Just wondering if anyone has successfully configured a VPN tunnel from a PIX
at V 6.2 to a Nokia 440 (or similar) running Firewall-1 V 4.1 SP5.
The configuration at both ends is:
IKE Key exchange
3DES Encryption
SHA1 Hash
Pre-shared secret
Diffie Hellman Group 2
PIX config:
sysopt connection permit-ipsec
no sysopt route dnat
crypto ipsec transform-set dg esp-3des esp-sha-hmac
crypto dynamic-map dynmap 10 set transform-set dg
crypto map dgmap 5 ipsec-isakmp
crypto map dgmap 5 match address st_vpn
crypto map dgmap 5 set peer 64.x.x.x
crypto map dgmap 5 set transform-set dg
crypto map dgmap 10 ipsec-isakmp dynamic dynmap
crypto map dgmap client configuration address initiate
crypto map dgmap client configuration address respond
crypto map dgmap interface outside
isakmp enable outside
isakmp key ******** address 0.0.0.0 netmask 0.0.0.0
isakmp key ******** address 64.x.x.x netmask 255.255.255.255
isakmp identity address
isakmp client configuration address-pool local vpn_client outside
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption 3des
isakmp policy 10 hash sha
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400
We have other dynamic VPN clients using the PIX as well.
Phase 1 completes OK but phase 2 fails with an errror message
which I fail to understand.
The config on the Nokia is as per a document provided by Nokia.
Any ideas or suggestions would be much appreciated.
Simon.
PIX debug output:
(identity) local= 213.x.x.x, remote= 64.x.x.x,
local_proxy= 17.254.7.5/255.255.255.255/0/0 (type=1),
remote_proxy= 10.10.10.6/255.255.255.255/0/0 (type=1)
VPN Peer: ISAKMP: Added new peer: ip:64.x.x.x Total VPN Peers:5
VPN Peer: ISAKMP: Peer ip:64.x.x.x Ref cnt incremented to:1 Total VPN Peers:5
ISAKMP (0): beginning Main Mode exchange
crypto_isakmp_process_block: src 64.x.x.x, dest 213.x.x.x
OAK_MM exchange
ISAKMP (0): processing SA payload. message ID = 0
ISAKMP (0): Checking ISAKMP transform 1 against priority 10 policy
ISAKMP: encryption 3DES-CBC
ISAKMP: hash SHA
ISAKMP: default group 2
ISAKMP: auth pre-share
ISAKMP: life type in seconds
ISAKMP: life duration (VPI) of 0x0 0x1 0x51 0x80
ISAKMP (0): atts are acceptable. Next payload is 0
ISAKMP (0): SA is doing pre-shared key authentication using id type ID_IPV4_ADDR
return status is IKMP_NO_ERROR
crypto_isakmp_process_block: src 64.x.x.x, dest 213.x.x.x
OAK_MM exchange
ISAKMP (0): processing KE payload. message ID = 0
ISAKMP (0): processing NONCE payload. message ID = 0
ISAKMP (0): ID payload
next-payload : 8
type : 1
protocol : 17
port : 500
length : 8
ISAKMP (0): Total payload length: 12
return status is IKMP_NO_ERROR
crypto_isakmp_process_block: src src 64.x.x.x, dest 213.x.x.x
OAK_MM exchange
ISAKMP (0): processing ID payload. message ID = 0
ISAKMP (0): processing HASH payload. message ID = 0
ISAKMP (0): SA has been authenticated
ISAKMP (0:0): Need config/address
ISAKMP (0:0): initiating peer config to 64.x.x.x. ID = 2678742696 (0x9faa5ea8)modecfg: sa: 81031700, new mess id= 9faa5ea8
return status is IKMP_NO_ERROR
ISAKMP (0): sending INITIAL_CONTACT notify
ISAKMP (0): sending NOTIFY message 24578 protocol 1
crypto_isakmp_process_block: src src 64.x.x.x, dest 213.x.x.x
ISAKMP: reserved not zero on payload 5!
crypto_isakmp_process_block: src src 64.x.x.x, dest 213.x.x.x
ISAKMP: reserved not zero on payload 5!
ISAKMP (0): retransmitting phase 2...
