RV120W IPSEC with DynDNS

mrcross01 · ‎01-15-2013

I'm probably doing something entirely stupid.

2 x RV120W, one in France, on in USA. Both are set up on DynDNS and I can administer both using their DynDNS addresses, however I cannot get IPSEC to connect between them (Gateway to Gateway). Setup was done using the wizard.

DNS Lookup on both routers returns the correct IP for the remote router but they won't connect.

Here's the VPN policy config at the US end. LAN there is 192.168.3.0

Add / Edit VPN Policy Configuration

Policy Name:

Policy Type:

Remote Endpoint:

NETBIOS:

Enable

Local Traffic Selection

Local IP:

Start Address:

End Address:

Subnet Mask:

Remote Traffic Selection

Remote IP:

This field is not editable, because netbios is selected.

Start Address:

End Address:

Subnet Mask:

Split DNS

Split DNS:

Enable

Domain Name Server 1:

Domain Name Server 2:

(Optional)

Domain Name 1:

Domain Name 2:

(Optional)

Manual Policy Parameters

SPI-Incoming:

SPI-Outgoing:

Encryption Algorithm:

Key-In:

Key-Out:

Integrity Algorithm:

Key-In:

Key-Out:

Auto Policy Parameters

SA-Lifetime:

Encryption Algorithm:

Integrity Algorithm:

PFS Key Group:

Enable

Select IKE Policy:

And here's the same for the French end

Add / Edit VPN Policy Configuration
Policy Name:
Policy Type:
Remote Endpoint:

NETBIOS:	Enable
Local Traffic Selection
Local IP:
Start Address:
End Address:
Subnet Mask:
Remote Traffic Selection
Remote IP:		This field is not editable, because netbios is selected.
Start Address:
End Address:
Subnet Mask:
Split DNS
Split DNS:	Enable
Domain Name Server 1:
Domain Name Server 2:	(Optional)
Domain Name 1:
Domain Name 2:	(Optional)
Manual Policy Parameters
SPI-Incoming:
SPI-Outgoing:
Encryption Algorithm:
Key-In:
Key-Out:
Integrity Algorithm:
Key-In:
Key-Out:
Auto Policy Parameters
SA-Lifetime:

Encryption Algorithm:
Integrity Algorithm:
PFS Key Group:	Enable

Select IKE Policy:

and here's the same for the French end where the LAN is 192.168.6.0

Add / Edit VPN Policy Configuration
Policy Name:
Policy Type:
Remote Endpoint:

NETBIOS:	Enable
Local Traffic Selection
Local IP:
Start Address:
End Address:
Subnet Mask:
Remote Traffic Selection
Remote IP:		This field is not editable, because netbios is selected.
Start Address:
End Address:
Subnet Mask:
Split DNS
Split DNS:	Enable
Domain Name Server 1:
Domain Name Server 2:	(Optional)
Domain Name 1:
Domain Name 2:	(Optional)
Manual Policy Parameters
SPI-Incoming:
SPI-Outgoing:
Encryption Algorithm:
Key-In:
Key-Out:
Integrity Algorithm:
Key-In:
Key-Out:
Auto Policy Parameters
SA-Lifetime:

Encryption Algorithm:
Integrity Algorithm:
PFS Key Group:	Enable

Select IKE Policy:

Any indications of where I'm going wrong will be much appreciated.

Mike

mrcross01 · ‎01-15-2013

Sorry the cut and paste of the Policies did not work, looked OK before I posted.

Let me know if you need further information.

Mike

Tom Watts · ‎01-15-2013

Hi Michael, if you could post the screen shots it would help a lot.

Can you also post the WAN status of each side?

-Tom
Please mark answered for helpful posts

-Tom Please mark answered for helpful posts http://blogs.cisco.com/smallbusiness/

mrcross01 · ‎01-15-2013

Many thanks Tom

attached

Mike

Tom Watts · ‎01-15-2013

On the French WAN it has an IP address 172.30.x.x. Is there a router connecting to the French WAN ov the RV120W? 172.30.x.x is generally a private IP address issued by a router, not an ISP address.

-Tom
Please mark answered for helpful posts

-Tom Please mark answered for helpful posts http://blogs.cisco.com/smallbusiness/

mrcross01 · ‎01-15-2013

Yes, it's sitting behind a Linksys on a not very good Internet connection deep in the French countryside. I don't have control over the Linksys. I'm actually at the French end.

I have other connections working from the French RV120W. I have one IPSec going to a Draytek 2830 in Portsmouth UK, that's on the 192.168.2.0 subnet and also a Draytek Vigor2600+ on the 192.168.5.0 subnet in Brighton UK. I can establish IPSec tunnels to both of these from the French RV120W. They connect and stay up with no problem. It's the pesky connection between the two RV120's which should be the easiest but is proving the most difficult!

Mike

Tom Watts · ‎01-15-2013

Hi Michael, the julierv120w.dyndns.org, I am unable to make any tcp socket to this. If there is the router in front of it, it should be sending all the requests to the RV120W.

When I check the nslookup, I'm getting a non-authoritive response of the 172.30.4.101. So it is fine the dyndns is mapping to this IP but all requests should be hitting the IP address of the first router then getting forwarded to the rv120w behind.

Can you try to configure the public IP that is on the first router in place of the fqdn you have set within the policies then test the connection? I have a feeling it can't find the peer.

-Tom
Please mark answered for helpful posts

-Tom Please mark answered for helpful posts http://blogs.cisco.com/smallbusiness/

mrcross01 · ‎01-16-2013

You Tom are a star!

What I should have done in the first place was type "find my ip" in to Google rather than just using the WAN IP shown on the RV120W Status Page. Either that or I should have been as clever as you and spotted that it was not a public IP.

Public IP turns out to be 92.158.59.128 and as soon as I plugged that in to the VPN setup it worked a treat. Many thanks indeed for your help.

Mike

mrcross01 · ‎01-16-2013

Supplementary question. In a situation like this where the RV120 is behind another router (Linksys in this case), the RV120's WAN address will be a private IP from the subnet that it sits on. It looks like it's the RV120's WAN address that is used when updating DynDNS.

Given that I can't program Dynamic DNS on the Linksys and as the Public address is readily obtainable is there any way you can think of to update DynDNS with the corrrect public address rather than the RV120's WAN IP?

Mike