Hi,<br><br>The DG834 don't support the Aggressive Mode, there is only <span id="result_box" class="short_text" lang="en"><span title="Cliquer ici pour voir d'autres traductions" class="hps">expected for VPN Site@Site<br>
Change the router is the better solution !<br><br>Regards,<br></span></span><br><div class="gmail_quote">On Mon, Mar 7, 2011 at 9:14 PM, Howard Spindel <span dir="ltr"><<a href="mailto:howard@sci1.com">howard@sci1.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">Fabio,<br>
<br>
Don't know why I'd need Dynamic DNS for the laptop. The router doesn't have to find the laptop - the laptop finds the router.<br>
<br>
I did look at the tutorial for the Netgear connection, but the DG834G is very different from the tutorial and hard to map. The DG834G has many fewer settings allowed than the tutorial's ProSafe router.<br>
<br>
I tried the specific suggestions you had, and it made no difference that I can see. Still not getting through Phase 1.<br>
<br>
Really need a cookbook approach tailored to the DG834G here.<br>
<br>
Thanks,<br>
Howard<div class="im"><br>
<br>
<br>
At 11:31 AM 3/7/2011, Fabio Cigoj wrote:<br>
</div><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
Howard,<br>
<br>
If you have a fixed IP address on the router that's ok, but you still<br>
need a dynamic DNS service for the laptop.<br>
I am a bit confused about the router as the Netgear website states it's<br>
a VPn passthrough in one place and that it can support up to 5 endpoints<br>
somewhere else.<br>
Worth giving it a try anyway...provided your router supports Mode Config<br>
for policy generation. One of the things I am sure of is that Shrew<br>
talks to Netgear only if Mode Config is used.<br>
If that is not the case then a new router is in order.<br>
Did you take a look to the tutorial published on Shrew's website for<br>
connections with Netgear hardware ? It is written for another router,<br>
but shouldn't be too difficult to figure it out.<br>
Bear in mind that some things need to be followed exactly, one is<br>
example is the authentication: pre shared key only does not work; it<br>
needs to be PSK + XAuth.<br>
Another thing is that the exchange mode must be set to aggressive. I<br>
tried main and it didn't work.<br>
Local gateway on the router is the local WAN IP, while for the remote I<br>
used a the FQDN assigned to the laptop.<br>
Make sure the address range to assign to the clients is on a different<br>
subnet than your LAN.<br>
DH group must be 2<br>
Encryption algorithm must be 3DES and integrity algorithm must be SHA-1<br>
<br>
Wouldn't know what more to add without a clear view of router and client<br>
configuration, but I think you have some more things to try now.<br>
<br>
Cheers<br>
<br>
Fabio<div><div></div><div class="h5"><br>
<br>
On 07/03/11 20:03, Howard Spindel wrote:<br>
> Fabio,<br>
><br>
> I shouldn't need a Dynamic DNS service as I have a static IP for my<br>
> Netgear router.<br>
><br>
> So, how would I make this work with the DG834, and what additional<br>
> software do I need? The Netgear config panels don't talk about it being<br>
> a VPN pass-through - they make it sound like a VPN endpoint.<br>
><br>
> If I'm going to have to buy a different router to make this work, what<br>
> router do folks like? (I need it with a DSL modem built-in too).<br>
><br>
> Thanks,<br>
> Howard<br>
><br>
> At 05:05 AM 3/7/2011, Fabio Cigoj wrote:<br>
>> Howard,<br>
>><br>
>> The DG834 is a VPN-passthough in first place, not a VPN-endpoint,<br>
>> which would force you set up a VPN server.<br>
>> From my gatherings, collected from qualified people like the author of<br>
>> Shrew, it seems that Netgear uses quite an old VPN stack, but there<br>
>> are better and worse routers.<br>
>> I use a 338, which, far from being perfect for my needs is a<br>
>> VPN-endpoint, I managed to make work in much a similar config as the<br>
>> one you need.<br>
>> The trick is to register with a (free) dynamic DNS service both your<br>
>> router and your laptop, so every time you connect to internet the name<br>
>> of your machines has the correct IP address assigned. At that point<br>
>> you can use the FQDN (fully qualified domain name) in the VPN config.<br>
>> It looks complicated, but it is(n't)<br>
>><br>
>> Cheers<br>
>><br>
>> Fabio<br>
>><br>
>> On Mon, Mar 7, 2011 at 1:31 PM, Howard Spindel <<a href="mailto:howard@sci1.com" target="_blank">howard@sci1.com</a><br></div></div><div class="im">
>> <mailto:<a href="mailto:howard@sci1.com" target="_blank">howard@sci1.com</a>>> wrote:<br>
>><br>
>> In all likelihood, the laptop would no be directly connected to<br>
>> the internet. I would be at the mercy of whomever was providing a<br>
>> hot spot.<br>
>><br>
>> Is there no way to get that to work?<br>
>><br>
>><br>
>>> Hi,<br>
>>><br>
>>> You laptop is directly connected to Internet ? (no NAT).<br>
>>> Because the NETGEAR DG834 support only the MAIN Mode... (and<br>
>>> the VPN is buggy...)<br>
>>><br>
>>> Regards,<br>
>>><br>
>>> On Mon, Mar 7, 2011 at 11:32 AM, Howard Spindel<br></div><div><div></div><div class="h5">
>>> <<a href="mailto:howard@sci1.com" target="_blank">howard@sci1.com</a> <mailto:<a href="mailto:howard@sci1.com" target="_blank">howard@sci1.com</a>>> wrote:<br>
>>><br>
>>> I'm trying to setup a VPN that will allow me to connect<br>
>>> in to my home network (with a Netgear DG834Gv4 facing the<br>
>>> internet) from a Windows 7 laptop.<br>
>>> Can anyone provide a cookbook for setting the Netgear VPN<br>
>>> settings and ShrewSoft VPN client that would enable the<br>
>>> two to connect? I've been tearing my hair trying all<br>
>>> sorts of combinations, but can't get anything to work.<br>
>>> The VPN trace on the Win 7 laptop shows three attempts to<br>
>>> send phase1 packets before it hits "resend limit exceeded<br>
>>> for phase1 exchange" and aborts.<br>
>>> I am a computer programmer with 30 years experience and<br>
>>> lots of networking experience, but I can't figure this<br>
>>> one out!<br>
>>> Thanks,<br>
>>> Howard<br>
>>> Netgear policy page looks like this right now:<br>
>>> Remote VPN Endpoint: Dynamic IP address<br>
>>> Local LAN: IP address is set to my local subnet<br>
>>> Remote LAN: IP address is set to "Single PC - no subnet"<br>
>>> IKE direction: responder only (only choice allowed)<br>
>>> Exchange mode: Main mode (only choice allowed)<br>
>>> DH group: auto<br>
>>> Local ID type: WAN IP address<br>
>>> Remote ID type: FQDN<br>
>>> Encryption algorithm: 3DES<br>
>>> Authentication algorithm: auto<br>
>>> Using a pre-shared key for authentication<br>
>>><br>
>>><br>
>>> _______________________________________________<br>
>>> vpn-help mailing list<br></div></div>
>>> <a href="mailto:vpn-help@lists.shrew.net" target="_blank">vpn-help@lists.shrew.net</a> <mailto:<a href="mailto:vpn-help@lists.shrew.net" target="_blank">vpn-help@lists.shrew.net</a>><div class="im">
<br>
>>> <a href="http://lists.shrew.net/mailman/listinfo/vpn-help" target="_blank">http://lists.shrew.net/mailman/listinfo/vpn-help</a><br>
>><br>
>><br>
>><br>
>> _______________________________________________<br>
>> vpn-help mailing list<br></div>
>> <a href="mailto:vpn-help@lists.shrew.net" target="_blank">vpn-help@lists.shrew.net</a> <mailto:<a href="mailto:vpn-help@lists.shrew.net" target="_blank">vpn-help@lists.shrew.net</a>><div class="im"><br>
>> <a href="http://lists.shrew.net/mailman/listinfo/vpn-help" target="_blank">http://lists.shrew.net/mailman/listinfo/vpn-help</a><br>
>><br>
><br>
><br>
><br>
> _______________________________________________<br>
> vpn-help mailing list<br>
> <a href="mailto:vpn-help@lists.shrew.net" target="_blank">vpn-help@lists.shrew.net</a><br>
> <a href="http://lists.shrew.net/mailman/listinfo/vpn-help" target="_blank">http://lists.shrew.net/mailman/listinfo/vpn-help</a><br>
</div></blockquote><div><div></div><div class="h5">
<br>
<br>
<br>
_______________________________________________<br>
vpn-help mailing list<br>
<a href="mailto:vpn-help@lists.shrew.net" target="_blank">vpn-help@lists.shrew.net</a><br>
<a href="http://lists.shrew.net/mailman/listinfo/vpn-help" target="_blank">http://lists.shrew.net/mailman/listinfo/vpn-help</a><br>
</div></div></blockquote></div><br>