Gateway to Gateway does trouble on a client to gateway vpn settings (RV042G)

[jpblcm001]

Hello,

On a RV042G a new Gateway to Gateway VPN connection, stops the NAT on a Client to Gateway VPN connection already done. The Client is logged (Tunnel ON) but cannot access servers behind the router. Deleting the Gateway to Gateway VPN connection makes all fine. The client is a MacBook Air with VPN Tracker software.

And the Gateway to Gateway (to another RV042) always stops with the "packet from XXX.XXX.XXX.XXX:500: [Tunnel Authorize Fail] no connection has been authorized with policy=PSK+AGGRESSIVE" message. And I'm sure to have the same G to G VPN rules on both RV042G (with the right IP of course).

May be it is the same problem that causes those troubles.

The firmware version is : V4.2.3.03 (Mar 19 2014 19:59:48)

Thanx for any help.

[SamirD]

Is the IP address being assigned to the VPN client within the site-to-site VPN IP scope.
 

[jpblcm001]

Hello Samir, thank you for your answer.

The IP are fixed for the site to site connection, the lans have different ranges, all fixed IP, no DHCP. The client to site connexion is to reach only one RV042G.

In fact we have a "headquarter" site we want in permanent VPN to a distant office, that for the "Gateway to Gateway" connexion, and we have some mobile users that use the client to site connexion to our "headquarter"

[SamirD]

Can you try using dhcp reservations and turn dhcp on?  I don't think they're related, but I have a hunch that the problem is somehow related.

[jpblcm001]

After many reboots, the tunnel is "on"... do not ask me why...  but I cannot do anything, the "nat" poblem seems to be here. Is the "NAT traversal" must be enabled on both side ?

[SamirD]

Rebooting the router won't disable the connection.  You have to manually mark the profile as inactive.

NAT traversal has nothing to do with the NAT feature of the router for local IP traffic.

Try disabling the VPN again and see if the local Ineternet page loading gets faster.

[jpblcm001]

Sorry, my english was not precise enough.

All in the LAN areas was and still is fine.

The problem is when the two RV042G are connected in VPN (gateway to gateway) nothing is possible. LAN1 cannot access LAN2 trough the tunnel. The UPNPD table is alerted as full ( so I stop it for test, but nothing happens).

For me it seems that is a rollback IP problem. Where can I specify the IP I want reserved for the VPN connexion ? for each VPN connexion ? I'm in an a all fixed IP LANs and I do not want to activate DHCP.

[SamirD]

Ahh, this is a different issue than what you originally described.

From the diagnostic screen of each rv042, can you ping the lan ip of the other rv042?  Can you ping the wan IP?

Upnp won't have anything to do with the lans pinging each other through the tunnel.

[jpblcm001]

Hello,

From the diagnostic screen, the ping does not work, on LAN IP neither the WAN IP..., but the tunnel is ON and NAT traversal activated on both side.

With firewall desactivated, I can PING the WAN IP (public IP), but not a LAN one.

[SamirD]

Okay, so it looks like while your tunnel is coming up according to the routers, the tunnel doesn't actually work.  This is usually a settings issue with the IP and subnet masks.  Be sure they are identical on each side in terms of local/remote settings.

[jpblcm001]

No, the settings in local/remote are exactly the same (inversed of course). The only thing I see is the WAN IP of the RV042G that is behind another router and the WAN IP is not the WAN I use to connect (of course is an local one). I use the real public IP. And do not forget that there already is a client-ton VPN that works very fine on it. I will picture you the connexions tonight.

Anyway, a big thank you for your help.

[mpyhala]

jpblcm001,

Forward port 443 (TCP) and 500 (UDP) to the WAN IP of the RV042G if it has a local IP on the WAN port. Make sure that the router in front of the RV042G allows VPN Passthrough. This is not officially supported, but I have seen it work.

- Marty

[jpblcm001]

here is a small diagram of my network, I'm sure that the IP are well set.

As I wrote a bit earlier, I have a Client to Gateway VPN working fine on the same RV042G, is the forwarding specially for the gateway to gateway vpn settings ?

[mpyhala]

jpblcm001,

If the ZyWall firewall is active, it will block the VPN tunnel from passing traffic. 

Does your Client to Gateway tunnel us IPsec or PPTP?

Can you Remote Manage the RV042G at site A using the WAN IP?

Does it respond to ping requests? (Disable Block WAN Request of course)

- Marty

[jpblcm001]

Yes, the firewall is active ( it is here for increased security) but it forwards the correct ports, and yes I'm using all IPSEC, so my "mobile" client to gateway VPN connection works fine. I've routed all the ports to manage via https and yes it works on both rv042.

And yes, PING responses are correct

I know it is a very strange problem... I must have forgotten something, but what... 

Thank you for your help too Mpyhala