[Vpn-help] [Bulk] Re: Connecting to Linksys RV042

[Marc Goldburg]

Matthew,

That was it!  Deselecting "Obtain Automatically" for the DNS server 
allowed the tunnel to come up, and I was able to manually specify a DNS 
server for our private zone.

Shrewsoft is providing a great public service with this client.  Thank you.

Marc

Matthew Grooms wrote:
> Marc Goldburg wrote:
>> Hello,
>>
>> I'm trying to connect to a "Group VPN" on a Linksys RV042 using the 
>> ShrewSoft client v 2.0.1.  The VPN is set up to authenticate based on 
>> a client FQDN and shared secret, and the router's LAN-side subnet is 
>> included in the client's Policy tab for that connection.  Phase 1 and 
>> Phase 2 are Diffie-Hellman Group 2/AES-256/MD5 with perfect forward 
>> secrecy on phase 2.
>> I've attached a router log and an IKE log from the client for a 
>> connection attempt below.  It looks like Phase 1 is completing 
>> successfully, but the router and client hang at the start (?) of 
>> Phase 2 with the router saying "Received informational payload, type 
>> IPSEC_INITIAL_CONTACT" and the client saying"phase 2 not found."  Any 
>> suggestions for how to debug this or for alternate configurations 
>> would be greatly appreciated.  Thanks in advance!
>>
>
> Yes. The Shrew Soft client uses modecfg between phase1 and phase2 to 
> handle automatic configuration. It can also work with a Gateway that 
> doesn't support modecfg but configuring it to do so can be a bit 
> tricky. In the upcoming 2.1 release, a strictly manual configuration 
> mode has been added to make the client easier to use with Linksys and 
> other gateways that don't support this functionality. DHCP over IPsec 
> support has also been added to work better with gateways such as 
> Fortinet / Fortigate. I also have a Juniper gateway on order which I 
> plan to add full support for in the future.
>
>>     DB : config added
>>     ii : xauth is not required
>>     ii : building config attribute list
>>     ii : excluding unity attribute set
>>     ii : - IP4 DNS Server
>>     ii : sending config pull request
>
> In the above log output, the client has determined it should attempt 
> to autoconfigure the DNS server address. It does this by sending a 
> config pull request which the Linksys router never responds to. What 
> you need to do is uncheck the "Enable DNS" option in the Name 
> Resolution tab so that the modecfg exchange will be skipped. 
> Alternately, if you have a DNS server that hosts a private zone behind 
> the gateway you can specify its address manually after unchecking the 
> "Obtain Automatically" option.
>
> This should get you up and running. Let me know if you have any more 
> questions.
>
> -Matthew
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.shrew.net/pipermail/vpn-help/attachments/20071008/c36f95e2/attachment-0002.html>