<div dir="ltr">Hello ,<div>I am new to strongswan and Juniper Netscreen SSG5 . Trying to setup VPN IPSec ESP tunnel as described below. Please help me resolve problem with my configuration.</div><div style><br></div><div style>
<div><br></div><div>1) IPSec Gateway 1 </div><div><br></div><div> Hardware version: 710</div><div> Software version: 6.1.0r5.0</div><div><br></div><div>2) IPSec Gateway 2 running</div><div> Linux 2.6.32. Strongswan</div>
<div><br></div><div>3) Setup Diagram :</div><div>(Remote Host)---(linux-GW1-strongswan)==UNTRUSTED==(0/0 netscreen GW2 0/3)---(Local Host)</div><div>(10.1.0.10)-----(10.1.0.1 , <a href="http://192.168.0.1/24)======(192.168.0.2/24">192.168.0.1/24)======(192.168.0.2/24</a>, 10.2.0.1)---(10.2.0.10)</div>
<div><br></div><div><br></div><div>Set Netscreen SSG5 device to factory default settings.<br></div><div style>First tried to setup SSG5 using wizard as follows</div><div><br></div><div><br></div><div>4) Went to Network->interfaces->list and found that </div>
<div> ethernet0/3 in "bgroup0" and in "Zone TRUST" but cannot assign IP address</div><div><br></div><div><br></div><div>5) From Wizards->Switch Port moved ethernet0/3 to "Not in Bgroup"</div>
<div> </div><div><br></div><div>6) For ethernet0/3 - Changed "Zone Name" to Trust and assigned IP <a href="http://10.2.0.10/24">10.2.0.10/24</a></div><div><br></div><div><br></div><div>7) ethernet0/0 is already in Zone Untrust - assigned <a href="http://192.168.0.1/24">192.168.0.1/24</a></div>
<div><br></div><div><br></div><div>8) Using VPN Wizard - </div><div> Zones - Local site: Trust , Remote Site: Untrust</div><div> Make a new Tunnel interface.</div><div> Bind to unnumbered interface ethernet0/0 (trust-vr)</div>
<div> LAN-to-LAN VPN tunnel</div><div> Local & remote Gateway IP address types</div><div> local static IP <-> Remote Static IP</div>
<div> Outgoing interface etherne0/0</div><div> Remote gatway IP address : 192.168.0.1</div><div> Preshared Secret for this tunnel : "juniper"</div>
<div> Local Host Address : 10.2.0.10</div><div> Remote Host Address : 10.1.0.10</div><div> Service: ANY , Policy Created for: Both Direction </div>
<div> Enable Logging</div><div> Schedule: None</div><div><br></div><div>9) Using netscreen CLI -</div><div> "set ike accept-all-proposal"</div><div>
<br></div><div>10) On linux gateway strongswan.conf </div><div> charon {</div><div> load = aes des sha1 sha2 md5 gmp random nonce hmac stroke kernel-netlink socket-default updown</div><div> multiple_authentication = no</div>
<div> }</div><div><br></div><div><br></div><div>11) ipsec.conf</div><div> cat ipsec.conf</div><div><br></div><div><br></div><div> config setup</div><div><br></div><div> conn %default</div><div> ikelifetime=60m</div>
<div> keylife=20m</div><div> rekeymargin=3m</div><div> keyingtries=1</div><div> authby=secret</div><div> keyexchange=ikev1</div><div> mobike=no</div><div><br></div><div> conn host-host</div>
<div> left=192.168.0.1</div><div> authby=secret</div><div> leftid=192.168.0.1</div><div> right=192.168.0.2 </div><div> rightid=192.168.0.2</div><div> type=transport</div><div> auto=add</div>
<div> </div><div> conn net-net</div><div> left=192.168.0.1</div><div> leftsubnet=<a href="http://10.1.0.0/16">10.1.0.0/16</a></div><div> leftid=192.168.0.1</div><div> right=192.168.0.2</div>
<div> rightsubnet=<a href="http://10.2.0.0/16">10.2.0.0/16</a></div><div> rightid=192.168.0.2</div><div> auto=route</div><div><br></div><div>12) cat ipsec.secrets</div><div>: PSK "juniper"</div>
<div><br></div><div>13) Then Sent ping from remote host. GW1 strongswan triggered IKE</div><div><br></div><div>14) But IKE negotiation fails. Netscreen has following in its log.</div><div><br></div><div>sun-> get event</div>
<div>Total event entries = 948</div><div>Date Time Module Level Type Description</div><div>2013-05-24 05:27:41 system info 00536 IKE 192.168.0.1 Phase 2 msg ID</div><div> 93417de2: Negotiations have failed.</div>
<div>2013-05-24 05:27:41 system info 00536 Rejected an IKE packet on ethernet0/0</div><div> from <a href="http://192.168.0.1:500">192.168.0.1:500</a> to <a href="http://192.168.0.2">192.168.0.2</a>:</div>
<div> 500 with cookies c2f82805f5e7033f and</div><div> e67f479f2b77804b because The peer sent</div><div> a proxy ID that did not match the one</div>
<div> in the SA config</div><div><br></div><div>Questions:</div><div> What is the meaning of proxy ID? </div><div> Where in strongswan configuration </div><div> should I make changes to so that netscreen does'nt complain about proxy ID ?</div>
<div> </div><div><br></div><div style>regards</div><div style>vikas </div><div><br></div></div></div>