Can an ASG work if it's setup as the DMZ host behind a NAT? We recently dropped our T-1 service here at home when Comcast finally made service available. The ASG was working fine when it had a real public IP on the WAN. I'm no unable to connect any of the Macs or iPhones that used to be able to connect so easily. The log files look like this when i attempts to connect the iPhone:
2010:06:10-11:35:08 athonia pluto[5494]: packet from 166.205.139.26:20586: received Vendor ID payload [RFC 3947]
2010:06:10-11:35:08 athonia pluto[5494]: packet from 166.205.139.26:20586: ignoring Vendor ID payload [4df37928e9fc4fd1b3262170d515c662]
2010:06:10-11:35:08 athonia pluto[5494]: packet from 166.205.139.26:20586: ignoring Vendor ID payload [8f8d83826d246b6fc7a8a6a428c11de8]
2010:06:10-11:35:08 athonia pluto[5494]: packet from 166.205.139.26:20586: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]
2010:06:10-11:35:08 athonia pluto[5494]: packet from 166.205.139.26:20586: received Vendor ID payload [Dead Peer Detection]
2010:06:10-11:35:08 athonia pluto[5494]: "S_REF_eSrvCYGWEh"[17] 166.205.139.26:20586 #32: responding to Main Mode from unknown peer 166.205.139.26:20586
2010:06:10-11:35:09 athonia pluto[5494]: "S_REF_eSrvCYGWEh"[17] 166.205.139.26:20586 #32: NAT-Traversal: Result using RFC 3947: both are NATed
2010:06:10-11:35:09 athonia pluto[5494]: "S_REF_eSrvCYGWEh"[17] 166.205.139.26:20586 #32: Peer ID is ID_IPV4_ADDR: '10.112.204.36'
2010:06:10-11:35:09 athonia pluto[5494]: "S_REF_eSrvCYGWEh"[18] 166.205.139.26:20586 #32: deleting connection "S_REF_eSrvCYGWEh" instance with peer 166.205.139.26 {isakmp=#0/ipsec=#0}
2010:06:10-11:35:09 athonia pluto[5494]: | NAT-T: new mapping 166.205.139.26:20586/20610)
2010:06:10-11:35:09 athonia pluto[5494]: "S_REF_eSrvCYGWEh"[18] 166.205.139.26:20610 #32: sent MR3, ISAKMP SA established
2010:06:10-11:35:10 athonia pluto[5494]: "S_REF_eSrvCYGWEh"[18] 166.205.139.26:20610 #32: ignoring informational payload, type IPSEC_INITIAL_CONTACT
2010:06:10-11:35:11 athonia pluto[5494]: "S_REF_eSrvCYGWEh"[18] 166.205.139.26:20610 #32: cannot respond to IPsec SA request because no connection is known for 67.174.60.69/32===192.168.0.249:4500:17/1701...166.205.139.26:20610[10.112.204.36]:17/%any==={10.112.204.36/32}
2010:06:10-11:35:11 athonia pluto[5494]: "S_REF_eSrvCYGWEh"[18] 166.205.139.26:20610 #32: sending encrypted notification INVALID_ID_INFORMATION to 166.205.139.26:20610
2010:06:10-11:36:46 athonia pluto[5494]: "S_REF_eSrvCYGWEh"[22] 166.205.139.26:20610 #34: sent MR3, ISAKMP SA established
2010:06:10-11:36:46 athonia pluto[5494]: "S_REF_eSrvCYGWEh"[22] 166.205.139.26:20610 #34: ignoring informational payload, type IPSEC_INITIAL_CONTACT
2010:06:10-11:36:47 athonia pluto[5494]: "S_REF_eSrvCYGWEh"[22] 166.205.139.26:20610 #34: cannot respond to IPsec SA request because no connection is known for 67.174.60.69/32===192.168.0.249:4500:17/1701...166.205.139.26:20610[10.112.204.36]:17/%any==={10.112.204.36/32}
2010:06:10-11:36:47 athonia pluto[5494]: "S_REF_eSrvCYGWEh"[22] 166.205.139.26:20610 #34: sending encrypted notification INVALID_ID_INFORMATION to 166.205.139.26:20610
2010:06:10-11:36:50 athonia pluto[5494]: "S_REF_eSrvCYGWEh"[22] 166.205.139.26:20610 #34: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0xb50a8e86 (perhaps this is a duplicated packet)
2010:06:10-11:36:50 athonia pluto[5494]: "S_REF_eSrvCYGWEh"[22] 166.205.139.26:20610 #34: sending encrypted notification INVALID_MESSAGE_ID to 166.205.139.26:20610
2010:06:10-11:39:10 athonia pluto[5494]: packet from 166.205.139.26:25512: received Vendor ID payload [RFC 3947]
2010:06:10-11:39:10 athonia pluto[5494]: packet from 166.205.139.26:25512: ignoring Vendor ID payload [4df37928e9fc4fd1b3262170d515c662]
2010:06:10-11:39:10 athonia pluto[5494]: packet from 166.205.139.26:25512: ignoring Vendor ID payload [80d0bb3def54565ee84645d4c85ce3ee]
2010:06:10-11:39:10 athonia pluto[5494]: packet from 166.205.139.26:25512: ignoring Vendor ID payload [9909b64eed937c6573de52ace952fa6b]
2010:06:10-11:39:10 athonia pluto[5494]: packet from 166.205.139.26:25512: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03]
2010:06:10-11:39:10 athonia pluto[5494]: packet from 166.205.139.26:25512: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02]
2010:06:10-11:39:10 athonia pluto[5494]: packet from 166.205.139.26:25512: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]
2010:06:10-11:39:10 athonia pluto[5494]: packet from 166.205.139.26:25512: received Vendor ID payload [Dead Peer Detection]
2010:06:10-11:39:10 athonia pluto[5494]: "S_REF_eSrvCYGWEh"[23] 166.205.139.26:25512 #35: responding to Main Mode from unknown peer 166.205.139.26:25512
2010:06:10-11:39:10 athonia pluto[5494]: "S_REF_eSrvCYGWEh"[23] 166.205.139.26:25512 #35: NAT-Traversal: Result using RFC 3947: both are NATed
2010:06:10-11:39:10 athonia pluto[5494]: "S_REF_eSrvCYGWEh"[23] 166.205.139.26:25512 #35: Peer ID is ID_IPV4_ADDR: '10.112.204.36'
2010:06:10-11:39:10 athonia pluto[5494]: "S_REF_eSrvCYGWEh"[24] 166.205.139.26:25512 #35: deleting connection "S_REF_eSrvCYGWEh" instance with peer 166.205.139.26 {isakmp=#0/ipsec=#0}
2010:06:10-11:39:10 athonia pluto[5494]: | NAT-T: new mapping 166.205.139.26:25512/20610)
2010:06:10-11:39:10 athonia pluto[5494]: "S_REF_eSrvCYGWEh"[24] 166.205.139.26:20610 #35: sent MR3, ISAKMP SA established
2010:06:10-11:39:11 athonia pluto[5494]: "S_REF_eSrvCYGWEh"[24] 166.205.139.26:20610 #35: ignoring informational payload, type IPSEC_INITIAL_CONTACT
2010:06:10-11:39:12 athonia pluto[5494]: "S_REF_eSrvCYGWEh"[24] 166.205.139.26:20610 #35: cannot respond to IPsec SA request because no connection is known for 67.174.60.69/32===192.168.0.249:4500:17/1701...166.205.139.26:20610[10.112.204.36]:17/%any==={10.112.204.36/32}
2010:06:10-11:39:12 athonia pluto[5494]: "S_REF_eSrvCYGWEh"[24] 166.205.139.26:20610 #35: sending encrypted notification INVALID_ID_INFORMATION to 166.205.139.26:20610
2010:06:10-11:39:15 athonia pluto[5494]: "S_REF_eSrvCYGWEh"[24] 166.205.139.26:20610 #35: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0x3b9110da (perhaps this is a duplicated packet)
Any ideas?
Thank You!!
--Athonia
This thread was automatically locked due to age.