<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Hi,<br>
<br>
I can confirm Shrew can work with Juniper configured with Preshared key
and Xauth.<br>
I have it configured but not on my computer.<br>
Can you send the configs from Juniper and the configs you have on the
client (change all the sensite data).<br>
<br>
Regards,<br>
<br>
Rui Cordeiro<br>
<br>
Paulo Penha wrote:
<blockquote
cite="mid:1dc7733c0912100717r28263d52vc54eb37784027b2b@mail.gmail.com"
type="cite">Hi people !<br>
<br>
I install and get success in Shrew VPN with Netscreen (Juniper SSG550),
using only Preshared Key.<br>
Now trying to establish VPN using procedure of <a
moz-do-not-send="true" href="http://www.shrew.net/support">http://www.shrew.net/support</a>.<br>
/wiki/HowtoJuniperSsg , Shrew VPN client and Juniper SSG.<br>
<br>
but get this messages:<br>
<br>
Client Shrew Verssion 2.2.0 log: <br>
user user1 authentication failed<br>
<br>
<br>
Juniper SSG550 Event log:<br>
<br>
IKE<187.89.196.120>: XAuth login failed for gateway
<VPN_DIR_GTW>, username <user1>, retry: 0, timeout: 1.<br>
<br>
Rejected an IKE packet on ethernet6/0 from <a moz-do-not-send="true"
href="http://187.89.196.120:4500">187.89.196.120:4500</a> to <a
moz-do-not-send="true" href="http://10.8.38.2:4500">10.8.38.2:4500</a>
with cookies 80289756f142712f and f6620d6ca1901e52 because a Phase 2
packet arrived while XAuth was still pending.<br>
<br>
IKE<187.89.196.120> Phase 1: Completed Aggressive mode
negotiations with a <28800>-second lifetime.<br>
<br>
<br>
Juniper CLI debug IKE:<br>
<br>
## 2009-12-09 17:07:42 : IKE<0.0.0.0 > Validate (503):
SA/56 KE/132 NONCE/24 ID/27 VID/12 VID/20 VID/20 VID/20 VID/20<br>
## 2009-12-09 17:07:42 : IKE<187.89.225.194 > Receive Id in AG
mode, id-type=2, id=<a moz-do-not-send="true"
href="http://vpn.company.com">vpn.company.com</a><br>
## 2009-12-09 17:07:42 : locate peer entry for (2/<a
moz-do-not-send="true" href="http://vpn.company.com">vpn.company.com</a>),
by identity.<br>
## 2009-12-09 17:07:42 : Found identity<<a moz-do-not-send="true"
href="http://vpn.company.com">vpn.company.com</a>> in group
<3> user id <11>.<br>
## 2009-12-09 17:07:42 : responder create sa:
187.89.225.194->10.8.38.2<br>
## 2009-12-09 17:07:42 : init p1sa, pidt = 0x0<br>
## 2009-12-09 17:07:42 : change peer identity for p1 sa, pidt = 0x0<br>
## 2009-12-09 17:07:42 : IKE<0.0.0.0 > create peer
identity 0883d40dc<br>
## 2009-12-09 17:07:42 : peer identity 83d40dc created.<br>
## 2009-12-09 17:07:42 : IKE<0.0.0.0 > EDIPI disabled<br>
## 2009-12-09 17:07:42 : IKE<0.0.0.0 > dh group 2<br>
## 2009-12-09 17:07:42 : locate peer entry for (2/<a
moz-do-not-send="true" href="http://vpn.company.com">vpn.company.com</a>),
by identity.<br>
## 2009-12-09 17:07:42 : Found identity<<a moz-do-not-send="true"
href="http://vpn.company.com">vpn.company.com</a>> in group
<3> user id <11>.<br>
## 2009-12-09 17:07:42 : IKE<0.0.0.0 > finished job
pkaidx <0> dh_len<128> dmax<64><br>
## 2009-12-09 17:07:42 : IKE<0.0.0.0 > finished job
d<a76fb5d8><189fc35><c64d5fe6><br>
<bd34f4a3><br>
## 2009-12-09 17:07:42 : IKE<0.0.0.0 > from FLOAT port.<br>
## 2009-12-09 17:07:42 : IKE<0.0.0.0 > extract payload
(72):<br>
## 2009-12-09 17:07:42 : IKE<0.0.0.0 > ikecfg list add
attr type 16520, val 0 added, len 0.<br>
## 2009-12-09 17:07:42 : IKE<0.0.0.0 > ikecfg list add
attr type 16521, val empty string, type <16521> added, len 0.<br>
## 2009-12-09 17:07:42 : IKE<0.0.0.0 > ikecfg list add
attr type 16522, val empty string, type <16522> added, len 0.<br>
## 2009-12-09 17:07:42 : IKE<0.0.0.0 > print ikecfg
attribute payload:<br>
## 2009-12-09 17:07:42 : IKE<0.0.0.0 > next: 0,
payloadlength 20, type 1, identifier 9519.<br>
## 2009-12-09 17:07:42 : IKE<0.0.0.0 > basic attr type
16520, valint 0<br>
## 2009-12-09 17:07:42 : IKE<0.0.0.0 > variable attr
type 16521, vallen 0, valstr empty string, type <16521><br>
## 2009-12-09 17:07:42 : IKE<0.0.0.0 > variable attr
type 16522, vallen 0, valstr empty string, type <16522><br>
## 2009-12-09 17:07:42 : IKE<0.0.0.0 > <br>
## 2009-12-09 17:07:42 : IKE<0.0.0.0 > from FLOAT port.<br>
## 2009-12-09 17:07:42 : IKE<0.0.0.0 > from FLOAT port.<br>
## 2009-12-09 17:07:42 : IKE<0.0.0.0 > print ikecfg
attribute payload:<br>
## 2009-12-09 17:07:42 : IKE<0.0.0.0 > next: 0,
payloadlength 33, type 2, identifier 9519.<br>
## 2009-12-09 17:07:42 : IKE<0.0.0.0 > basic attr type
16520, valint 0<br>
## 2009-12-09 17:07:42 : IKE<0.0.0.0 > variable attr
type 16521, vallen 1280, valstr user <br>
## 2009-12-09 17:07:42 : IKE<0.0.0.0 > <br>
## 2009-12-09 17:07:42 : IKE<0.0.0.0 > ikecfg list add
attr type 16520, val 0 added, len 0.<br>
## 2009-12-09 17:07:42 : IKE<0.0.0.0 > ikecfg list add
attr type 16521, val user added, len 5.<br>
## 2009-12-09 17:07:42 : IKE<0.0.0.0 > ikecfg list add
attr type 16522, val 1234567 added, len 8.<br>
## 2009-12-09 17:07:42 : IKE<0.0.0.0 > ikecfg list add
attr type 1, val 10.8.80.112 added, len 4.<br>
## 2009-12-09 17:07:42 : IKE<0.0.0.0 > ikecfg list add
attr type 2, val 255.255.255.255 added, len 4.<br>
## 2009-12-09 17:07:42 : IKE<0.0.0.0 > ikecfg list add
attr type 3, val 32.8.4.101 added, len 4.<br>
## 2009-12-09 17:07:42 : IKE<0.0.0.0 > ikecfg list add
attr type 3, val 32.8.5.101 added, len 4.<br>
## 2009-12-09 17:07:42 : IKE<0.0.0.0 > print ikecfg
attribute payload:<br>
## 2009-12-09 17:07:42 : IKE<0.0.0.0 > next: 0,
payloadlength 40, type 3, identifier 9519.<br>
## 2009-12-09 17:07:42 : IKE<0.0.0.0 > variable attr
type 1, vallen 1024, valstr 10.8.80.112 <br>
## 2009-12-09 17:07:42 : IKE<0.0.0.0 > <br>
## 2009-12-09 17:07:43 : IKE<0.0.0.0 > dh group 2<br>
## 2009-12-09 17:07:43 : IKE<0.0.0.0 > finished job
pkaidx <0> dh_len<128> dmax<64><br>
## 2009-12-09 17:07:43 : IKE<0.0.0.0 > finished job
d<c5975e8a><6b7285b1><6c644c1e><94c00385><br>
## 2009-12-09 17:07:43 : IKE<0.0.0.0 > BN, top32 dmax64
zero<no><br>
## 2009-12-09 17:07:43 : IKE<0.0.0.0 > from FLOAT port.<br>
## 2009-12-09 17:07:43 : IKE<0.0.0.0 > print ikecfg
attribute payload:<br>
## 2009-12-09 17:07:43 : IKE<0.0.0.0 > next: 0,
payloadlength 12, type 4, identifier 9519.<br>
## 2009-12-09 17:07:43 : IKE<0.0.0.0 > variable attr
type 3, vallen 0, valstr 0.0.0.0 <br>
## 2009-12-09 17:07:43 : IKE<0.0.0.0 > <br>
## 2009-12-09 17:07:43 : IKE<0.0.0.0 > ikecfg list add
attr type 3, val 0.0.0.0 added, len 0.<br>
## 2009-12-09 17:07:43 : IKE<0.0.0.0 > ikecfg list add
attr type 16527, val 0 added, len 0.<br>
## 2009-12-09 17:07:43 : IKE<0.0.0.0 > print ikecfg
attribute payload:<br>
## 2009-12-09 17:07:43 : IKE<0.0.0.0 > next: 0,
payloadlength 12, type 3, identifier 9519.<br>
## 2009-12-09 17:07:43 : IKE<0.0.0.0 > basic attr type
16527, valint 0<br>
## 2009-12-09 17:07:43 : IKE<0.0.0.0 > <br>
## 2009-12-09 17:07:43 : IKE<0.0.0.0 > from FLOAT port.<br>
<br>
<br>
Shrew VPN Client work with Juniper ? Preshred Key and XAut ?<br>
Somebody halp me ?<br>
<br>
Thanks<br>
<br>
<pre wrap="">
<hr size="4" width="90%">
_______________________________________________
vpn-help mailing list
<a class="moz-txt-link-abbreviated" href="mailto:vpn-help@lists.shrew.net">vpn-help@lists.shrew.net</a>
<a class="moz-txt-link-freetext" href="http://lists.shrew.net/mailman/listinfo/vpn-help">http://lists.shrew.net/mailman/listinfo/vpn-help</a>
</pre>
</blockquote>
</body>
</html>