How strange. We have a bidirectional policy on the netscreen, and can initiate the VPN from the remote client. From the remote client, we can ping the local network, but not in reverse. We have set this VPN up over a 3g link, but I can't see how that should matter. We are using XAuth authentication. My netscreen config has the following policy lines:<br>
<br>set policy id 18 from "Untrust" to "Trust" "Dial-Up VPN" "<a href="http://192.168.13.0/24">192.168.13.0/24</a>" "ANY" tunnel vpn "dialupvpn" id 1 pair-policy 35 log <br>
<br>set policy id 35 from "Trust" to "Untrust" "<a href="http://192.168.13.0/24">192.168.13.0/24</a>" "Dial-Up VPN" "ANY" tunnel vpn "dialupvpn" id 1 pair-policy 18 log <br>
set policy id 35<br>set log session-init<br>exit<br><br>I suspect the problem must lie with the netscreen rather than the shrewsoft client, so this may not be the appropriate place to continue this query - but any light anyone can shed would be most welcome!<br>
<br><br><div class="gmail_quote">On Thu, Dec 17, 2009 at 1:24 PM, VPN Client Product Support <span dir="ltr"><<a href="mailto:vpn-help@lists.shrew.net" target="_blank">vpn-help@lists.shrew.net</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div>
<div dir="ltr"><font color="#000000" face="Calibri" size="2">Hi Ben,</font></div>
<div dir="ltr"><font face="calibri" size="2"></font> </div>
<div dir="ltr"><font face="calibri" size="2">I have just checked that. I do not have any issues connecting back to the Shrew Client. A have created a bidirectional policy for that purpose, and anything goes smooth. Of course Shrew Client has to be connected;
you can't initiate VPN connection from SSG side.</font></div>
<div dir="ltr"><font face="calibri" size="2"></font> </div>
<div dir="ltr"><font face="calibri" size="2">Regards,</font></div>
<div dir="ltr"><font face="calibri" size="2">Clemens Hoffmann</font></div>
<div dir="ltr"><font face="calibri" size="2"></font> </div>
<div style="direction: ltr;">
<hr>
<font face="Tahoma" size="2"><b>Von:</b> <a href="mailto:vpn-help-bounces@lists.shrew.net" target="_blank">vpn-help-bounces@lists.shrew.net</a> [<a href="mailto:vpn-help-bounces@lists.shrew.net" target="_blank">vpn-help-bounces@lists.shrew.net</a>] im Auftrag von VPN Client Product Support [<a href="mailto:vpn-help@lists.shrew.net" target="_blank">vpn-help@lists.shrew.net</a>]<br>
<b>Gesendet:</b> Donnerstag, 17. Dezember 2009 09:56<br>
<b>An:</b> VPN Client Product Support<br>
<b>Betreff:</b> Re: [vpn-help] Bidirectional VPN shrewsoft client <> netscreen<br>
</font><br>
</div><div><div></div><div>
<div></div>
<div>Thanks - I'll give it a go today. So what I was attempting was not possible with Shrewsoft client alone?
<br>
<br>
Cheers,<br>
<br>
Ben<br>
<br>
<div class="gmail_quote">On Thu, Dec 17, 2009 at 2:22 AM, VPN Client Product Support
<span dir="ltr"><<a href="mailto:vpn-help@lists.shrew.net" target="_blank">vpn-help@lists.shrew.net</a>></span> wrote:<br>
<blockquote style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;" class="gmail_quote">
<div bgcolor="#FFFFFF">
<div>Ben,</div>
<div><br>
</div>
<div>Since this is not related to Shrew I'm emailing you directly. Have a look at pfSense for setting up a gate-to-gate VPN tunnel. You can use IPSec or OpenSSL.</div>
<div><br>
</div>
<div>Best,<br>
<br>
Frank Pikelner</div>
<div>
<div></div>
<div>
<div><br>
On 2009-12-16, at 6:29 PM, "VPN Client Product Support" <<a href="mailto:vpn-help@lists.shrew.net" target="_blank">vpn-help@lists.shrew.net</a>> wrote:<br>
<br>
</div>
<div></div>
<blockquote type="cite">
<div>Hi,<br>
<br>
I have used the shrewsoft client for a while, and have succesfully configured it to connect to a netscreen VPN endpoin (ns5gt running screenOS 5.40r8.0)<br>
<br>
I am now trying to set up a bidirectional VPN such that not only can I see the LAN to which the netscreen is connected, but machines on that LAN can see my machine. After much trying myself, looking at routing policies and the like, I have not got very far.
I also looked at the shrewsoft config guide here:<br>
<br>
<a href="http://www.shrew.net/support/wiki/HowtoJuniperSsg" target="_blank"></a><a href="http://www.shrew.net/support/wiki/HowtoJuniperSsg" target="_blank">http://www.shrew.net/support/wiki/HowtoJuniperSsg</a><br>
<br>
Which seemed to mirror pretty closely what I had already, but only dealt with inbound traffic from the remote client.<br>
<br>
Is there a way to acheive what I am attempting, and if so is there any information I could provide that would better help diagnose the problem I am having?<br>
<br>
Cheers,<br>
<br>
Ben<br>
</div>
</blockquote>
</div>
</div>
<blockquote type="cite">
<div><span>_______________________________________________</span>
<div><br>
<span>vpn-help mailing list</span><br>
<span><a href="mailto:vpn-help@lists.shrew.net" target="_blank">vpn-help@lists.shrew.net</a></span><br>
<span><a href="http://lists.shrew.net/mailman/listinfo/vpn-help" target="_blank">http://lists.shrew.net/mailman/listinfo/vpn-help</a></span><br>
</div>
</div>
</blockquote>
</div>
<br>
_______________________________________________<br>
vpn-help mailing list<br>
<a href="mailto:vpn-help@lists.shrew.net" target="_blank">vpn-help@lists.shrew.net</a><br>
<a href="http://lists.shrew.net/mailman/listinfo/vpn-help" target="_blank">http://lists.shrew.net/mailman/listinfo/vpn-help</a><br>
<br>
</blockquote>
</div>
<br>
</div>
</div></div></div>
<br>_______________________________________________<br>
vpn-help mailing list<br>
<a href="mailto:vpn-help@lists.shrew.net" target="_blank">vpn-help@lists.shrew.net</a><br>
<a href="http://lists.shrew.net/mailman/listinfo/vpn-help" target="_blank">http://lists.shrew.net/mailman/listinfo/vpn-help</a><br>
<br></blockquote></div><br>