Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 10 replies
  • Subscribers 1 subscriber
  • Views 3847 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Help Needed IPSec Tunnel

PabloDiablo
Hi All,

I'm trying to setup an IPSec Tunnel between my Astaro and work (Juniper). I'm unable to setup a tunnel and with the following in the log:

my PC - Astaro === Juniper - PC

#6: responding to Main Mode
#6: NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike-02/03: no NAT detected
#6: ignoring informational payload, type IPSEC_INITIAL_CONTACT
#6: Peer ID is ID_IPV4_ADDR: 'Work external IP'
#6: Dead Peer Detection (RFC 3706) enabled
#6: sent MR3, ISAKMP SA established
#6: cannot respond to IPsec SA request because no connection is known for 0.0.0.0/0=== "my external IP"["my external IP"]..."Work external IP"[Work external IP"]===PC/32
#6: sending encrypted notification INVALID_ID_INFORMATION to "Work external IP":500 

I have 2 external interface and 1 with a astatic IP (my external IP). I also have Masquerading from LAN to Uplink interfaces and a rule LAN - any - any.
Also a Multipath Rule LAN - any - Second Interface.

The ruling of the other side only allows my PC IP, so I guess the problem is the 0.0.0.0/0 but I configured in:
Site-to-Site -> IPSec -> Connections -> "Local Networks" added here my PC...

Can anyone help to solve this isssue?

TIA


This thread was automatically locked due to age.
Parents
  • 0
    I think that manually entered static routes won't work for VPN traffic - that the traffic is already "in" or "out" of the tunnel before the manual routes are considered.

    Please show pictures of your 'IPsec Connection' and 'Remote Gateway' and confirm that you have NAT-T enabled on the 'Advanced' tab.

    Cheers - Bob
Reply
  • 0
    I think that manually entered static routes won't work for VPN traffic - that the traffic is already "in" or "out" of the tunnel before the manual routes are considered.

    Please show pictures of your 'IPsec Connection' and 'Remote Gateway' and confirm that you have NAT-T enabled on the 'Advanced' tab.

    Cheers - Bob
Children