<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=iso-8859-1"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:"MS Sans Serif";}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
span.EmailStyle19
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
p.Sprechblasentext, li.Sprechblasentext, div.Sprechblasentext
{mso-style-name:Sprechblasentext;
mso-style-link:"Sprechblasentext Zchn";
margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
span.SprechblasentextZchn
{mso-style-name:"Sprechblasentext Zchn";
mso-style-priority:99;
mso-style-link:Sprechblasentext;
font-family:"Tahoma","sans-serif";}
span.EmailStyle22
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:70.85pt 70.85pt 56.7pt 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='color:#1F497D'>I have had this issue with several different Windows versions. Try disabling any third party firewalls on the client. Native Windows Firewall seems to work ok but the one that comes with Mcafee is bad. You mentioned that you have unblocked specific ports. I would recommend that for a short period you disable the firewall completely, just to establish whether or not that is causing the problem.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Also, in the Shrewsoft client settings, try disabling NET Traversal. This feature is generally not needed anyway unless you are trying to NAT to a network more than one level deep and some Windows installations that I have seen do not work well with it enabled. (Acces Manager => Right click desired profile => Properties => Client Tab => NAT Traversal = “disabled”)<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>David<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> vpn-help-bounces@lists.shrew.net [mailto:vpn-help-bounces@lists.shrew.net] <b>On Behalf Of </b>martin.angst@atos.net<br><b>Sent:</b> Thursday, September 27, 2012 7:08 AM<br><b>To:</b> vpn-help@lists.shrew.net<br><b>Subject:</b> [vpn-help] Problem with<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><span lang=DE>Hello all,<o:p></o:p></span></p><p class=MsoNormal><span lang=DE><o:p> </o:p></span></p><p class=MsoNormal>We have a Problem concerning Shrew soft VPN Client running on Windows 2008 Server SP1.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Setting:<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Virtual Windows Server 2008 R2 Standard Service Pack 1 running on VMware ESX Server.<o:p></o:p></p><p class=MsoNormal>Our Firewall allows Traffic (Port 500, 4500) from/to this Server<o:p></o:p></p><p class=MsoNormal>Shrew Soft VPN Client (Version 2.1.7) was delivered from customer including several Profiles.<o:p></o:p></p><p class=MsoNormal>Shrew Soft VPN Client was installed without Error messages on that server.<o:p></o:p></p><p class=MsoNormal>Profiles from Customer had been imported without error.<o:p></o:p></p><p class=MsoNormal>Starting the client leads to the following messages<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal style='text-autospace:none'><span style='font-size:8.5pt;font-family:"MS Sans Serif";color:maroon'>config loaded for site 'Atos3-TSK'<o:p></o:p></span></p><p class=MsoNormal style='text-autospace:none'><span style='font-size:8.5pt;font-family:"MS Sans Serif";color:maroon'>configuring client settings ...<o:p></o:p></span></p><p class=MsoNormal style='text-autospace:none'><span style='font-size:8.5pt;font-family:"MS Sans Serif";color:maroon'>attached to key daemon ...<o:p></o:p></span></p><p class=MsoNormal style='text-autospace:none'><span style='font-size:8.5pt;font-family:"MS Sans Serif";color:maroon'>peer configured<o:p></o:p></span></p><p class=MsoNormal style='text-autospace:none'><span style='font-size:8.5pt;font-family:"MS Sans Serif";color:maroon'>iskamp proposal configured<o:p></o:p></span></p><p class=MsoNormal style='text-autospace:none'><span style='font-size:8.5pt;font-family:"MS Sans Serif";color:maroon'>esp proposal configured<o:p></o:p></span></p><p class=MsoNormal style='text-autospace:none'><span style='font-size:8.5pt;font-family:"MS Sans Serif";color:maroon'>client configured<o:p></o:p></span></p><p class=MsoNormal style='text-autospace:none'><span style='font-size:8.5pt;font-family:"MS Sans Serif";color:maroon'>local id configured<o:p></o:p></span></p><p class=MsoNormal style='text-autospace:none'><span style='font-size:8.5pt;font-family:"MS Sans Serif";color:maroon'>pre-shared key configured<o:p></o:p></span></p><p class=MsoNormal style='text-autospace:none'><span style='font-size:8.5pt;font-family:"MS Sans Serif";color:maroon'>bringing up tunnel ...<o:p></o:p></span></p><p class=MsoNormal style='text-autospace:none'><span style='font-size:8.5pt;font-family:"MS Sans Serif"'>negotiation timout occurred<o:p></o:p></span></p><p class=MsoNormal style='text-autospace:none'><span style='font-size:8.5pt;font-family:"MS Sans Serif";color:black'>tunnel disabled<o:p></o:p></span></p><p class=MsoNormal style='text-autospace:none'><span style='font-size:8.5pt;font-family:"MS Sans Serif";color:black'>detached from key daemon ...<o:p></o:p></span></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>The client does not work reporting: “negotiation timeout” <o:p></o:p></p><p class=MsoNormal>We sniffed the packages send from (received by) the server and noticed, that the client sends packages for IKE Phase1to the customers Firewall and the customers Firewall answers, but…<o:p></o:p></p><p class=MsoNormal>It seems that the client could not catch the packages send from customers firewall, because it sends the first request several times…<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>We Installed the client on several laptops running XP or WIN 7 and the client works properly (each test machine has been connected to the internet using the wireless LAN Adapter).<o:p></o:p></p><p class=MsoNormal>Additionally the Client works properly when it was installed on a virtual Win 2008 Server running with VMware Player on a WIN 7 Machine.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>My question is: <o:p></o:p></p><p class=MsoNormal>Why is it not possible for Shrew Soft VPN Client to establish the VPN Tunnel ?<o:p></o:p></p><p class=MsoNormal>Thanks in advance for help and <o:p></o:p></p><p class=MsoNormal>Best regards<o:p></o:p></p><p class=MsoNormal><span lang=DE><o:p> </o:p></span></p><p class=MsoNormal style='text-autospace:none'><span lang=DE style='mso-fareast-language:DE'><img width=160 height=4 id="Bild_x0020_1" src="cid:image001.png@01CD9C93.46D8A0A0"></span><span lang=DE style='font-size:10.0pt;font-family:"Arial","sans-serif";mso-fareast-language:DE'><o:p></o:p></span></p><p class=MsoNormal style='text-autospace:none'><b><span style='font-size:9.0pt;font-family:"Verdana","sans-serif";mso-fareast-language:DE'>Martin Angst<o:p></o:p></span></b></p><p class=MsoNormal style='text-autospace:none'><span lang=EN-GB style='font-size:8.0pt;font-family:"Verdana","sans-serif";mso-fareast-language:DE'>Consulting & System Integration<o:p></o:p></span></p><p class=MsoNormal style='text-autospace:none'><span lang=EN-GB style='font-size:8.0pt;font-family:"Verdana","sans-serif";mso-fareast-language:DE'>Sector Energy & Services<o:p></o:p></span></p><p class=MsoNormal style='text-autospace:none'><span lang=DE style='font-size:8.0pt;font-family:"Verdana","sans-serif";mso-fareast-language:DE'>Telefon +49 (0) 221 8299 263<o:p></o:p></span></p><p class=MsoNormal style='text-autospace:none'><span lang=DE style='font-size:8.0pt;font-family:"Verdana","sans-serif";mso-fareast-language:DE'>Mobile: +49 (0) 157 7253 2680<o:p></o:p></span></p><p class=MsoNormal style='text-autospace:none'><span lang=DE style='font-size:8.0pt;font-family:"Verdana","sans-serif";mso-fareast-language:DE'>Fax: +49 (0) 221 8299 777<o:p></o:p></span></p><p class=MsoNormal style='text-autospace:none'><span lang=DE style='font-size:8.0pt;font-family:"Verdana","sans-serif";mso-fareast-language:DE'>pers. Fax: +49 (0) 221 8299 9263<span style='color:blue'><o:p></o:p></span></span></p><p class=MsoNormal style='text-autospace:none'><span lang=DE style='font-size:8.0pt;font-family:"Verdana","sans-serif";mso-fareast-language:DE'><a href="mailto:Martin.Angst@atos.net">Martin.Angst@atos.net</a><o:p></o:p></span></p><p class=MsoNormal style='text-autospace:none'><span lang=DE style='font-size:8.0pt;font-family:"Verdana","sans-serif";mso-fareast-language:DE'>Atos Information Technology GmbH<o:p></o:p></span></p><p class=MsoNormal style='text-autospace:none'><span lang=DE style='font-size:8.0pt;font-family:"Verdana","sans-serif";mso-fareast-language:DE'>Franz Geuer Straße 10<o:p></o:p></span></p><p class=MsoNormal style='text-autospace:none'><span lang=DE style='font-size:8.0pt;font-family:"Verdana","sans-serif";mso-fareast-language:DE'>50823 Köln<o:p></o:p></span></p><p class=MsoNormal style='text-autospace:none'><span lang=DE style='font-size:8.0pt;font-family:"Verdana","sans-serif";mso-fareast-language:DE'><a href="http://www.atos.net">www.atos.net</a><o:p></o:p></span></p><p class=MsoNormal style='text-autospace:none'><span lang=DE style='mso-fareast-language:DE'><img border=0 width=128 height=37 id="Bild_x0020_2" src="cid:image002.jpg@01CD9C93.46D8A0A0"></span><span lang=DE style='font-size:8.0pt;font-family:"Verdana","sans-serif";mso-fareast-language:DE'><o:p></o:p></span></p><p class=MsoNormal style='text-autospace:none'><span lang=DE style='font-size:8.0pt;font-family:"Verdana","sans-serif";mso-fareast-language:DE'><o:p> </o:p></span></p><p class=MsoNormal><span lang=DE><o:p> </o:p></span></p><p class=MsoNormal><span lang=DE style='font-size:12.0pt;font-family:"Courier New"'>__________________________________________________________________________________________________________________________________________<br>Atos Information Technology GmbH, Luxemburger Strasse 3, D-45131 Essen, Postfach 100 123, D-45001 Essen<br>Telefon: +49 201 4305 0, Fax: +49 201 4305 689095, <a href="http://www.de.atos.net">www.de.atos.net</a><br>ING Bank AG, Frankfurt/Main: Konto 001 014 0937, BLZ 500 210 00, Swift / BIC INGBDEFF, IBAN DE74 5002 1000 0010 1409 37<br>Geschäftsführer: Winfried Holz, Vorsitzender des Aufsichtsrats: Peter Hollfelder, Handelsregister Essen HRB 19354, Ust.-ID.-Nr.: DE147861238<br>___________________________________________________________________________________________________________________________________________</span><span lang=DE style='font-size:12.0pt;font-family:"Times New Roman","serif"'><o:p></o:p></span></p></div></body></html>