Community Help Hub

kal800 · ‎02-25-2015

Hi,

Cannot make it run using password authentication.

Here is the configuration that worked:

1. Created 3 certs - one for remote, one for local and user authentication certificate

2. VPN definition:

Type: IKE 1

Mode: Dynamic IP restricted client

Burb: internal

Enc: Tunnel

Local: Use Localhost IP

Remote Authentication - Remote certificate

Local Authentication - Local Certificate

Enable NAT Traversal

Mode Aggressive

And that's it - on the other side, I used VPN Tracker 8 with cerificates imported. And it worked.

Now, I tried to setup that VPN password based and hit the wall.

I tried different configurations - IKE1/Aggressive, IKE2/Main, IKE2/XAUTH. Always, I'm getting error that the connection was dropped due to policy.

In remote tab, I have password and remote identity - ID Kal, DN "sname" and mail address, In local tab I have grayed out password and IP Address "localhost"

I try both VPN Tracker and recommended shrew on Windows. With certs it works, with password it does not....

Please help - any advise really apreciated!

Kal

I checked the audit:

exchange mode (AGGRESSIVE MODE) not supported by policy, packet dropped

sliedl · ‎03-05-2015

The first thing you should do is upgrade this firewall to 70103H10, so that the 1500+ bug fixes between 70102 and 70103H10 can be discounted as the problem (although I do not see any bugs here, per se, just perhaps a misconfiguration). You have a 7-day license when you install version 7 in which to install patches when you have no licensed Support.

The firewall is using the Public IP your VPN-client is going through (some router at the edge of that network) as the Remote Network in the VPN Definition. When you have a "Dynamic IP Client" VPN Definition you can see the Remote IP is greyed-out and says 'client' and the Remote Network IP is greyed-out (so you cannot change these). Your VPN Client (VPN Tracker I take it) is sending its local, private IP address as the Remote Network instead. The client does not, presumably, have any way to know what's its Public IP address is so it cannot send that as the Remote Network to the firewall.

Try this small change:

Change the VPN Mode to "Dynamic IP Restricted Client." Leave the "Client address pool" setting as <disabled> and then click New under the Remote Network IP section and add 192.168.0.10/32...

Wait...

Your client IP address is in the same network as the Local Network that is behind the firewall so this setup will not work, even if the tunnel came up. I should have seen that sooner. Your client PC and any clients behind the firewall are simply going to ARP for any addresses in 192.168.0.0/24 (to which 192.168.0.10 belongs). The ARPs are broadcast only on your local network, they will not go over the VPN. If you were to get this VPN established and you tried to connect from the client to an IP across the tunnel your client will simply send ARPs on its local network, get no response, and then stop trying.

What you should do is set up Client Address Pools on the firewall. These are pushed to VPN Clients via the Mode Config process of ISAKMP. This way you assign incoming VPN clients an IP address from a specific-pool of IPs so that, just as you see here, if their local private IP (from a coffee shop let's say) happens to be in the same network as your local firewall network they can still connect. There are two different scenarios like this detailed in the 70103 Admin Guide and in various knowledgebase articles.

sliedl · ‎02-26-2015

The one error you pasted simply means you had Main Mode selected on the firewall side and Aggressive Mode selected on the client for that attempt. Provided you make those match for the next attempt and it doesn't work, is there a different error in the audit? You also need to troubleshoot from the client side. If you ever see 'Retransmitting...' in a VPN-audit you know that the client has an error and has stopped responding to the firewall (therefore you must troubleshoot on the client side).

If you can, I suggest calling in to Support to troubleshoot this with a remote session.

kal800 · ‎02-26-2015

Thanks a lot, but I'm afraid it is not that case. Unfortunately, I cannot raise the ticket yet - we have a pair of aftermarket devices with 7.0.1.02 SecureOS, and currently we are evaluating if they will suit our needs, if so, we will obtain support for sure, but till that moment, we have to rely on community help

So, I gathered some logs, first policy summary:

ipsec add name=ike_1_password type=password encapsulation=tunnel active=0 \

authalgorithm=sha1,md5 burb=internal encryptalgorithm=cast128,3des,des \

fw-id=FQDN:sky.com fwauthmethod=password fwgw=localhost ids=Kal \

ippoolid=All options=NO_STRICT_ID_MATCHING,NAT_T,INITIAL_CONTACT \

p1auth=sha1,md5 p1crypt=aes256,aes128,3des,des p1exchange=AGGRESSIVE_MODE \

p1life-kb=0 p1life-sec=3600 p1oakly=5,2,1 p1soft=85 p2life-kb=0 \

p2life-sec=700 p2soft=85 password='*' pfs=0 position=3 remotegw=dynamic \

srcnet='' version=1

and log from client side:

18:11:55 VPN Connection Requested

18:11:55 Action on error is now stop

18:11:55 This is VPN Tracker 8.1 cc3538137be2

18:11:55 Preparing Connection

18:11:58 Next step: Removing reachability check for VPN gateway

18:11:58 Local network identifier is NETWORK-SIGNATURE://Modem.RemoteAddress=*99#

18:11:58 Checking for network collisions

18:11:58 Next step: Welcoming connectiond on socket 8

18:11:58 Next step: Updating connectiond process info

18:11:58 Configuring

18:11:58 call pfkey_send_register for AH (349)

18:11:58 call pfkey_send_register for ESP (349)

18:11:58 call pfkey_send_register for IPCOMP (349)

18:11:58 Next step: Sending connectiond config

18:11:58 Saving cached local endpoint 164.126.135.53

18:11:59 Phase 1 Started

18:11:59 Next step: Processing connectiond connection request

18:11:59 Next step: Starting Phase 1

18:11:59 Next step: Starting connectiond timeout

18:11:59 initiate new phase 1 negotiation: 164.126.135.53[51209]<=>46.186.89.252[500] (1049)

18:11:59 begin Aggressive mode. (1054)

18:11:59 === Phase 1 aggressive exchange / initiator / send 1 (106)

18:11:59 new cookie: 0f769bd8787c561b (2159)

18:11:59 local ID: Kal (KEY_ID) (3823)

18:11:59 created transform #1 len=36 (2836)

18:11:59 type=Life Type, flag=0x8000, lorv=seconds (1) (2203)

18:11:59 type=Life Duration, flag=0x8000, lorv=28800 (28800) (2203)

18:11:59 type=Encryption Algorithm, flag=0x8000, lorv=AES-CBC (7) (2203)

18:11:59 type=Key Length, flag=0x8000, lorv=256 (256) (2203)

18:11:59 type=Authentication Method, flag=0x8000, lorv=pre-shared key (1) (2203)

18:11:59 type=Hash Algorithm, flag=0x8000, lorv=SHA (2) (2203)

18:11:59 type=Group Description, flag=0x8000, lorv=1024-bit MODP group (2) (2203)

18:11:59 created transform #2 len=36 (2836)

18:11:59 type=Life Type, flag=0x8000, lorv=seconds (1) (2203)

18:11:59 type=Life Duration, flag=0x8000, lorv=28800 (28800) (2203)

18:11:59 type=Encryption Algorithm, flag=0x8000, lorv=AES-CBC (7) (2203)

18:11:59 type=Key Length, flag=0x8000, lorv=192 (192) (2203)

18:11:59 type=Authentication Method, flag=0x8000, lorv=pre-shared key (1) (2203)

18:11:59 type=Hash Algorithm, flag=0x8000, lorv=SHA (2) (2203)

18:11:59 type=Group Description, flag=0x8000, lorv=1024-bit MODP group (2) (2203)

18:11:59 created transform #3 len=36 (2836)

18:11:59 type=Life Type, flag=0x8000, lorv=seconds (1) (2203)

18:11:59 type=Life Duration, flag=0x8000, lorv=28800 (28800) (2203)

18:11:59 type=Encryption Algorithm, flag=0x8000, lorv=AES-CBC (7) (2203)

18:11:59 type=Key Length, flag=0x8000, lorv=128 (128) (2203)

18:11:59 type=Authentication Method, flag=0x8000, lorv=pre-shared key (1) (2203)

18:11:59 type=Hash Algorithm, flag=0x8000, lorv=SHA (2) (2203)

18:11:59 type=Group Description, flag=0x8000, lorv=1024-bit MODP group (2) (2203)

18:11:59 created transform #4 len=32 (2836)

18:11:59 type=Life Type, flag=0x8000, lorv=seconds (1) (2203)

18:11:59 type=Life Duration, flag=0x8000, lorv=28800 (28800) (2203)

18:11:59 type=Encryption Algorithm, flag=0x8000, lorv=3DES-CBC (5) (2203)

18:11:59 type=Authentication Method, flag=0x8000, lorv=pre-shared key (1) (2203)

18:11:59 type=Hash Algorithm, flag=0x8000, lorv=SHA (2) (2203)

18:11:59 type=Group Description, flag=0x8000, lorv=1024-bit MODP group (2) (2203)

18:11:59 created transform #5 len=32 (2836)

18:11:59 type=Life Type, flag=0x8000, lorv=seconds (1) (2203)

18:11:59 type=Life Duration, flag=0x8000, lorv=28800 (28800) (2203)

18:11:59 type=Encryption Algorithm, flag=0x8000, lorv=DES-CBC (1) (2203)

18:11:59 type=Authentication Method, flag=0x8000, lorv=pre-shared key (1) (2203)

18:11:59 type=Hash Algorithm, flag=0x8000, lorv=SHA (2) (2203)

18:11:59 type=Group Description, flag=0x8000, lorv=1024-bit MODP group (2) (2203)

18:11:59 created proposal #1 len=180 (2857)

18:11:59 add payload of len 188, next type sa (2289)

18:11:59 add payload of len 128, next type ke (2289)

18:11:59 add payload of len 16, next type nonce (2289)

18:11:59 add payload of len 7, next type id (2289)