<html><body><span style="font-family:Verdana; color:#000000; font-size:10pt;"><div>No it wasn't working before the firmware upgrade.</div>
<div> </div>
<div>I did fire up wireshark and see the traffic going to the router but did not see any return traffic from the router. I flipped it to aggressive mode and retyped the PSK in. Kinda mystified me but maybe I need to upgrade it. <BR></div>
<div><BR></div>
<div>Rob</div>
<div> </div>
<BLOCKQUOTE style="BORDER-LEFT: blue 2px solid; PADDING-LEFT: 8px; FONT-FAMILY: verdana; COLOR: black; MARGIN-LEFT: 8px; FONT-SIZE: 10pt" id=replyBlockquote webmail="1">
<DIV id=wmQuoteWrapper>-------- Original Message --------<BR>Subject: Re: [vpn-help] Linksys BEFSX41 Tunnel not coming up<BR>From: Kevin VPN <<a href="mailto:kvpn@live.com">kvpn@live.com</a>><BR>Date: Sat, November 24, 2012 1:19 pm<BR>To: <a href="mailto:vpn-help@lists.shrew.net">vpn-help@lists.shrew.net</a><BR><BR>On 11/22/2012 09:41 PM, Robert Hough wrote:<BR>> I am having trouble connecting to my VPN on a Linksys BEFSX41 which was flashed<BR>> to latest firmware version. I keep getting a "negotiation timeout occurred"<BR>> when trying to bring up the tunnel. Logs on the BEFSX41 indicate the VPN<BR>> client is trying to connect. Logs on the vpn client indicate that resend limit<BR>> exceeded for phase1.<BR>> Not sure what I have configed wrong so all details are below.<BR>> Settings on router:<BR>> IPSEC Passthrough > Enabled<BR>> PPOE Passthough > Enabled<BR>> PPTP Passthrough > Enabled<BR>> Local Secure Group > Subnet x.x.x.x.<BR>> Remote Secure Group > Any<BR>> Remote Security Gateway > Any<BR>> Encryption > DES<BR>> Authentication > MD5<BR>> Key Management > Auto (IKE)<BR>> ADVANCED SETTINGS ><BR>><BR>> Phase 1: > Mode: Main mode<BR>><BR>> Encryption: DES<BR>><BR>> Authentication: MD5<BR>><BR>> Group 768 Bit<BR>><BR>> Key Lifetime: 3600 seconds<BR>><BR>><BR>><BR>> Phase 2: > Encryption: DES<BR>><BR>> Authentication: MD5<BR>><BR>> PFS: On<BR>><BR>> Group: 768 Bit<BR>><BR>> Key Lifetime: 3600 seconds<BR>><BR>> Other Setting<BR>><BR>> Netbios broadcast box checked<BR>> Shrew Soft Client<BR>> NAT Transversal: enable<BR>> NAT Transversal: port 4500<BR>> IKE Fragmentation: enable<BR>> Maximum packet size: 540 bytes<BR>> Other Options<BR>> Enable Dead Peer Detection<BR>> Enable ISAKMP Failure Notifications<BR>> Enable Client Login Banner<BR>> Name Resolution<BR>> All boxes checked<BR>> Authentication Method: MutualPSK<BR>> Identification Type: IP Address<BR>> Remote Identity: IP Address<BR>> Credentials: Pre shared key<BR>> Phase 1<BR>> Exchange Type: main<BR>> DH Exchange: group1<BR>> Cipher Algorithm: des<BR>> Hash Algorithm: md5<BR>> key life time limit: 3600 secs<BR>> key life data limit 0 kb<BR>> Phase 2<BR>> Transform Algorithm: esp-des<BR>> HMAC Algorith: md5<BR>> PFS Exchange: group 1<BR>> key life time limit: 3600 secs<BR>> key life data limit 0 kb<BR>> Policy<BR>> policy generation level: unique<BR>> obtain topology automatically or tunnel all checked<BR><BR>Hi Rob,<BR><BR>Was the VPN was working before the firmware was upgraded?<BR><BR>Based on your description that the Linksys sees the client connection <BR>(and presumably does not give an error) but that the VPN client does not <BR>see the Linksys' responses (resend limit exceeded), I would suggest <BR>using a packet sniffer (like Wireshark) on your VPN client machine to <BR>see if the machine itself is receiving any packets back from the Linksys.<BR><BR>I do note that you're using Main Mode, IP Addresses and PSK to identify <BR>the VPN connection. I would check to make sure that the PSK did not <BR>somehow get changed during the firmware update. Re-enter the PSK just <BR>to be sure.<BR><BR>Most of the VPNs we see here are configured in Aggressive Mode. I could <BR>be wrong on this too, but I think using Aggressive Mode instead of Main <BR>Mode works better in situations where the connecting clients have <BR>dynamic IP addresses, so you could try that too.<BR>_______________________________________________<BR>vpn-help mailing list<BR><a href="mailto:vpn-help@lists.shrew.net">vpn-help@lists.shrew.net</a><BR><a href="http://lists.shrew.net/mailman/listinfo/vpn-help">http://lists.shrew.net/mailman/listinfo/vpn-help</a><BR></DIV></BLOCKQUOTE></span></body></html>