 replies
  • Subscribers 1 subscriber
  • Views 7836 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Asg7 - fvg318

andersjj
Trying to get a site to site VPN working with ASG7 at the "home office" and FVG318 at the "branch office".

Using AES-128 PFS...tried to match up all the settings on the FVG318...keep getting the following log which ends in "No phase 2 handle"

here's the netgear log

2009-02-20 : INFO:  accept a request to establish IKE-SA: astaro.domain.com
2009-02-20 : INFO:  remote configuration for identifier "astaro.domain.com" found
2009-02-20 : INFO:  Initiating new phase 1 negotiation: branch_ip[500]homeoffice_ip[500]
2009-02-20 : INFO:  Beginning Identity Protection mode.
2009-02-20 : INFO:  Received unknown Vendor ID
2009-02-20 : INFO:  Received unknown Vendor ID
2009-02-20 : INFO:  Received unknown Vendor ID
2009-02-20 : INFO:  Received unknown Vendor ID
2009-02-20 : INFO:  ISAKMP-SA established for branch_ip[500]-homeoffice_ip[500] with spi:a775074169fe97d1:01b0e6014a326da2
2009-02-20 : INFO:  Sending Informational Exchange: notify payload[INITIAL-CONTACT]
2009-02-20 : INFO:  Initiating new phase 2 negotiation: branch_ip[500]homeoffice_ip[0]
2009-02-20 : ERROR:  Unknown notify message from homeoffice_ip[500].No phase2 handle found.


asg7 key line seems to be

pluto[14149]: "S_myfirst ipsec_0"[8] xx.xx.xx.xx #12: cannot respond to IPsec SA request because no connection is known for xx.xx.xx.0/24===xx.xx.xx.xx...xx.xx.xx.xx

Do I have the source and dest IP's reversed or something?  Any help would be great...thanks...hopefully it's something simple I didn't enter in ASG7 config...


This thread was automatically locked due to age.
  • 0 in reply to andersjj
    No, still not working.  I'm wondering if my ISP might be blocking something that would allow the inital connection, but perhaps would not be allowing any communication after the connection is made?

    is that even possible a possible scenario?  Perhaps I should look for a more "wide open" connection somewhere to try to the "branch office" router with?


    Possible, but unlikely. If anything, the ISP would block the ports altogether.

    Barry
  • 0 in reply to BAlfson
    I've reached the limit of my understanding in reading the IPSec log.  I didn't see any obvious errors, but I don't know it well enough to understand the conversation.

    Maybe someone else would offer to look at the PF and IPSec VPN logs...  Rather than download an entire day of logs, just turn on the live logs for a minute or two.

    Cheers - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Cookie Information Banner