<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
<title></title>
</head>
<body bgcolor="#ffffff" text="#000000">
<font face="Arial">Matthew,<br>
<br>
That was it! Deselecting "Obtain Automatically" for the DNS server
allowed the tunnel to come up, and I was able to manually specify a DNS
server for our private zone.<br>
<br>
Shrewsoft is providing a great public service with this client. Thank
you.<br>
<br>
Marc<br>
</font><br>
Matthew Grooms wrote:<br>
<blockquote cite="mid:470ACC14.6060505@shrew.net" type="cite">Marc
Goldburg wrote:
<br>
<blockquote type="cite">Hello,
<br>
<br>
I'm trying to connect to a "Group VPN" on a Linksys RV042 using the
ShrewSoft client v 2.0.1. The VPN is set up to authenticate based on a
client FQDN and shared secret, and the router's LAN-side subnet is
included in the client's Policy tab for that connection. Phase 1 and
Phase 2 are Diffie-Hellman Group 2/AES-256/MD5 with perfect forward
secrecy on phase 2. <br>
I've attached a router log and an IKE log from the client for a
connection attempt below. It looks like Phase 1 is completing
successfully, but the router and client hang at the start (?) of Phase
2 with the router saying "Received informational payload, type
IPSEC_INITIAL_CONTACT" and the client saying"phase 2 not found." Any
suggestions for how to debug this or for alternate configurations would
be greatly appreciated. Thanks in advance!
<br>
<br>
</blockquote>
<br>
Yes. The Shrew Soft client uses modecfg between phase1 and phase2 to
handle automatic configuration. It can also work with a Gateway that
doesn't support modecfg but configuring it to do so can be a bit
tricky. In the upcoming 2.1 release, a strictly manual configuration
mode has been added to make the client easier to use with Linksys and
other gateways that don't support this functionality. DHCP over IPsec
support has also been added to work better with gateways such as
Fortinet / Fortigate. I also have a Juniper gateway on order which I
plan to add full support for in the future.
<br>
<br>
<blockquote type="cite"> DB : config added
<br>
ii : xauth is not required
<br>
ii : building config attribute list
<br>
ii : excluding unity attribute set
<br>
ii : - IP4 DNS Server
<br>
ii : sending config pull request
<br>
</blockquote>
<br>
In the above log output, the client has determined it should attempt to
autoconfigure the DNS server address. It does this by sending a config
pull request which the Linksys router never responds to. What you need
to do is uncheck the "Enable DNS" option in the Name Resolution tab so
that the modecfg exchange will be skipped. Alternately, if you have a
DNS server that hosts a private zone behind the gateway you can specify
its address manually after unchecking the "Obtain Automatically"
option.
<br>
<br>
This should get you up and running. Let me know if you have any more
questions.
<br>
<br>
-Matthew
<br>
<br>
</blockquote>
<br>
</body>
</html>