<div dir="ltr"><div><div>Hi John,<br><br></div>What do you use in Policy Tab for generation level ? <br><br></div>Cheers<br><div><div><div><div><div class="gmail_extra"><br><div class="gmail_quote">On Sat, Mar 18, 2017 at 3:05 PM, John Ellin <span dir="ltr"><<a href="mailto:john@4ccompany.com" target="_blank">john@4ccompany.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi,<br>
<br>
I am attempting to connect an OpenSUSE 42.1 client to my SRX5308.<br>
<br>
Followed the instructions here: <a href="https://www.shrew.net/support/Howto_Netgear" rel="noreferrer" target="_blank">https://www.shrew.net/support/<wbr>Howto_Netgear</a> with the following exceptions:<br>
NAS:<br>
Mode config:<br>
IP Pool Address range: 192.168.128.1 - 192.168.128.16<br>
Local IP Address: <a href="http://192.168.0.0/255.255.252.0" rel="noreferrer" target="_blank">192.168.0.0/255.255.252.0</a><br>
<br>
IKE Policy:<br>
XAuth Authentication Type: Radius - PAP<br>
<br>
Shrew:<br>
Policy:<br>
include <a href="http://192.168.0.0/255.255.252.0" rel="noreferrer" target="_blank">192.168.0.0/255.255.252.0</a><br>
<br>
When I attempt to connect, the VPN client states that the tunnel established, however, the NAS states that the IPSec SA is NOT established.<br>
<br>
Assuming:<br>
<a href="http://remote.client.com" rel="noreferrer" target="_blank">remote.client.com</a> = FQDN of remote client<br>
USER = user id of XAuth authenticating user<br>
XXX.XXX.XXX.XXX = external address of remote client<br>
YYY.YYY.YYY.YYY = external IP address of SRX5308<br>
<br>
The logs from the NAS are as follows (first entry at bottom):<br>
<br>
Fri Mar 17 14:41:38 2017 (GMT -0400): [SRX5308] [IKE] INFO: 192.168.128.1 IP address has been released by remote peer.<br>
Fri Mar 17 14:41:37 2017 (GMT -0400): [SRX5308] [IKE] INFO: ISAKMP-SA deleted for YYY.YYY.YYY.YYY[4500]-XXX.XXX.<wbr>XXX.XXX[34224] with spi:8ae7e3cde8560bbb:<wbr>bb87af718d22be29<br>
Fri Mar 17 14:41:36 2017 (GMT -0400): [SRX5308] [IKE] INFO: XAuthUser USER Logged Out from IP Address XXX.XXX.XXX.XXX<br>
Fri Mar 17 14:41:36 2017 (GMT -0400): [SRX5308] [IKE] INFO: Purged ISAKMP-SA with proto_id=ISAKMP and spi=8ae7e3cde8560bbb:<wbr>bb87af718d22be29.<br>
<br>
Fri Mar 17 14:40:46 2017 (GMT -0400): [SRX5308] [IKE] ERROR: Ignored attribute 28680<br>
Fri Mar 17 14:40:46 2017 (GMT -0400): [SRX5308] [IKE] ERROR: Ignored attribute 28677<br>
Fri Mar 17 14:40:46 2017 (GMT -0400): [SRX5308] [IKE] ERROR: Cannot open "/etc/motd"<br>
Fri Mar 17 14:40:46 2017 (GMT -0400): [SRX5308] [IKE] ERROR: Ignored attribute 28674<br>
Fri Mar 17 14:40:46 2017 (GMT -0400): [SRX5308] [IKE] WARNING: Ignored attribute 5<br>
Fri Mar 17 14:40:46 2017 (GMT -0400): [SRX5308] [IKE] INFO: 192.168.128.1 IP address is assigned to remote peer XXX.XXX.XXX.XXX[34224]<br>
Fri Mar 17 14:40:46 2017 (GMT -0400): [SRX5308] [IKE] INFO: Received attribute type "ISAKMP_CFG_REQUEST" from XXX.XXX.XXX.XXX[34224]<br>
Fri Mar 17 14:40:46 2017 (GMT -0400): [SRX5308] [IKE] INFO: XAuthUser USER Logged In from IP Address XXX.XXX.XXX.XXX<br>
Fri Mar 17 14:40:46 2017 (GMT -0400): [SRX5308] [IKE] INFO: Login succeeded for user "USER"<br>
Fri Mar 17 14:40:46 2017 (GMT -0400): [SRX5308] [IKE] INFO: Contacting RADIUS for authenticating user "USER" using PAP<br>
Fri Mar 17 14:40:46 2017 (GMT -0400): [SRX5308] [IKE] INFO: Received attribute type "ISAKMP_CFG_REPLY" from XXX.XXX.XXX.XXX[34224]<br>
Fri Mar 17 14:40:46 2017 (GMT -0400): [SRX5308] [IKE] INFO: ISAKMP-SA established for YYY.YYY.YYY.YYY[4500]-XXX.XXX.<wbr>XXX.XXX[34224] with spi:8ae7e3cde8560bbb:<wbr>bb87af718d22be29<br>
Fri Mar 17 14:40:46 2017 (GMT -0400): [SRX5308] [IKE] INFO: Sending Xauth request to XXX.XXX.XXX.XXX[34224]<br>
Fri Mar 17 14:40:46 2017 (GMT -0400): [SRX5308] [IKE] INFO: NAT detected: Local is behind a NAT device. and alsoPeer is behind a NAT device<br>
Fri Mar 17 14:40:46 2017 (GMT -0400): [SRX5308] [IKE] INFO: NAT-D payload does not match for XXX.XXX.XXX.XXX[34224]<br>
Fri Mar 17 14:40:46 2017 (GMT -0400): [SRX5308] [IKE] INFO: NAT-D payload does not match for YYY.YYY.YYY.YYY[4500]<br>
Fri Mar 17 14:40:46 2017 (GMT -0400): [SRX5308] [IKE] INFO: For XXX.XXX.XXX.XXX[63293], Selected NAT-T version: RFC 3947Fri Mar 17 14:40:46 2017 (GMT -0400): [SRX5308] [IKE] INFO: Floating ports for NAT-T with peer XXX.XXX.XXX.XXX[34224]<br>
Fri Mar 17 14:40:46 2017 (GMT -0400): [SRX5308] [IKE] INFO: Received unknown Vendor ID<br>
Fri Mar 17 14:40:46 2017 (GMT -0400): [SRX5308] [IKE] INFO: Received unknown Vendor ID<br>
Fri Mar 17 14:40:46 2017 (GMT -0400): [SRX5308] [IKE] INFO: Received unknown Vendor ID<br>
Fri Mar 17 14:40:46 2017 (GMT -0400): [SRX5308] [IKE] INFO: Received Vendor ID: DPD<br>
Fri Mar 17 14:40:46 2017 (GMT -0400): [SRX5308] [IKE] INFO: Received Vendor ID: DPD<br>
Fri Mar 17 14:40:46 2017 (GMT -0400): [SRX5308] [IKE] INFO: Received unknown Vendor ID<br>
Fri Mar 17 14:40:46 2017 (GMT -0400): [SRX5308] [IKE] INFO: Received Vendor ID: RFC 3947<br>
Fri Mar 17 14:40:46 2017 (GMT -0400): [SRX5308] [IKE] INFO: Received unknown Vendor ID<br>
Fri Mar 17 14:40:46 2017 (GMT -0400): [SRX5308] [IKE] INFO: Received Vendor ID: draft-ietf-ipsec-nat-t-ike-02<br>
Fri Mar 17 14:40:46 2017 (GMT -0400): [SRX5308] [IKE] INFO: Received unknown Vendor ID<br>
Fri Mar 17 14:40:46 2017 (GMT -0400): [SRX5308] [IKE] INFO: Received unknown Vendor ID<br>
Fri Mar 17 14:40:46 2017 (GMT -0400): [SRX5308] [IKE] INFO: Received Vendor ID: draft-ietf-ipsra-isakmp-xauth-<wbr>06.txt<br>
Fri Mar 17 14:40:46 2017 (GMT -0400): [SRX5308] [IKE] INFO: Beginning Aggressive mode.<br>
Fri Mar 17 14:40:46 2017 (GMT -0400): [SRX5308] [IKE] INFO: Received request for new phase 1 negotiation: YYY.YYY.YYY.YYY[500]<=>XXX.<wbr>XXX.XXX.XXX[63293]<br>
Fri Mar 17 14:40:46 2017 (GMT -0400): [SRX5308] [IKE] INFO: Remote configuration for identifier "<a href="http://remote.client.com" rel="noreferrer" target="_blank">remote.client.com</a>" found<br>
<br>
Additionally, the routing table on the client contains an entry for the external IP address of the NAS (which I was not expecting) but contains no entry for <a href="http://192.168.0.0/22" rel="noreferrer" target="_blank">192.168.0.0/22</a>.<br>
<br>
Any help would be greatly appreciated.<br>
<br>
--<br>
<br>
/jona.<br>
<br>
<br>
______________________________<wbr>_________________<br>
vpn-help mailing list<br>
<a href="mailto:vpn-help@lists.shrew.net">vpn-help@lists.shrew.net</a><br>
<a href="https://lists.shrew.net/mailman/listinfo/vpn-help" rel="noreferrer" target="_blank">https://lists.shrew.net/<wbr>mailman/listinfo/vpn-help</a><br>
</blockquote></div><br></div></div></div></div></div></div>