<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
tt
{mso-style-priority:99;
font-family:"Courier New";}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
span.EmailStyle23
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-CA" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><a name="_MailEndCompose"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">I have several SSG20s setup for user VPNs with Shrew, using preshared keys. Been many years since I did the setup, so really rusty,
but here’s what I do.<o:p></o:p></span></a></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">I have a single IKE user defined in Netscreen, with a FQDN identity as
</span><a href="mailto:vpndudes@mydomain.com"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">vpndudes@mydomain.com</span></a><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">. I reference this identity in the
Shrew connection profile under the Authentication tab/Local Indentity. This IKE user I share for all user logons, and since its shared I have to make sure to set a high number for allowed multiple logons for the IKE user.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">When users logon, they then supply a username and password, which is the individual authentication they each use. In my case I’m using a RADIUS server for external
authentication, but I suppose it could be local authentication users on Netscreen too.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">I’m not sure if you are creating multiple IKE users to go with multiple authentication users, or just 1 like I did, but to my knowledge the only time Netscreen
cares if you logon multiple times with the same user is if you are sharing the IKE user in your VPN setup (like I am), and not setting the allowed logons for that IKE user greater than 1.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><i><span style="font-size:10.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></i></p>
<p class="MsoNormal"><i><span style="font-size:10.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Andy
<o:p></o:p></span></i></p>
</div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span lang="EN-US" style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> vpn-help-bounces@lists.shrew.net [mailto:vpn-help-bounces@lists.shrew.net]
<b>On Behalf Of </b>J. Schröder<br>
<b>Sent:</b> Friday, November 01, 2013 12:06 PM<br>
<b>To:</b> ppluciennik@yahoo.com; vpn-help@lists.shrew.net<br>
<b>Subject:</b> Re: [vpn-help] Only one concurrent session possible / VPN with Netscreen<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif"">Hi there,<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif""> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif"">I tried to assign IP addresses manually to the different VPN users, but that didn't solve the problem. In the Netscreen logs I can see, that established vpn connections are
terminated, because the respective user is already connected:<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif""> <o:p></o:p></span></p>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif"">2013-10-31 21:40:35 system info 00536 IKE<xx.xx.xx.xx>: XAuth login was terminated because the user logged in again. Previous gateway: <xx.xx.xx.xx>. Username: <user1>
at <192.168.1.11/255.255.255.255>.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif""> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif"">2013-10-31 21:38:53 system info 00536 IKE<xx.xx.xx.xx>: XAuth login was terminated because the user logged in again. Previous gateway: <xx.xx.xx.xx>. Username: <user2>
at <192.168.1.10/255.255.255.255>.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif""> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif"">Really strange. So I assume that only using certificates (instead of preshared keys) would solve the problem.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif""> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif"">Any other idea?<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif""> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif"">Regards<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif"">Johan<o:p></o:p></span></p>
</div>
</div>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif""> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif"">------ Originalnachricht ------<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif"">Von: "Piotr Pluciennik" <<a href="mailto:ppluciennik@yahoo.com">ppluciennik@yahoo.com</a>><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif"">An: "<a href="mailto:ponymann@gmail.com">ponymann@gmail.com</a>" <<a href="mailto:ponymann@gmail.com">ponymann@gmail.com</a>><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif"">Gesendet: 30.10.2013 17:05:32<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif"">Betreff: Re: Re[2]: [vpn-help] Only one concurrent session possible / VPN with Netscreen<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif""> <o:p></o:p></span></p>
</div>
<div id="fa94f1443f254f8e9498d3a2b2c54aff">
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 8.0pt;margin-left:3.75pt;margin-top:2.25pt;margin-right:0in;margin-bottom:5.0pt">
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0">
<tbody>
<tr>
<td valign="top" style="padding:0in 0in 0in 0in">
<p><span style="font-size:10.0pt;font-family:"Arial","sans-serif"">I had similiar problem with Cisco. The solution was changing manually ip asigned to client. I'm not sure wchich tab it is, as I remember it is in general, now I'm away form the computer, using
only tablet., so cannot check it for you. Check what ip is assigned to each client. It should be different. Manualy setting different ip's solved my problem.<o:p></o:p></span></p>
<p><span style="font-size:10.0pt;font-family:"Arial","sans-serif"">Let me know if it helped you.<br>
Regards<br>
Piotr<o:p></o:p></span></p>
</td>
</tr>
</tbody>
</table>
<div id="_origMsg_">
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif""><o:p> </o:p></span></p>
<div>
<div>
<div>
<div class="MsoNormal" align="center" style="text-align:center"><span style="font-size:9.0pt;font-family:"Arial","sans-serif"">
<hr size="1" width="100%" align="center">
</span></div>
</div>
<p class="MsoNormal"><b><span style="font-size:9.0pt;font-family:"Arial","sans-serif"">From:
</span></b><span style="font-size:9.0pt;font-family:"Arial","sans-serif"">J. Schröder <<a href="mailto:ponymann@gmail.com">ponymann@gmail.com</a>>;
<br>
<b>To: </b><<a href="mailto:ppluciennik@yahoo.com">ppluciennik@yahoo.com</a>>; <br>
<b>Subject: </b>Re[2]: [vpn-help] Only one concurrent session possible / VPN with Netscreen
<br>
<b>Sent: </b>Wed, Oct 30, 2013 3:58:13 PM <o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif""><o:p> </o:p></span></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0">
<tbody>
<tr>
<td valign="top" style="padding:0in 0in 0in 0in">
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif"">Hi,<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif""> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif"">which setting do you mean exactly? The client IP is assigned automatically using the IP pool configured in the Netscreen.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif""> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif"">Regards<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif"">Johnny<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif""> <o:p></o:p></span></p>
</div>
<div id="yqt08533">
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif"">------ Originalnachricht ------<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif"">Von: "Piotr Pluciennik" <<a href="javascript:return">ppluciennik@yahoo.com</a>><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif"">An: "<a href="mailto:ponymann@gmail.com">ponymann@gmail.com</a>" <<a href="javascript:return">ponymann@gmail.com</a>><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif"">Gesendet: 30.10.2013 16:46:28<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif"">Betreff: Re: [vpn-help] Only one concurrent session possible / VPN with Netscreen<o:p></o:p></span></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 8.0pt;margin-left:3.75pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt">
<div id="f3b5e402eeb3400b9ed97a8479bb0670">
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0">
<tbody>
<tr>
<td valign="top" style="padding:0in 0in 0in 0in">
<p><span style="font-size:10.0pt;font-family:"Arial","sans-serif"">Hi, <o:p></o:p></span></p>
<p><span style="font-size:10.0pt;font-family:"Arial","sans-serif"">Probably it is ip conflict. How it is set in your shrewsoft? If manualy - change each client to have different ip.<o:p></o:p></span></p>
<p><span style="font-size:10.0pt;font-family:"Arial","sans-serif"">Hope that helps.<o:p></o:p></span></p>
<p><span style="font-size:10.0pt;font-family:"Arial","sans-serif"">Regards<br>
Piotr<o:p></o:p></span></p>
</td>
</tr>
</tbody>
</table>
<div id="_origMsg_">
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif""><o:p> </o:p></span></p>
<div>
<div>
<div>
<div>
<div class="MsoNormal" align="center" style="text-align:center"><span style="font-size:9.0pt;font-family:"Arial","sans-serif"">
<hr size="1" width="100%" align="center">
</span></div>
</div>
</div>
<p class="MsoNormal"><b><span style="font-size:9.0pt;font-family:"Arial","sans-serif"">From:
</span></b><span style="font-size:9.0pt;font-family:"Arial","sans-serif"">J. Schröder <<a href="javascript:return">ponymann@gmail.com</a>>;
<br>
<b>To: </b><<a href="javascript:return">vpn-help@lists.shrew.net</a>>; <br>
<b>Subject: </b>[vpn-help] Only one concurrent session possible / VPN with Netscreen
<br>
<b>Sent: </b>Wed, Oct 30, 2013 3:32:12 PM <o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif""><o:p> </o:p></span></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0">
<tbody>
<tr>
<td valign="top" style="padding:0in 0in 0in 0in">
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif"">Hi there,<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif""> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif"">I setup my Netscreen and Shrewsoft client using the manual at
<a href="https://www.shrew.net/support/Howto_Juniper_SSG">https://www.shrew.net/support/Howto_Juniper_SSG</a>.<br>
I created multiple user accounts. Everything works fine, but it's only possible to connect one user to the Netscreen: When user A is connected and the user B connects to the Netscreen, user A is disconnected.<br>
So, how can I use more than one concurrent session for different users? All user are in the same VPN user group.
<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif""> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif"">Any idea? Thank you!<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif""> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif"">Regards<br>
Johnny<o:p></o:p></span></p>
</div>
</td>
</tr>
</tbody>
</table>
</div>
</div>
</div>
</div>
</blockquote>
</div>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
</blockquote>
</div>
</div>
</body>
</html>