<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 10pt;
font-family:Tahoma
}
--></style>
</head>
<body class='hmmessage'><div dir='ltr'>
Please, any help would be very appreciated<br><br><div>> From: fmorales_htw@hotmail.com<br>> To: vpn-help@lists.shrew.net<br>> Date: Mon, 27 Jun 2011 09:29:17 +0200<br>> Subject: [vpn-help] Simple shrew dialup vpn user with SSG-140 does not works - Please Help<br>> <br>> <br>> Hi, I am trying to setup a simple dial-up vpn user with shrew and Juniper SSG-140 using the tutorial <br>> <br>> http://www.shrew.net/support/wiki/HowtoJuniperSsg<br>> <br>> <br>> but it does not works....<br>> <br>> <br>> I always get the following error:<br>> <br>> 2011-06-27 09:15:45 info IKE<88.xxxxxxxx>: XAuth login was aborted for gateway <vpnclient_gateway>, username <joe>, retry: 0. <br>> 2011-06-27 09:15:39 info Rejected an IKE packet on ethernet0/9 from 88.xxxxxxxx:58125 to 62.XXx.XXX.XXX:4500 with cookies 429c1915bb026bce and c125368ff8ef5fb4 because a Phase 2 packet arrived while XAuth was still pending. <br>> 2011-06-27 09:15:39 info IKE<88.2.163.210> Phase 1: Completed Aggressive mode negotiations with a <28800>-second lifetime. <br>> 2011-06-27 09:15:39 info IKE<88.xxxxxxxx> Phase 1: Completed for user <vpnclient_ph1id>. <br>> 2011-06-27 09:15:39 info IKE<88.xxxxxxxx> Phase 1: IKE responder has detected NAT in front of the remote device. <br>> 2011-06-27 09:15:39 info IKE<88.xxxxxxxx> Phase 1: IKE responder has detected NAT in front of the local device. <br>> 2011-06-27 09:15:39 info IKE<88.xxxxxxxx> Phase 1: Responder starts AGGRESSIVE mode negotiations. <br>> <br>> <br>> <br>> <br>> Here is my shrew file:<br>> <br>> <br>> n:version:2<br>> n:network-ike-port:500<br>> n:network-mtu-size:1380<br>> n:client-addr-auto:1<br>> n:network-natt-port:4500<br>> n:network-natt-rate:15<br>> n:network-frag-size:540<br>> n:network-dpd-enable:1<br>> n:client-banner-enable:1<br>> n:network-notify-enable:1<br>> n:client-wins-used:1<br>> n:client-wins-auto:1<br>> n:client-dns-used:1<br>> n:client-dns-auto:1<br>> n:client-splitdns-used:1<br>> n:client-splitdns-auto:1<br>> n:phase1-dhgroup:2<br>> n:phase1-life-secs:86400<br>> n:phase1-life-kbytes:0<br>> n:vendor-chkpt-enable:0<br>> n:phase2-life-secs:3600<br>> n:phase2-life-kbytes:0<br>> n:policy-nailed:0<br>> n:policy-list-auto:0<br>> s:network-host:vpn.XXXXXXXXXXXXX.com<br>> s:client-auto-mode:pull<br>> s:client-iface:virtual<br>> s:network-natt-mode:enable<br>> s:network-frag-mode:enable<br>> s:auth-method:mutual-psk-xauth<br>> s:ident-client-type:fqdn<br>> s:ident-server-type:fqdn<br>> s:ident-client-data:client.domain.com<br>> s:ident-server-data:vpngw.domain.com<br>> b:auth-mutual-psk:YXQ0d2lyZWxlc3M=<br>> s:phase1-exchange:aggressive<br>> s:phase1-cipher:auto<br>> s:phase1-hash:auto<br>> s:phase2-transform:auto<br>> s:phase2-hmac:auto<br>> s:ipcomp-transform:disabled<br>> n:phase2-pfsgroup:-1<br>> s:policy-level:auto<br>> s:policy-list-include:192.168.12.0 / 255.255.252.0<br>> <br>> <br>> And here is my SSG - 140 config file ...<br>> <br>> set clock ntp<br>> set clock timezone 1<br>> set vrouter trust-vr sharable<br>> set vrouter "untrust-vr"<br>> exit<br>> set vrouter "trust-vr"<br>> unset auto-route-export<br>> exit<br>> set service "TCP-5904" protocol tcp src-port 0-65535 dst-port 5904-5904 <br>> unset alg sql enable<br>> set auth-server "Local" id 0<br>> set auth-server "Local" server-name "Local"<br>> set auth-server "Local" timeout 20<br>> set auth default auth server "Local"<br>> set auth radius accounting port 1646<br>> set admin name "netscreen"<br>> set admin password "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"<br>> set admin user "admin" password "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" privilege "all"<br>> set admin manager-ip 192.168.13.90 255.255.255.255<br>> set admin manager-ip 192.168.13.187 255.255.255.255<br>> set admin manager-ip 192.168.14.208 255.255.255.255<br>> set admin manager-ip 192.168.15.201 255.255.255.255<br>> set admin manager-ip 192.168.13.223 255.255.255.255<br>> set admin manager-ip 192.168.13.62 255.255.255.255<br>> set admin port 8080<br>> set admin scs password disable username netscreen<br>> set admin auth timeout 10<br>> set admin auth server "Local"<br>> set admin format dos<br>> set zone "Trust" vrouter "trust-vr"<br>> set zone "Untrust" vrouter "trust-vr"<br>> set zone "DMZ" vrouter "trust-vr"<br>> set zone "VLAN" vrouter "trust-vr"<br>> set zone id 100 "Zona Teletrabajadores"<br>> set zone id 101 "Untrust-2"<br>> set zone "Untrust-Tun" vrouter "trust-vr"<br>> set zone "Trust" tcp-rst <br>> unset zone "Untrust" block <br>> unset zone "Untrust" tcp-rst <br>> set zone "MGT" block <br>> set zone "DMZ" tcp-rst <br>> set zone "VLAN" block <br>> unset zone "VLAN" tcp-rst <br>> unset zone "Zona Teletrabajadores" tcp-rst <br>> unset zone "Untrust-2" tcp-rst <br>> set zone "Untrust" screen tear-drop<br>> set zone "Untrust" screen syn-flood<br>> set zone "Untrust" screen ping-death<br>> set zone "Untrust" screen ip-filter-src<br>> set zone "Untrust" screen land<br>> set zone "V1-Untrust" screen tear-drop<br>> set zone "V1-Untrust" screen syn-flood<br>> set zone "V1-Untrust" screen ping-death<br>> set zone "V1-Untrust" screen ip-filter-src<br>> set zone "V1-Untrust" screen land<br>> set interface "ethernet0/0" zone "Trust"<br>> set interface "ethernet0/1" zone "DMZ"<br>> set interface "ethernet0/2" zone "Untrust"<br>> set interface "ethernet0/8" zone "Trust"<br>> set interface "ethernet0/9" zone "Untrust"<br>> unset interface vlan1 ip<br>> set interface ethernet0/8 ip 192.168.10.1/16<br>> set interface ethernet0/8 route<br>> set interface ethernet0/9 ip 62.XXXXXXXXX/28<br>> set interface ethernet0/9 route<br>> unset interface vlan1 bypass-others-ipsec<br>> unset interface vlan1 bypass-non-ip<br>> set interface ethernet0/8 ip manageable<br>> set interface ethernet0/9 ip manageable<br>> set interface ethernet0/9 manage ping<br>> set interface ethernet0/9 manage telnet<br>> set interface ethernet0/9 manage web<br>> set interface ethernet0/9 vip untrust 5904 "TCP-5904" 192.168.13.184 manual<br>> set interface ethernet0/8 dip 4 192.168.10.100 192.168.10.100<br>> set interface ethernet0/8 dot1x max-user 32<br>> set pak-poll p1queue pak-threshold 240<br>> set pak-poll p2queue pak-threshold 80<br>> unset flow no-tcp-seq-check<br>> set flow tcp-syn-check<br>> set domain MyNetwork<br>> set hostname FW-SSG140<br>> set pki authority default scep mode "auto"<br>> set pki x509 default cert-path partial<br>> set pki x509 dn country-name "ES"<br>> set pki x509 dn state-name "------"<br>> set pki x509 dn local-name "------"<br>> set pki x509 dn org-name "--------"<br>> set pki x509 dn name "FW-SSG140"<br>> set pki x509 dn email "FW-SSG140xxxxxxxxxx.com"<br>> set dns host dns1 194.179.1.100 src-interface ethernet0/9<br>> set dns host dns2 62.XXX.XXX.XXX src-interface ethernet0/9<br>> set dns host dns3 0.0.0.0<br>> set address "Trust" "192.168.0.0/255.255.0.0" 192.168.0.0 255.255.0.0<br>> set address "Trust" "192.168.13.125/255.255.255.255" 192.168.13.125 255.255.255.255<br>> set address "Trust" "192.168.13.162/255.255.255.255" 192.168.13.162 255.255.255.255<br>> set address "Trust" "192.168.13.223/255.255.255.255" 192.168.13.223 255.255.255.255<br>> set address "Trust" "192.168.162" 192.168.162 <br>> set address "Trust" "192.169.13.130/255.255.255.255" 192.169.13.130 255.255.255.255<br>> set address "Trust" "Red Servidor 192.168.12.0 255.255.252.0<br>> set address "Zona Teletrabajadores" "192.168.13.224/255.255.255.255" 192.168.13.224 255.255.255.255<br>> set ippool "mypool" 192.168.39.1 192.168.39.254<br>> set ippool "IP_Pool" 172.16.16.10 172.16.16.50<br>> set user "joe" uid 108<br>> set user "joe" type l2tp xauth<br>> set user "joe" remote ippool "mypool"<br>> set user "joe" remote dns1 "192.168.13.114"<br>> set user "joe" remote dns2 "192.168.13.130"<br>> set user "joe" password "BHDBhCY0N24JHwstwVCaNUot52nujMMGRg=="<br>> unset user "joe" type auth<br>> set user "joe" "enable"<br>> set user "vpnclient_ph1id" uid 107<br>> set user "vpnclient_ph1id" ike-id fqdn "client.domain.com" share-limit 1<br>> set user "vpnclient_ph1id" type ike<br>> set user "vpnclient_ph1id" "enable"<br>> set user-group "vpnclient_group" id 3<br>> set user-group "vpnclient_group" user "vpnclient_ph1id"<br>> set ike gateway "vpnclient_gateway" dialup "vpnclient_ph1id" Aggr local-id "vpngw.domain.com" outgoing-interface "ethernet0/9" preshare "1GK7RhS/NSu5cTsbHqCQOs9mp3n8IZO1bg==" proposal "pre-g2-3des-sha" "pre-g2-3des-md5" "pre-g2-aes128-sha" "pre-g2-aes128-md5"<br>> unset ike gateway "vpnclient_gateway" nat-traversal udp-checksum<br>> set ike gateway "vpnclient_gateway" nat-traversal keepalive-frequency 20<br>> set ike gateway "vpnclient_gateway" xauth server "Local"<br>> unset ike gateway "vpnclient_gateway" xauth do-edipi-auth<br>> set ike gateway "vpnclient_gateway" dpd interval 30<br>> unset ike policy-checking<br>> set ike respond-bad-spi 1<br>> unset ike ikeid-enumeration<br>> unset ike dos-protection<br>> unset ipsec access-session enable<br>> set ipsec access-session maximum 5000<br>> set ipsec access-session upper-threshold 0<br>> set ipsec access-session lower-threshold 0<br>> set ipsec access-session dead-p2-sa-timeout 0<br>> unset ipsec access-session log-error<br>> unset ipsec access-session info-exch-connected<br>> unset ipsec access-session use-error-log<br>> set xauth default ippool "mypool"<br>> set xauth default dns1 192.168.13.114<br>> set xauth default dns2 192.168.13.130<br>> set vpn "vpnclient_tunnel" gateway "vpnclient_gateway" no-replay tunnel idletime 0 proposal "nopfs-esp-3des-sha" "nopfs-esp-3des-md5" "nopfs-esp-aes128-sha" "nopfs-esp-aes128-md5" <br>> set l2tp default dns1 192.168.13.114<br>> set l2tp default dns2 192.168.13.130<br>> set l2tp default ppp-auth chap<br>> set l2tp "l2-tunnel" id 1 outgoing-interface ethernet0/9 keepalive 60<br>> set l2tp "l2-tunnel" remote-setting ippool "mypool" dns1 192.168.13.114<br>> set url protocol websense<br>> exit<br>> set policy id 84 name "vpnclient" from "Untrust" to "Trust" "Dial-Up VPN" "Red Servidor MyNetwork" "ANY" nat src tunnel vpn "vpnclient_tunnel" id 102 log <br>> set policy id 84<br>> exit<br>> set policy id 3 from "Trust" to "Untrust" "Any" "Any" "ANY" deny log <br>> set policy id 3<br>> exit<br>> set policy id 1 from "Untrust" to "Trust" "Any" "Any" "ANY" deny log <br>> set policy id 1<br>> exit<br>> set syslog config "192.168.13.222"<br>> set syslog config "192.168.13.222" facilities local0 local0<br>> set syslog enable<br>> set nsmgmt bulkcli reboot-timeout 60<br>> set nsmgmt bulkcli reboot-wait 0<br>> set ssh version v2<br>> set ssh enable<br>> set scp enable<br>> set config lock timeout 5<br>> set ntp server "130.206.3.166"<br>> set ntp server src-interface "ethernet0/9"<br>> set ntp interval 100<br>> set snmp port listen 161<br>> set snmp port trap 162<br>> set vrouter "untrust-vr"<br>> exit<br>> set vrouter "trust-vr"<br>> unset add-default-route<br>> set route 0.0.0.0/0 interface ethernet0/9 gateway 62.XXX.XXX.XXX preference 20<br>> exit<br>> set vrouter "untrust-vr"<br>> exit<br>> set vrouter "trust-vr"<br>> exit<br>> <br>> <br>> <br>> Any help would be very appreciated.<br>> <br>> Thanks <br>> _______________________________________________<br>> vpn-help mailing list<br>> vpn-help@lists.shrew.net<br>> http://lists.shrew.net/mailman/listinfo/vpn-help<br></div> </div></body>
</html>