VPN mit NetGear ProSafe Software

[achim]

Hallo!
Ich habe versucht mittels NetGear ProSafe eine VPN-Verbindung herzustellen.
Bin genau nach der Anleitung vorgegangen. Leider kommt keine Verbindung zu Stande.

Die NetGear Software meldet:
10-08: 19:08:41.031 This is a version of NETGEAR ProSafe VPN Client.
10-08: 19:08:41.156 Filter table loaded.
10-08: 19:08:48.312
10-08: 19:08:48.312 My Connections\VPN Stadtwerke - Initiating IKE Phase 1 (IP ADDR=88.117.XXX.XXX)
10-08: 19:08:48.437 My Connections\VPN Stadtwerke - SENDING>>>> ISAKMP OAK MM (SA, VID 2x)
10-08: 19:09:04.171 My Connections\VPN Stadtwerke - message not received! Retransmitting!
10-08: 19:09:04.171 My Connections\VPN Stadtwerke - SENDING>>>> ISAKMP OAK MM (Retransmission)
10-08: 19:09:19.171 My Connections\VPN Stadtwerke - message not received! Retransmitting!
10-08: 19:09:19.171 My Connections\VPN Stadtwerke - SENDING>>>> ISAKMP OAK MM (Retransmission)
10-08: 19:09:34.171 My Connections\VPN Stadtwerke - message not received! Retransmitting!
10-08: 19:09:34.171 My Connections\VPN Stadtwerke - SENDING>>>> ISAKMP OAK MM (Retransmission)
10-08: 19:09:49.171 My Connections\VPN Stadtwerke - Exceeded 3 IKE SA negotiation attempts

[Gerd von Egidy]

Hallo,

Die Meldungen besagen, daß die Gegenstelle nicht antwortet. Kann es vielleicht sein, daß die Firewall auf dem Intranator keine VPN-Verbindungen reinlässt? Wählen Sie unter Netzwerk > Provider > Profile : Firewall eine passende Firewallregelliste aus.

Herzliche Grüße,

v. Egidy

[achim]

Intranator meldet:

Oct 8 19:04:11 intranator ipsec_starter[2250]: Pluto has changed
Oct 8 19:04:11 intranator pluto[8930]: shutting down
Oct 8 19:04:11 intranator pluto[8930]: forgetting secrets
Oct 8 19:04:11 intranator pluto[8930]: "C1": deleting connection
Oct 8 19:04:11 intranator pluto[8930]: "C1_N2": deleting connection
Oct 8 19:04:11 intranator pluto[8930]: "C1_N0": deleting connection
Oct 8 19:04:11 intranator pluto[8930]: shutting down interface eth1/eth1 88.117.XXX.XXX
Oct 8 19:04:11 intranator pluto[8930]: shutting down interface lo/lo 127.0.0.1
Oct 8 19:04:11 intranator pluto[8930]: shutting down interface eth0/eth0 192.168.XXX.XXX
Oct 8 19:04:11 intranator pluto[8930]: shutting down interface eth2/eth2 10.247.XXX.XXX
Oct 8 19:04:11 intranator pluto[361]: Starting Pluto (strongSwan Version 2.8.6 VENDORID KEYRR)
Oct 8 19:04:11 intranator pluto[361]: including NAT-Traversal patch (Version 0.6c)
Oct 8 19:04:11 intranator pluto[361]: ike_alg: Activating OAKLEY_AES_CBC encryption: Ok
Oct 8 19:04:11 intranator pluto[361]: ike_alg: Activating OAKLEY_BLOWFISH_CBC encryption: Ok
Oct 8 19:04:11 intranator pluto[361]: ike_alg: Activating OAKLEY_SERPENT_CBC encryption: Ok
Oct 8 19:04:11 intranator pluto[361]: ike_alg: Activating OAKLEY_SHA2_256 hash: Ok
Oct 8 19:04:11 intranator pluto[361]: ike_alg: Activating OAKLEY_SHA2_384 hash: Ok
Oct 8 19:04:11 intranator pluto[361]: ike_alg: Activating OAKLEY_SHA2_512 hash: Ok
Oct 8 19:04:11 intranator pluto[361]: ike_alg: Activating OAKLEY_TWOFISH_CBC encryption: Ok
Oct 8 19:04:11 intranator pluto[361]: ike_alg: Activating OAKLEY_TWOFISH_CBC_SSH encryption: Ok
Oct 8 19:04:11 intranator pluto[361]: Testing registered IKE encryption algorithms:
Oct 8 19:04:11 intranator pluto[361]: OAKLEY_BLOWFISH_CBC self-test not available
Oct 8 19:04:11 intranator pluto[361]: OAKLEY_3DES_CBC self-test not available
Oct 8 19:04:11 intranator pluto[361]: OAKLEY_AES_CBC self-test not available
Oct 8 19:04:11 intranator generate[357]: ended, no reboot needed
Oct 8 19:04:11 intranator pluto[361]: OAKLEY_SERPENT_CBC self-test not available
Oct 8 19:04:11 intranator pluto[361]: OAKLEY_TWOFISH_CBC self-test not available
Oct 8 19:04:11 intranator pluto[361]: OAKLEY_TWOFISH_CBC_SSH self-test not available
Oct 8 19:04:11 intranator pluto[361]: Testing registered IKE hash algorithms:
Oct 8 19:04:11 intranator pluto[361]: OAKLEY_MD5 hash self-test passed
Oct 8 19:04:11 intranator pluto[361]: OAKLEY_MD5 hmac self-test passed
Oct 8 19:04:11 intranator pluto[361]: OAKLEY_SHA hash self-test passed
Oct 8 19:04:11 intranator pluto[361]: OAKLEY_SHA hmac self-test passed
Oct 8 19:04:11 intranator pluto[361]: OAKLEY_SHA2_256 hash self-test passed
Oct 8 19:04:11 intranator pluto[361]: OAKLEY_SHA2_256 hmac self-test passed
Oct 8 19:04:11 intranator pluto[361]: OAKLEY_SHA2_384 hash self-test passed
Oct 8 19:04:11 intranator pluto[361]: OAKLEY_SHA2_384 hmac self-test passed
Oct 8 19:04:11 intranator pluto[361]: OAKLEY_SHA2_512 hash self-test passed
Oct 8 19:04:11 intranator pluto[361]: OAKLEY_SHA2_512 hmac self-test passed
Oct 8 19:04:11 intranator pluto[361]: All crypto self-tests passed
Oct 8 19:04:11 intranator pluto[361]: Using Linux 2.6 IPsec interface code
Oct 8 19:04:11 intranator pluto[361]: Could not change to directory '/etc/ipsec.d/cacerts'
Oct 8 19:04:11 intranator pluto[361]: Could not change to directory '/etc/ipsec.d/aacerts'
Oct 8 19:04:11 intranator pluto[361]: Could not change to directory '/etc/ipsec.d/ocspcerts'
Oct 8 19:04:11 intranator pluto[361]: Could not change to directory '/etc/ipsec.d/crls'
Oct 8 19:04:11 intranator pluto[361]: listening for IKE messages
Oct 8 19:04:11 intranator pluto[361]: adding interface eth2/eth2 10.247.XXX.XXX:500
Oct 8 19:04:11 intranator pluto[361]: adding interface eth2/eth2 10.247.XXX.XXX:4500
Oct 8 19:04:11 intranator pluto[361]: adding interface eth1/eth1 88.117.XXX.XXX:500
Oct 8 19:04:11 intranator pluto[361]: adding interface eth1/eth1 88.117.XXX.XXX:4500
Oct 8 19:04:11 intranator pluto[361]: adding interface eth0/eth0 192.168.XXX.XXX:500
Oct 8 19:04:11 intranator pluto[361]: adding interface eth0/eth0 192.168.XXX.XXX:4500
Oct 8 19:04:11 intranator pluto[361]: adding interface lo/lo 127.0.0.1:500
Oct 8 19:04:11 intranator pluto[361]: adding interface lo/lo 127.0.0.1:4500
Oct 8 19:04:11 intranator pluto[361]: loading secrets from "/etc/ipsec.secrets"
Oct 8 19:04:11 intranator pluto[361]: loaded private key file '/usr/intranator/keys/private/1.key.pem' (887 bytes)
Oct 8 19:04:11 intranator pluto[361]: loaded private key file '/usr/intranator/keys/private/2.key.pem' (1675 bytes)
Oct 8 19:04:11 intranator pluto[361]: loaded host cert file '/usr/intranator/keys/private/2.cert.pem' (1334 bytes)
Oct 8 19:04:11 intranator pluto[361]: loaded host cert file '/usr/intranator/keys/public/1.pem' (1655 bytes)
Oct 8 19:04:11 intranator pluto[361]: added connection description "C1"
Oct 8 19:04:11 intranator pluto[361]: loaded host cert file '/usr/intranator/keys/private/2.cert.pem' (1334 bytes)
Oct 8 19:04:11 intranator pluto[361]: loaded host cert file '/usr/intranator/keys/public/1.pem' (1655 bytes)
Oct 8 19:04:11 intranator pluto[361]: added connection description "C1_N0"
Oct 8 19:04:11 intranator pluto[361]: loaded host cert file '/usr/intranator/keys/private/2.cert.pem' (1334 bytes)
Oct 8 19:04:11 intranator pluto[361]: loaded host cert file '/usr/intranator/keys/public/1.pem' (1655 bytes)
Oct 8 19:04:11 intranator pluto[361]: added connection description "C1_N2"

[Gerd von Egidy]

Hallo,

der Intranator empfängt keinerlei Meldungen von der Gegenstelle. Spricht auch für die Firewall, siehe oben.

Herzliche Grüße,

v. Egidy

[achim]

Danke für die Info!
Hab die passende Firewall-Regel aktiviert.
Nun geht die Verbindung schon ein Stück weiter, leider bekomme ich noch eine Fehlermeldung.

Fehlermeldung Netgear:
10-09: 09:27:15.531
10-09: 09:27:15.531 My Connections\VPN Stadtwerke - Initiating IKE Phase 1 (IP ADDR=88.117.XXX.XXX)
10-09: 09:27:15.656 My Connections\VPN Stadtwerke - SENDING>>>> ISAKMP OAK MM (SA, VID 2x)
10-09: 09:27:16.015 My Connections\VPN Stadtwerke - RECEIVED<<< ISAKMP OAK MM (SA, VID 4x)
10-09: 09:27:16.125 My Connections\VPN Stadtwerke - Peer supports Dead Peer Detection Version 1.0
10-09: 09:27:16.125 My Connections\VPN Stadtwerke - Peer is NAT-T draft-02 capable
10-09: 09:27:16.125 My Connections\VPN Stadtwerke - Dead Peer Detection enabled
10-09: 09:27:16.140 My Connections\VPN Stadtwerke - SENDING>>>> ISAKMP OAK MM (KE, NON, NAT-D 2x, VID 4x)
10-09: 09:27:16.968 My Connections\VPN Stadtwerke - RECEIVED<<< ISAKMP OAK MM (KE, NON, CERT_REQ, NAT-D 2x)
10-09: 09:27:17.203 My Connections\VPN Stadtwerke - Using configured machine certificate ".....".
10-09: 09:27:17.250 My Connections\VPN Stadtwerke - SENDING>>>> ISAKMP OAK MM *(ID, CERT, CERT_REQ 2x, SIG, NOTIFY:STATUS_REPLAY_STATUS, NOTIFY:STATUS_INITIAL_CONTACT)
10-09: 09:27:17.656 My Connections\VPN Stadtwerke - RECEIVED<<< ISAKMP OAK MM *(ID, CERT, SIG)
10-09: 09:27:17.703 My Connections\VPN Stadtwerke - Established IKE SA
10-09: 09:27:17.703 MY COOKIE bc 64 fd 4 da 12 68 72
10-09: 09:27:17.703 HIS COOKIE 30 58 ee 2f f8 e4 c6 7
10-09: 09:27:17.906
10-09: 09:27:17.906 My Connections\VPN Stadtwerke - Initiating IKE Phase 2 with Client IDs (message id: C0182B82)
10-09: 09:27:17.906 My Connections\VPN Stadtwerke - Initiator = IP ADDR=91.141.XXX.XXX, prot = 0 port = 0
10-09: 09:27:17.906 My Connections\VPN Stadtwerke - Responder = IP SUBNET/MASK=192.168.XXX.XXX/255.255.255.0, prot = 0 port = 0
10-09: 09:27:17.906 My Connections\VPN Stadtwerke - SENDING>>>> ISAKMP OAK QM *(HASH, SA, NON, KE, ID 2x)
10-09: 09:27:18.046 My Connections\VPN Stadtwerke - RECEIVED<<< ISAKMP OAK INFO *(HASH, NOTIFY:INVALID_ID_INFO)
10-09: 09:27:18.046 My Connections\VPN Stadtwerke - Discarding SA negotiation
10-09: 09:27:18.046 My Connections\VPN Stadtwerke - Deleting IKE SA (IP ADDR=88.117.XXX.XXX)
10-09: 09:27:18.046 MY COOKIE bc 64 fd 4 da 12 68 72
10-09: 09:27:18.046 HIS COOKIE 30 58 ee 2f f8 e4 c6 7

[Gerd von Egidy]

Hallo,

das sieht schon wesentlich besser aus.

10-09: 09:27:17.703 My Connections\VPN Stadtwerke - Established IKE SA

Das bedeutet, Phase 1 ist erfolgreich abgeschlossen, die Zertifikate stimmen.

Danach kommt Phase 2 und dort werden die IP-Adressen ausgehandelt:

10-09: 09:27:18.046 My Connections\VPN Stadtwerke - RECEIVED<<< ISAKMP OAK INFO *(HASH, NOTIFY:INVALID_ID_INFO)

Der Intranator akzeptiert die vom Client geforderten Tunnel-Adressen nicht und bricht deshalb die Verbindung ab.

Was haben Sie denn auf der Seite "Tunnel" auf dem Intranator bei der VPN-Verbindung eingestellt?

Versuchen Sie mal bei "Lokales Netz" das Netz 192.168.XXX.XXX/255.255.255.0 einzustellen und bei "Netz auf Gegenseite" dann "Externe IP". Denn es sieht so aus, als ob Ihr Client direkt am Internet hängt und keinen Router vornedran hat.

Herzliche Grüße,

v. Egidy

[achim]

Hallo!
Herzlichen Dank für Ihre Bemühungen.
VPN funktioniert nun. Habe bei VPN -> Tunnel auf Lokale Netze 192....... gestellt.

Ich muss sagen ihr habt einen spitzen Support, findet man wirklich nur ganz selten.
Grosses Lob.
Schönen Tag noch und nochmals Danke.