<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">Issue wih Client Follow up <o:p></o:p></p>
<p class="MsoNormal">I hope this better describes the issue. <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">We have a shrew soft client 2.2.1\2.1.6 releases on a Windows 7 Computers.<o:p></o:p></p>
<p class="MsoNormal">Note there is a Mac at one of these sites using IPSecuritas that connects fine.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I have about 40 clients on this Juniper SSG140<o:p></o:p></p>
<p class="MsoNormal">3 Clients have a behaviors as was described in the previous post "Issue with Client"<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">We get a partial connection to the firewall (Juniper SSG140 Software Version 6.3.0r14.0)
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">But here is what we get:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">"The client never identifies itself fully to the firewall. It makes a connection and will send packets but randomly reply with packets sometimes not. Ping will show disconnects or latency for random periods or worse When these clients
connect they also will throw off working clients on occasion."<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">From the Juniper side <o:p></o:p></p>
<p class="MsoNormal">from a putty session you can see as follows: <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">You can see that an IKE has established using a get sa (sometimes not all time but when does it will show as active)<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">When you check the VPN Tunnel for Mobile VPN users I do not see an IP on the tunnel when it should have binded or worse sometime 3 of the same IPs binded for connection (when 3 Ips happen it will sometimes slow down and\or kick off other
users) <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I see this in the logs as well.. <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">2013-07-01 18:52:06 info IKE<############> Phase 1: IKE responder has detected NAT in front of the remote device.
<o:p></o:p></p>
<p class="MsoNormal">2013-07-01 18:52:06 info IKE<############> Phase 1: IKE responder has detected NAT in front of the local device.
<o:p></o:p></p>
<p class="MsoNormal">Note: IP Redacted log had IP correct<o:p></o:p></p>
<p class="MsoNormal"><o:p></o:p></p>
<p class="MsoNormal">This Juniper mobile vpn set up has been working for some time. There have been no changes on the firewall with exception of a software update less than 24 hours ago to try to resolve this.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">It is a belief that this is from the client side causing this problem. We updated has a small update to the VPN connection for Enable NAT-Traversal from 5 ms to 60 ms but then was changed back to 5ms was made over a week ago to try to
fix this issue by our consultant <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Is there any reason the shrew soft client would either get 3 ips from the tunnel binding or for some reason not bind to the tunnel for return?
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">We did try an update to client 2.2.2. which had no effect.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The users only seem to have windows 7 in common. <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Any ideas would be helpful. <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I can provide some logs if needed. <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<br>
<hr>
<font face="Arial" color="Black" size="2">Technical data included in this e-mail may be Export-Controlled and subject to<br>
the Arms Export Control Act (Title 22, U.S.C., sec 2751 et seq.) or the Export<br>
Administration Act of 1979, as amended seq.<br>
<br>
This information or element thereof, in any form, shall not be disclosed to a<br>
foreign person (including foreign person employees), entity, or exported from<br>
the United States without U.S. Government authority and the express written<br>
authorization of DCX-CHOL Enterprises, Inc.<br>
This document may contain DCX-CHOL<br>
Enterprises, Inc. Proprietary Information and is to be used only for the<br>
purposes for which it has been supplied and is not to be duplicated or<br>
disclosed in whole or in part without written permission from a duly authorized<br>
representative of DCX-CHOL Enterprises, Inc.<br>
<br>
If you feel you have received this email in error please contact the DCX-CHOL<br>
IT Team at 310-516-1692 ext 454.<br>
</font>
</body>
</html>