This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

IPSEC VPN ID Question

Hello,

I am stuck on a issue which is probably very simple but cannot work it out [:S] Any help would be appreciated.

I am trying to set up a IPSEC Site2Site Tunnel allong the following setup:

(LocalNet:192.168.210.0/24)--(LocalAstaro WAN:192.168.0.105)--(LocalRouterWAN:81.222.205.125)
===Internet===
(HeadOfficeWAN:85.196.155.70)--(HeadOfficeNet:192.168.150.0/25)

So the local astaro is stuck behind a router which gives it the IP:192.168.0.105

Now I know that the solution to this is to enable NAT (Done)
and set the VPN ID at the local side to 81.222.205.125 and it should work.
As the Headoffice VPN is set to communicate to 81.222.205.125

The question is how to set the local VPN ID to 81.222.205.125???

I had thought this would be set in Remote Gateway -- VPN ID Type: IP Address -- VPN ID 81.222.205.125
but this seems to have no effect?

The tunnel that is displayed is:
SA: 192.168.210.0/24=192.168.0.105 85.196.155.70=192.168.150.0/24
VPN ID: 192.168.0.105
Error: No connection

Clearly the tunnel will not work until I am able to set the VPN ID: 81.222.205.125
but how????????? [:O]

Thanks

This thread was automatically locked due to age.

Parents

0 BAlfson over 15 years ago

Thanks, d12fk, for the detailed explanations - I don't think I'd ever internalized the importance of the IDs matching; I've always used certs with "Initiate connection" so I guess I've just been lucky!

Peter, the other downside of using a PSK in "Respond only" mode is that you can have only one such PSK per Astaro.  That means, the PSK for L2TP over IPsec would have to be identical.  Certainly not as secure as you would like!
New Information: It is now possible to do this in V8 and later, as d12fk notes below.  You have to select 'Enable probing of preshared keys' at the bottom of the 'Advanced' tab in 'IPsec'.

In any case, both RSA and X509 certs use asymmetric keys, and are a whole lot more secure than a PSK.  The advantage goes to X509 certs over RSA - you can revoke a certificate whereas you can't change the RSA key for just one site.

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 BAlfson over 15 years ago

Thanks, d12fk, for the detailed explanations - I don't think I'd ever internalized the importance of the IDs matching; I've always used certs with "Initiate connection" so I guess I've just been lucky!

Peter, the other downside of using a PSK in "Respond only" mode is that you can have only one such PSK per Astaro.  That means, the PSK for L2TP over IPsec would have to be identical.  Certainly not as secure as you would like!
New Information: It is now possible to do this in V8 and later, as d12fk notes below.  You have to select 'Enable probing of preshared keys' at the bottom of the 'Advanced' tab in 'IPsec'.

In any case, both RSA and X509 certs use asymmetric keys, and are a whole lot more secure than a PSK.  The advantage goes to X509 certs over RSA - you can revoke a certificate whereas you can't change the RSA key for just one site.

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 d12fk over 15 years ago in reply to BAlfson

Peter, the other downside of using a PSK in "Respond only" mode is that you can have only one such PSK per Astaro. That means, the PSK for L2TP over IPsec would have to be identical. Certainly not as secure as you would like!

That's only true for ASG V7. We added an option to allow multiple PSK for peers with unknown IP address in V8 (IPsec remote access, L2TP, IPsec respond only site-to-site). You can find it at the IPsec "Advanced" tab.
Cancel
Vote Up 0 Vote Down

Cancel