tobi83
Mar 14, 2012, updated at 13:28:33 (UTC)
view4842
view1
0
Goto Top

Netgear VPN einrichten

GermanQuestionFirewallSecurity
Hi,

ich habe ein kleines Problem. Und zwar haben wir uns hier eine Netgear VPN Firewall gekauft, um einen Aussendienstler anzubuínden.

Habe mir auch schon die Anleitung von Netgear angesehen, komme damit aber nicht so ganz klar.

Ich denke das mein Hauptproblem bei den Remote und bei Local ID´s liegt. Ich verstehe nicht so ganz was ich da eintragen soll. Als VPn Client verwenden wir einen von NCP.

Hier habe ich mal ein paar Screenshots von meinen Einstellungen im VPN Gateway gemacht.

VPN Wizard:

3292be2fc78f75ffa9dee99ae78abcd1

VPN Policy:

97ca5c47bf272401c98a09264dca0787

IKE Policy

c873d2d7a7dce8b26ec5bf090f6ac9e8

Hier nochmal das Log aus der Firewall:

2012 Mar 14 14:22:08 [SRXN3205] [IKE] Remote configuration for identifier "123.123.1.1" found_  
2012 Mar 14 14:22:08 [SRXN3205] [IKE] Received request for new phase 1 negotiation: 84.xx.xx.xx[500]<=>89.xx.xx.xx[10952]_
2012 Mar 14 14:22:08 [SRXN3205] [IKE] Beginning Aggressive mode._
2012 Mar 14 14:22:08 [SRXN3205] [IKE] Received unknown Vendor ID_
                - Last output repeated twice -
2012 Mar 14 14:22:08 [SRXN3205] [IKE] Received Vendor ID: draft-ietf-ipsec-nat-t-ike-02__
2012 Mar 14 14:22:08 [SRXN3205] [IKE] Received unknown Vendor ID_
                - Last output repeated twice -
2012 Mar 14 14:22:08 [SRXN3205] [IKE] Received Vendor ID: DPD_
2012 Mar 14 14:22:08 [SRXN3205] [IKE] DPD is Enabled_
2012 Mar 14 14:22:08 [SRXN3205] [IKE] Received unknown Vendor ID_
                - Last output repeated 2 times -
2012 Mar 14 14:22:08 [SRXN3205] [IKE] Received Vendor ID: CISCO-UNITY_
2012 Mar 14 14:22:08 [SRXN3205] [IKE] For 89.xx.xx.xx[10952], Selected NAT-T version: draft-ietf-ipsec-nat-t-ike-02_
2012 Mar 14 14:22:09 [SRXN3205] [IKE] Setting DPD Vendor ID_
2012 Mar 14 14:22:09 [SRXN3205] [IKE] Floating ports for NAT-T with peer 89.xx.xx.xx[10954]_
2012 Mar 14 14:22:09 [SRXN3205] [IKE] NAT-D payload matches for 84.xx.xx.xx[4500]_
2012 Mar 14 14:22:09 [SRXN3205] [IKE] NAT-D payload does not match for 89.xx.xx.xx[10954]_
2012 Mar 14 14:22:09 [SRXN3205] [IKE] Ignore INITIAL-CONTACT notification from 89.xx.xx.xx[10954] because it is only accepted after phase1._
2012 Mar 14 14:22:09 [SRXN3205] [IKE] NAT detected: Peer is behind a NAT device_
2012 Mar 14 14:22:09 [SRXN3205] [IKE] ISAKMP-SA established for 84.xx.xx.xx[4500]-89.xx.xx.xx[10954] with spi:02513ed196c5a1d3:4c7d36054648246f_
2012 Mar 14 14:22:09 [SRXN3205] [IKE] Sending Informational Exchange: notify payload[INITIAL-CONTACT]_
2012 Mar 14 14:22:10 [SRXN3205] [IKE] Responding to new phase 2 negotiation: 84.xx.xx.xx<=>89.xx.xx.xx_
2012 Mar 14 14:22:10 [SRXN3205] [IKE] Failed to get IPsec SA configuration for: 0.0.0.0/0<->192.168.0.200/32 from 123.123.1.1_
2012 Mar 14 14:22:15 [SRXN3205] [IKE] Responding to new phase 2 negotiation: 84.xx.xx.xx<=>89.xx.xx.xx_
2012 Mar 14 14:22:15 [SRXN3205] [IKE] Failed to get IPsec SA configuration for: 0.0.0.0/0<->192.168.0.200/32 from 123.123.1.1_
2012 Mar 14 14:22:21 [SRXN3205] [IKE] Responding to new phase 2 negotiation: 84.xx.xx.xx<=>89.xx.xx.xx_
2012 Mar 14 14:22:21 [SRXN3205] [IKE] Failed to get IPsec SA configuration for: 0.0.0.0/0<->192.168.0.200/32 from 123.123.1.1_
2012 Mar 14 14:22:27 [SRXN3205] [IKE] Responding to new phase 2 negotiation: 84.xx.xx.xx<=>89.xx.xx.xx_
2012 Mar 14 14:22:27 [SRXN3205] [IKE] Failed to get IPsec SA configuration for: 0.0.0.0/0<->192.168.0.200/32 from 123.123.1.1_
2012 Mar 14 14:22:29 [SRXN3205] [IKE] DPD R-U-THERE received from "89.xx.xx.xx[10954]"_  
2012 Mar 14 14:22:29 [SRXN3205] [IKE] DPD R-U-THERE-ACK sent to "89.xx.xx.xx[10954]"_  
2012 Mar 14 14:22:29 [SRXN3205] [IKE] Purged ISAKMP-SA with proto_id=ISAKMP and spi=02513ed196c5a1d3:4c7d36054648246f._
2012 Mar 14 14:22:30 [SRXN3205] [IKE] ISAKMP-SA deleted for 84.xx.xx.xx[4500]-89.xx.xx.xx[10954] with spi:02513ed196c5a1d3:4c7d36054648246f_


Danke euch schon mal für eure Hilfe

Gruß
-Tobi
comment-contentCommentShareShare
Share on Facebook Share on Twitter Share on Reddit Share on Linkedin

Content-Key: 181932

Url: https://administrator.de/contentid/181932

Printed on: April 19, 2024 at 20:04 o'clock

1 Comment
Goto Top
Member: goscho
goscho Mar 14, 2012 at 12:59:32 (UTC)
Goto Top
Hi Tobi,

es sollte von Vorteil sein, wenn du in der IKE-Policy im Punkt Remote den Typ "User-FQDN" auswählst.
Allerdings kann ich dir nicht beim Einrichten des NCP-Clients in Verbindung mit dem FVS helfen.

BTW: Was hast du eigentlich für Fehler? Wie geht der Außendienstler ins Internet? Wie ist die Konfig des Clients?
GermanQuestionFirewallSecurity
Hotly discussed
gleixnerdCheck of ZFW Firewallgleixnerd - 3 CommentsAlexWishaHow to set up and configure a Linux GRE tunnelAlexWisha - 3 CommentsjstrickerWIREGUARD VPN ON UDM PRO BEHIND FRITZBOX - HANDSHAKE DID NOT COMPLETEjstricker - 3 CommentsDaniEnd of Support dates for Office 2016, 2019 Apps und Productivity ServersDani - 1 Comment