For 4. Re: Problem after upgrade to ubuntu 11.10 (Kevin VPN)<br><br>Downgrade to version 2.15.<br><br>Best regards,<br><br>Félix<br><br><div class="gmail_quote">2011/11/8 <span dir="ltr"><<a href="mailto:vpn-help-request@lists.shrew.net">vpn-help-request@lists.shrew.net</a>></span><br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">Send vpn-help mailing list submissions to<br>
<a href="mailto:vpn-help@lists.shrew.net">vpn-help@lists.shrew.net</a><br>
<br>
To subscribe or unsubscribe via the World Wide Web, visit<br>
<a href="http://lists.shrew.net/mailman/listinfo/vpn-help" target="_blank">http://lists.shrew.net/mailman/listinfo/vpn-help</a><br>
or, via email, send a message with subject or body 'help' to<br>
<a href="mailto:vpn-help-request@lists.shrew.net">vpn-help-request@lists.shrew.net</a><br>
<br>
You can reach the person managing the list at<br>
<a href="mailto:vpn-help-owner@lists.shrew.net">vpn-help-owner@lists.shrew.net</a><br>
<br>
When replying, please edit your Subject line so it is more specific<br>
than "Re: Contents of vpn-help digest..."<br>
<br>
<br>
Today's Topics:<br>
<br>
1. Re: VPN Connection Problems (Kevin VPN)<br>
2. Re: SAs expire immediately, connecting to Juniper SSG via<br>
Shrew (Kevin VPN)<br>
3. Re: Shrew 2.2.0 OS X build does not work on OSX 10.6.8 (Kevin VPN)<br>
4. Re: Problem after upgrade to ubuntu 11.10 (Kevin VPN)<br>
5. Re: Shrew 2.2.0 OS X build working on OSX 10.7 Lion? (Kevin VPN)<br>
6. Re: Shrew 2.2.0 OS X build does not work on OSX 10.6.8<br>
(Jinyan Huang)<br>
<br>
<br>
----------------------------------------------------------------------<br>
<br>
Message: 1<br>
Date: Mon, 7 Nov 2011 22:05:17 -0500<br>
From: Kevin VPN <<a href="mailto:kvpn@live.com">kvpn@live.com</a>><br>
Subject: Re: [vpn-help] VPN Connection Problems<br>
To: <a href="mailto:vpn-help@lists.shrew.net">vpn-help@lists.shrew.net</a><br>
Message-ID: <BLU0-SMTP273E293F6DA43A90C2E74B0A0DE0@phx.gbl><br>
Content-Type: text/plain; charset="ISO-8859-1"; format=flowed<br>
<br>
On 10/26/2011 11:05 PM, Joshua Joyce wrote:<br>
> Experts:<br>
><br>
...<br>
><br>
> I have been having problems with the multiple stations kicking off<br>
> the the stations that connected prior. I juggle the connection for a<br>
> while, and soon the VPN Gateway doesn't respond to anyone. Several<br>
> hardware reboots later things start connecting again with the same<br>
> problem. I really noticed this after I connected the server for the<br>
> first time. Prior to that I was able to RDP on station from the<br>
> other station through the VPN Connection, so I know they can reach<br>
> each other.<br>
><br>
> I set up the Shrew exactly the way shown on the Shrew set-up page for<br>
> netgear.<br>
><br>
><br>
> Maybe a question for further down the road, but can I set this up a<br>
> different way than shown on the Shrew set-up page? It ha me using<br>
> 3DES, which I recall uses a ton of processor resourses.<br>
...<br>
<br>
Hi Josh,<br>
<br>
For the first problem (users kicking others) it's possible that the<br>
Netgear only only allows one concurrent login. Since you're all using<br>
the same remote identifier, I think that there's probably a conflict.<br>
(I'm not sure why it requires multiple reboots to restore service though.)<br>
<br>
I'm not sure if there's a way to allow multiple logins with the same<br>
remote identifier. You could explore using a different Remote<br>
Identifier Type, perhaps there's one that allows a dynamic client IP. If<br>
you have a fixed (and manageable) number of clients, you could also<br>
create a separate VPN (IKE Policy) for each.<br>
<br>
For the second issue, you can always try using some encryption other<br>
than 3DES to save cycles, although you'd probably also sacrifice some<br>
level of crypto strength. It might be worth it though, if your clients<br>
are in the field and battery life is an important issue. Just make sure<br>
that both the gateway and client are set to the same values and it<br>
should work.<br>
<br>
If all you need the VPN for is access to the server, since you've got<br>
Server 2008 R2, if your clients are Win7, you could also look at putting<br>
them together as a domain and using DirectAccess to provide an encrypted<br>
channel between the server and clients.<br>
<br>
<br>
------------------------------<br>
<br>
Message: 2<br>
Date: Mon, 7 Nov 2011 22:13:25 -0500<br>
From: Kevin VPN <<a href="mailto:kvpn@live.com">kvpn@live.com</a>><br>
Subject: Re: [vpn-help] SAs expire immediately, connecting to Juniper<br>
SSG via Shrew<br>
To: <a href="mailto:vpn-help@lists.shrew.net">vpn-help@lists.shrew.net</a><br>
Message-ID: <BLU0-SMTP2761DFE1FDADED7DB3AB90CA0DE0@phx.gbl><br>
Content-Type: text/plain; charset="ISO-8859-1"; format=flowed<br>
<br>
On 10/27/2011 04:22 PM, Tim Keane wrote:<br>
><br>
> When I attempt to connect using Shrew, Phase1 and Phase2 negotiations are<br>
> completed successfully. However, the SAs immediately expire. This is happening<br>
> using Shrew v. 2.1.7 and 2.2.0, on both XP and Win7 client computers.<br>
><br>
...<br>
> 11/10/27 15:01:47 ii : processing phase2 packet ( 76 bytes )<br>
> 11/10/27 15:01:47 ii : processing phase2 packet ( 76 bytes )<br>
> 11/10/27 15:01:47 DB : phase2 found<br>
> 11/10/27 15:01:47 DB : phase2 found<br>
> 11/10/27 15:01:47 !! : phase2 packet ignored, resending last packet ( phase2<br>
> already mature )<br>
> 11/10/27 15:01:47 !! : phase2 packet ignored, resending last packet ( phase2<br>
> already mature )<br>
><br>
<br>
Hi Tim,<br>
<br>
I would suggest that your problem is that Phase 2 is not completing<br>
successfully. Shrew might think that it's complete (mature), but the<br>
gateway is still sending configure packets, suggesting that it does not<br>
agree. I've seen this before, but can't remember exactly the cause.<br>
Maybe the proxy ids or policies didn't match?<br>
<br>
Double-check your Phase 2, proxy and/or policy settings to be sure they<br>
are the same on both the client and gateway.<br>
<br>
<br>
------------------------------<br>
<br>
Message: 3<br>
Date: Mon, 7 Nov 2011 22:18:16 -0500<br>
From: Kevin VPN <<a href="mailto:kvpn@live.com">kvpn@live.com</a>><br>
Subject: Re: [vpn-help] Shrew 2.2.0 OS X build does not work on OSX<br>
10.6.8<br>
To: <a href="mailto:vpn-help@lists.shrew.net">vpn-help@lists.shrew.net</a><br>
Message-ID: <BLU0-SMTP161522EAD61BC2F66387EECA0DE0@phx.gbl><br>
Content-Type: text/plain; charset="ISO-8859-1"; format=flowed<br>
<br>
On 11/02/2011 11:05 PM, Jinyan Huang wrote:<br>
> Dear list,<br>
><br>
> I have Shrew VPN on my windows and Mac OS. In the same network<br>
> environment, the windows version is working, but on Mac is not. The<br>
> log file is follow. Any suggestions? Thank you very much in advance.<br>
><br>
> config loaded for site 'server'<br>
> attached to key daemon ...<br>
> peer configured<br>
> iskamp proposal configured<br>
> esp proposal configured<br>
> client configured<br>
> local id configured<br>
> remote id configured<br>
> file password required for user@serverb<br>
> file password required for user@serverb<br>
> file password required for user@serverb<br>
> file password required for user@serverb<br>
> server cert configured<br>
> client cert configured<br>
> client key configured<br>
> bringing up tunnel ...<br>
> negotiation timout occurred<br>
> tunnel disabled<br>
> detached from key daemon<br>
> user<br>
><br>
> sudo iked restart<br>
> ii : created ike socket <a href="http://0.0.0.0:500" target="_blank">0.0.0.0:500</a><br>
> ii : created natt socket <a href="http://0.0.0.0:4500" target="_blank">0.0.0.0:4500</a><br>
> ## : IKE Daemon, ver 2.2.0<br>
> ## : Copyright 2009 Shrew Soft Inc.<br>
> ## : This product linked OpenSSL 0.9.8r 8 Feb 2011<br>
><br>
><br>
> ps aux | grep iked<br>
> user 1498 0.0 0.0 2435116 528 s003 S+ 10:52AM 0:00.00 grep iked<br>
> root 1485 0.0 0.0 611516 836 ?? Ss 10:49AM 0:00.07<br>
> iked restart<br>
<br>
Hi Jinyan,<br>
<br>
I don't have a Mac, so I can't really help much, but are you perhaps<br>
running a firewall or other VPN software that is intercepting/blocking<br>
the packets coming back from the VPN gateway? The iked.log does not<br>
show any packets received from the gateway.<br>
<br>
Are you able to look at the gateway to see if it receives the connect<br>
request from Shrew?<br>
<br>
<br>
------------------------------<br>
<br>
Message: 4<br>
Date: Mon, 7 Nov 2011 22:27:05 -0500<br>
From: Kevin VPN <<a href="mailto:kvpn@live.com">kvpn@live.com</a>><br>
Subject: Re: [vpn-help] Problem after upgrade to ubuntu 11.10<br>
To: <a href="mailto:vpn-help@lists.shrew.net">vpn-help@lists.shrew.net</a><br>
Message-ID: <BLU0-SMTP1380B314620542D06C3E6C2A0DE0@phx.gbl><br>
Content-Type: text/plain; charset="ISO-8859-1"; format=flowed<br>
<br>
On 10/28/2011 09:10 AM, Joao Mendes wrote:<br>
> Hi Tio,<br>
> I tryed 2.2.0 beta 2 and worked.<br>
><br>
> I send you a deb I made with checkinstall (install at your responsability)<br>
><br>
> I needed to start iked manually (after renaming /etc/iked.conf.sample to<br>
> /etc/iked.conf)<br>
><br>
> Then start the UI qikea..<br>
><br>
> The vpn configuration file is the same.<br>
><br>
><br>
> Cumprimentos,<br>
> Jo?o Mendes<br>
><br>
<br>
Hi Jo?o,<br>
<br>
This deb file is really welcome, thank you! This will help a lot of<br>
people! Especially since the bug hasn't even been assigned to someone<br>
to fix yet (<a href="https://bugs.launchpad.net/ubuntu/+source/ike/+bug/860208" target="_blank">https://bugs.launchpad.net/ubuntu/+source/ike/+bug/860208</a>).<br>
<br>
I notice that the build is for amd64. I'm not very aware of Linux<br>
builds, but I think that means it is for 64bit versions of Ubuntu. Is<br>
it possible for you to also make one for 32bit? Pretty please? :)<br>
<br>
<br>
------------------------------<br>
<br>
Message: 5<br>
Date: Mon, 7 Nov 2011 22:30:13 -0500<br>
From: Kevin VPN <<a href="mailto:kvpn@live.com">kvpn@live.com</a>><br>
Subject: Re: [vpn-help] Shrew 2.2.0 OS X build working on OSX 10.7<br>
Lion?<br>
To: <a href="mailto:vpn-help@lists.shrew.net">vpn-help@lists.shrew.net</a><br>
Message-ID: <BLU0-SMTP11327CE7543F4ECDEF2CF56A0DE0@phx.gbl><br>
Content-Type: text/plain; charset="ISO-8859-1"; format=flowed<br>
<br>
On 11/01/2011 05:45 PM, Jaren Angerbauer wrote:<br>
> On Tue, Nov 1, 2011 at 3:35 PM, Paul Theodoropoulos<<a href="mailto:paul@anastrophe.com">paul@anastrophe.com</a>> wrote:<br>
>> apologies for the delay replying - to the best of my recollection, i did not<br>
>> reinstall shrew after upgrading to lion, however, i could not testify to<br>
>> that in a court of law. :)<br>
><br>
> FWIW, I installed Shrew for the first time after upgrading to Lion,<br>
> and it's working great. For those having issues, perhaps try<br>
> uninstalling / reinstalling. Is there any guide that shows how to<br>
> completely remove the software from the system?<br>
><br>
<br>
I second that, a set of instructions for removal from OS X would be most<br>
useful - I'm assuming it's not so simple as deleting the Shrew objects<br>
from the Applications menu in Finder, since iked runs at startup.<br>
<br>
<br>
------------------------------<br>
<br>
Message: 6<br>
Date: Tue, 8 Nov 2011 11:54:00 +0800<br>
From: Jinyan Huang <<a href="mailto:jhuang.tongji@gmail.com">jhuang.tongji@gmail.com</a>><br>
Subject: Re: [vpn-help] Shrew 2.2.0 OS X build does not work on OSX<br>
10.6.8<br>
To: Kevin VPN <<a href="mailto:kvpn@live.com">kvpn@live.com</a>><br>
Cc: <a href="mailto:vpn-help@lists.shrew.net">vpn-help@lists.shrew.net</a><br>
Message-ID:<br>
<<a href="mailto:CAN31xkcdn262ODXo8qGfnFJC7T-iB_8nygm2K_aQC%2B%2B5Dewm6Q@mail.gmail.com">CAN31xkcdn262ODXo8qGfnFJC7T-iB_8nygm2K_aQC++5Dewm6Q@mail.gmail.com</a>><br>
Content-Type: text/plain; charset=ISO-8859-1<br>
<br>
I just use the client of shrew. I cannot look at the gateway to see if<br>
it receives the connect request from Shrew.<br>
<br>
But I used the same internet the windows Shrew can connect but Mac<br>
not. In my Mac, I do not install firewall or other VPN software.<br>
<br>
It is strange.<br>
<br>
On Tue, Nov 8, 2011 at 11:18 AM, Kevin VPN <<a href="mailto:kvpn@live.com">kvpn@live.com</a>> wrote:<br>
> On 11/02/2011 11:05 PM, Jinyan Huang wrote:<br>
>><br>
>> Dear list,<br>
>><br>
>> I have Shrew VPN on my windows and Mac OS. In the same network<br>
>> environment, the windows version is working, but on Mac is not. The<br>
>> log file is follow. Any suggestions? Thank you very much in advance.<br>
>><br>
>> config loaded for site 'server'<br>
>> attached to key daemon ...<br>
>> peer configured<br>
>> iskamp proposal configured<br>
>> esp proposal configured<br>
>> client configured<br>
>> local id configured<br>
>> remote id configured<br>
>> file password required for user@serverb<br>
>> file password required for user@serverb<br>
>> file password required for user@serverb<br>
>> file password required for user@serverb<br>
>> server cert configured<br>
>> client cert configured<br>
>> client key configured<br>
>> bringing up tunnel ...<br>
>> negotiation timout occurred<br>
>> tunnel disabled<br>
>> detached from key daemon<br>
>> user<br>
>><br>
>> sudo iked restart<br>
>> ii : created ike socket <a href="http://0.0.0.0:500" target="_blank">0.0.0.0:500</a><br>
>> ii : created natt socket <a href="http://0.0.0.0:4500" target="_blank">0.0.0.0:4500</a><br>
>> ## : IKE Daemon, ver 2.2.0<br>
>> ## : Copyright 2009 Shrew Soft Inc.<br>
>> ## : This product linked OpenSSL 0.9.8r 8 Feb 2011<br>
>><br>
>><br>
>> ps aux | grep iked<br>
>> user ? ?1498 ? 0.0 ?0.0 ?2435116 ? ?528 s003 ?S+ ? 10:52AM ? 0:00.00 grep<br>
>> iked<br>
>> root ? ? ?1485 ? 0.0 ?0.0 ? 611516 ? ?836 ? ?? ?Ss ? 10:49AM ? 0:00.07<br>
>> iked restart<br>
><br>
> Hi Jinyan,<br>
><br>
> I don't have a Mac, so I can't really help much, but are you perhaps running<br>
> a firewall or other VPN software that is intercepting/blocking the packets<br>
> coming back from the VPN gateway? ?The iked.log does not show any packets<br>
> received from the gateway.<br>
><br>
> Are you able to look at the gateway to see if it receives the connect<br>
> request from Shrew?<br>
> _______________________________________________<br>
> vpn-help mailing list<br>
> <a href="mailto:vpn-help@lists.shrew.net">vpn-help@lists.shrew.net</a><br>
> <a href="http://lists.shrew.net/mailman/listinfo/vpn-help" target="_blank">http://lists.shrew.net/mailman/listinfo/vpn-help</a><br>
><br>
<br>
<br>
------------------------------<br>
<br>
_______________________________________________<br>
vpn-help mailing list<br>
<a href="mailto:vpn-help@lists.shrew.net">vpn-help@lists.shrew.net</a><br>
<a href="http://lists.shrew.net/mailman/listinfo/vpn-help" target="_blank">http://lists.shrew.net/mailman/listinfo/vpn-help</a><br>
<br>
<br>
End of vpn-help Digest, Vol 62, Issue 4<br>
***************************************<br>
</blockquote></div><br><br clear="all"><br>-- <br><b>Félix Pablo Grande Ramos</b><br><br><i>Carpe diem quam minimum credula postero<br></i>Aprovecha el día, no confíes en mañana<br><br><i><b>Horacio</b> (Odas,I,11)<br></i><br>