This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

IPSec site to site using SG 430 and Juniper SSG-5 as Remote Gateway problem

Hi,

Currently we have a ipsec site to site tunnel running from our main office(JuniperSSG320M) to our branch office(JuniperSSG-5).

We're planning to switch the Juniper router in our main office with Sophos SG-450. So i made a similar ipsec config from our ssg320m to the sophos device but unfortunately it won't connect or initiate.

Please see the logs below from Sophos Device:

2015:04:17-09:09:59 testdemo ipsec_starter[30582]: pluto stopped after 20 ms

2015:04:17-09:09:59 testdemo ipsec_starter[30582]: ipsec starter stopped

2015:04:17-09:10:02 testdemo ipsec_starter[31430]: Starting strongSwan 4.4.1git20100610 IPsec [starter]...

2015:04:17-09:10:02 testdemo ipsec_starter[31430]: no default route - cannot cope with %defaultroute!!!

2015:04:17-09:10:02 testdemo pluto[31442]: Starting IKEv1 pluto daemon (strongSwan 4.4.1git20100610) THREADS VENDORID CISCO_QUIRKS

2015:04:17-09:10:02 testdemo pluto[31442]: loaded plugins: curl ldap aes des blowfish serpent twofish sha1 sha2 md5 random x509 pubkey pkcs1 pgp dnskey pem sqlite hmac gmp xauth attr attr-sql resolve

2015:04:17-09:10:02 testdemo pluto[31442]: including NAT-Traversal patch (Version 0.6c)

2015:04:17-09:10:02 testdemo pluto[31442]: Using Linux 2.6 IPsec interface code

2015:04:17-09:10:02 testdemo ipsec_starter[31436]: pluto (31442) started after 20 ms

2015:04:17-09:10:02 testdemo pluto[31442]: loading ca certificates from '/etc/ipsec.d/cacerts'

2015:04:17-09:10:02 testdemo pluto[31442]: loaded ca certificate from '/etc/ipsec.d/cacerts/VPN Signing CA.pem'

2015:04:17-09:10:02 testdemo pluto[31442]: loading aa certificates from '/etc/ipsec.d/aacerts'

2015:04:17-09:10:02 testdemo pluto[31442]: loading ocsp certificates from '/etc/ipsec.d/ocspcerts'

2015:04:17-09:10:02 testdemo pluto[31442]: Changing to directory '/etc/ipsec.d/crls'

2015:04:17-09:10:02 testdemo pluto[31442]: loading attribute certificates from '/etc/ipsec.d/acerts'

2015:04:17-09:10:02 testdemo pluto[31442]: listening for IKE messages

2015:04:17-09:10:02 testdemo pluto[31442]: adding interface eth15/eth15 10.10.100.9:500

2015:04:17-09:10:02 testdemo pluto[31442]: adding interface eth15/eth15 10.10.100.9:4500

2015:04:17-09:10:02 testdemo pluto[31442]: adding interface eth12/eth12 204.174.99.111:500

2015:04:17-09:10:02 testdemo pluto[31442]: adding interface eth12/eth12 204.174.99.111:4500

2015:04:17-09:10:02 testdemo pluto[31442]: adding interface eth12/eth12 204.174.99.108:500

2015:04:17-09:10:02 testdemo pluto[31442]: adding interface eth12/eth12 204.174.99.108:4500

2015:04:17-09:10:02 testdemo pluto[31442]: adding interface eth12/eth12 204.174.99.107:500

2015:04:17-09:10:02 testdemo pluto[31442]: adding interface eth12/eth12 204.174.99.107:4500

2015:04:17-09:10:02 testdemo pluto[31442]: adding interface eth10/eth10 192.168.1.54:500

2015:04:17-09:10:02 testdemo pluto[31442]: adding interface eth10/eth10 192.168.1.54:4500

2015:04:17-09:10:02 testdemo pluto[31442]: adding interface eth9/eth9 204.178.195.60:500

2015:04:17-09:10:02 testdemo pluto[31442]: adding interface eth9/eth9 204.178.195.60:4500

2015:04:17-09:10:02 testdemo pluto[31442]: adding interface eth9/eth9 204.178.195.59:500

2015:04:17-09:10:02 testdemo pluto[31442]: adding interface eth9/eth9 204.178.195.59:4500

2015:04:17-09:10:02 testdemo pluto[31442]: adding interface eth9/eth9 204.178.195.58:500

2015:04:17-09:10:02 testdemo pluto[31442]: adding interface eth9/eth9 204.178.195.58:4500

2015:04:17-09:10:02 testdemo pluto[31442]: adding interface lo/lo 127.0.0.1:500

2015:04:17-09:10:02 testdemo pluto[31442]: adding interface lo/lo 127.0.0.1:4500

2015:04:17-09:10:02 testdemo pluto[31442]: adding interface lo/lo ::1:500

2015:04:17-09:10:02 testdemo pluto[31442]: loading secrets from "/etc/ipsec.secrets"

2015:04:17-09:10:02 testdemo pluto[31442]: loaded PSK secret for 10.10.100.9 10.10.101.9

2015:04:17-09:10:02 testdemo pluto[31442]: added connection description "S_TESTNZ IPSEC"

2015:04:17-09:10:02 davaomx pluto[31442]: "S_TESTNZ IPSEC" #1: initiating Main Mode

It just get stucked in initiating Main Mode

Please see logs below from our Remote Gateway Juniper-SSG5

2015-04-17 09:10:10 info Rejected an IKE packet on ethernet0/1 from 10.10.100.9:500 to 10.10.101.9:500 with cookies 7ff5bfc7da953342 and 0000000000000000 because an initial Phase 1 packet arrived from an unrecognized peer gateway.
2015-04-17 09:09:49 info Rejected an IKE packet on ethernet0/1 from 10.10.100.9:500 to 10.10.101.9:500 with cookies 7ff5bfc7da953342 and 0000000000000000 because an initial Phase 1 packet arrived from an unrecognized peer gateway.
2015-04-17 09:09:39 info Rejected an IKE packet on ethernet0/1 from 10.10.100.9:500 to 10.10.101.9:500 with cookies 7ff5bfc7da953342 and 0000000000000000 because an initial Phase 1 packet arrived from an unrecognized peer gateway.
2015-04-17 09:09:33 info Rejected an IKE packet on ethernet0/1 from 10.10.100.9:500 to 10.10.101.9:500 with cookies da2de1c7c8a08f26 and 0000000000000000 because an initial Phase 1 packet arrived from an unrecognized peer gateway.

I'm pretty sure i the ipsec configuration from sophos to ssg-5 are identical. So i don't know where else to look at. Once i swapped again my SSG320m juniper device the tunnel works again. It might be some configuration needed in the sophos device.

This thread was automatically locked due to age.

0 BAlfson over 10 years ago

Hi, specz, and welcome to the User BB!

Please click on the [Go Advanced] button below and attach pictures of the IPsec Policy open in Edit mode and of the corresponding settings in the Juniper. Also, confirm that NAT-T and DPD are selected in both the Juniper and SG.

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 specz over 10 years ago in reply to BAlfson

Hi, specz, and welcome to the User BB!

Please click on the [Go Advanced] button below and attach pictures of the IPsec Policy open in Edit mode and of the corresponding settings in the Juniper. Also, confirm that NAT-T and DPD are selected in both the Juniper and SG.

Cheers - Bob

Hi balfson

I think i already found the problem. The juniper devices were running on Aggressive Mode and i just found out reading through the astaro/sophos KB that only ipsec mainmode is supported on Sophos devices.

I would really like to test the mainmode option but right now there are no IT support guys in the branch office side to restore the settings if it won't work.
Cancel
Vote Up 0 Vote Down

Cancel