Name : ZyxelRG
Type : Initiate Connection
Gateway : (The host i define previously)
Auth type : Preshared key
VPN ID : IpAddress
Remote Networks : Any
I Create a New IPsec connection in the ASG menu
Name : ZyxelTEST
Remote Gateway : ZyxelRG
Local interface : (Public interface of my ASG 200)
Policy : AES-128
Local Networks : Any
Autopacket filtering is checked
On the Zywall, i create a new Remote gateway.
Name : Astaro
Interface : 192.168.0.253 (Ip of the interface behind the NAT router)
Preshared key : identical to the Astaro
Negotiationmode : Main
Encryption : AES128
Authentication : MD5
KeyGroup : DH5
Nat traversal Enabled (enabled on the ASg Too)
Dead peer detection enabled
create a VPN connection
Name : VPNDC
VPN Gateway : Public ip of the ASG200 (YYY.YYY.YYY.YYY)
Local Policy : 192.168.0.0/24
Remote policy : 172.16.0.0/24
Active Protocole : ESP
Encapsulation :Tunnel
Encryption : AES128
Authentication : MD5
Perfect Forward secrecy : DH5
When i try to establish a connection from the Zywall, here the log i can see in the Astaro.
2010:10:27-13:30:09 DC-ASG001 pluto[7124]: packet from ***.***.***.***:500: ignoring Vendor ID payload [f758f22668750f03b08df6ebe1d0]
2010:10:27-13:30:09 DC-ASG001 pluto[7124]: packet from ***.***.***.***:500: ignoring Vendor ID payload [draft-stenberg-ipsec-nat-traversal-01]
2010:10:27-13:30:09 DC-ASG001 pluto[7124]: packet from ***.***.***.***:500: ignoring Vendor ID payload [draft-stenberg-ipsec-nat-traversal-02]
2010:10:27-13:30:09 DC-ASG001 pluto[7124]: packet from ***.***.***.***:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-00]
2010:10:27-13:30:09 DC-ASG001 pluto[7124]: packet from ***.***.***.***:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02]
2010:10:27-13:30:09 DC-ASG001 pluto[7124]: packet from ***.***.***.***:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]
2010:10:27-13:30:09 DC-ASG001 pluto[7124]: packet from ***.***.***.***:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03]
2010:10:27-13:30:09 DC-ASG001 pluto[7124]: packet from ***.***.***.***:500: received Vendor ID payload [RFC 3947]
2010:10:27-13:30:09 DC-ASG001 pluto[7124]: packet from ***.***.***.***:500: received Vendor ID payload [Dead Peer Detection]
2010:10:27-13:30:09 DC-ASG001 pluto[7124]: "S_greenbow"[1] ***.***.***.***:4500 #13: responding to Main Mode from unknown peer ***.***.***.***:4500
2010:10:27-13:30:09 DC-ASG001 pluto[7124]: | NAT-T: new mapping ***.***.***.***:4500/500)
2010:10:27-13:30:11 DC-ASG001 pluto[7124]: "S_greenbow"[1] ***.***.***.*** #13: NAT-Traversal: Result using RFC 3947: peer is NATed
2010:10:27-13:30:12 DC-ASG001 pluto[7124]: "S_greenbow"[1] ***.***.***.*** #13: ignoring informational payload, type IPSEC_INITIAL_CONTACT
2010:10:27-13:30:12 DC-ASG001 pluto[7124]: "S_greenbow"[1] ***.***.***.*** #13: Peer ID is ID_IPV4_ADDR: '1.1.1.1'
2010:10:27-13:30:12 DC-ASG001 pluto[7124]: | NAT-T: new mapping ***.***.***.***:500/4500)
2010:10:27-13:30:12 DC-ASG001 pluto[7124]: "S_greenbow"[2] ***.***.***.***:4500 #13: sent MR3, ISAKMP SA established
2010:10:27-13:30:13 DC-ASG001 pluto[7124]: "S_greenbow"[2] ***.***.***.***:4500 #13: cannot respond to IPsec SA request because no connection is known for 172.16.0.0/24===YYY.YYY.YYY.YYY:4500[YYY.YYY.YYY.YYY]...***.***.***.***:4500[1.1.1.1]===192.168.0.0/24
2010:10:27-13:30:13 DC-ASG001 pluto[7124]: "S_greenbow"[2] ***.***.***.***:4500 #13: sending encrypted notification INVALID_ID_INFORMATION to ***.***.***.***:4500
i don't kow why it talk about a Greenbow connection that is a old removed entries.
I don't find what is missing in order to make it work.
Thanks you for your help.
Ced
This thread was automatically locked due to age.
