VPN tussen 2 locaties met 2x FVS336G

[Verwijderd]

Hallo,
Misschien dat jullie me een eindje op weg kunnen helpen?
Ik heb de volgende post ook in een USA forum gepost, vandaar dat hij in het engels is:

I've got a problem establishing a VPN connection between 2 locations. I call them Location A and Location B.
Location A has a ZyXEL P-2602h-d1a modem with a Netgear FVS336G,
Location B has a Netgear DG834B modem with a second Netgear FVS336g
I've drawn a situation schets:



When I go over VPN, Connection status, and I click connect, I constantly get the "Invalid SA protocol type: 0_" messeage.

Following detailed information about Location A and Location B.

Location A
ZyXel Modem setup:




Netgear FVS336G setup:





VPN Log:

2008 Dec 16 17:40:10 [FVS336G] [IKE] accept a request to establish IKE-SA: 195.240.118.xx_
2008 Dec 16 17:40:10 [FVS336G] [IKE] Configuration found for 195.240.118.xx._
2008 Dec 16 17:40:10 [FVS336G] [IKE] Initiating new phase 1 negotiation: 192.168.1.5[500]<=>195.240.118.xx[500]_
2008 Dec 16 17:40:10 [FVS336G] [IKE] Beginning Identity Protection mode._
2008 Dec 16 17:40:41 [FVS336G] [IKE] Invalid SA protocol type: 0_
2008 Dec 16 17:40:41 [FVS336G] [IKE] Phase 2 negotiation failed due to time up waiting for phase1. _
2008 Dec 16 17:41:10 [FVS336G] [IKE] Phase 1 negotiation failed due to time up for 195.240.118.xx[500].20b53e474b05148b:0000000000000000_

Location B
Netgear DG834B Modem setup:



Modem logfile:

Tue, 2008-12-16 10:17:37 - UDP Packet - Source:82.168.51.xx,500 Destination:195.240.118.xx,500 - [VPN-IPSEC rule match]
Tue, 2008-12-16 10:23:43 - UDP Packet - Source:82.168.51.xx,500 Destination:195.240.118.xx,500 - [VPN-IPSEC rule match]
Tue, 2008-12-16 10:35:58 - UDP Packet - Source:82.168.51.xx,500 Destination:195.240.118.xx,500 - [VPN-IPSEC rule match]
Tue, 2008-12-16 10:42:05 - UDP Packet - Source:82.168.51.xx,500 Destination:195.240.118.xx,500 - [VPN-IPSEC rule match]
Tue, 2008-12-16 10:54:18 - UDP Packet - Source:82.168.51.xx,500 Destination:195.240.118.xx,500 - [VPN-IPSEC rule match]
Tue, 2008-12-16 11:06:33 - UDP Packet - Source:82.168.51.xx,500 Destination:195.240.118.xx,500 - [VPN-IPSEC rule match]
Tue, 2008-12-16 11:12:40 - UDP Packet - Source:82.168.51.xx,500 Destination:195.240.118.xx,500 - [VPN-IPSEC rule match]
Tue, 2008-12-16 11:24:53 - UDP Packet - Source:82.168.51.xx,500 Destination:195.240.118.xx,500 - [VPN-IPSEC rule match]
Tue, 2008-12-16 11:31:01 - UDP Packet - Source:82.168.51.xx,500 Destination:195.240.118.xx,500 - [VPN-IPSEC rule match]
Tue, 2008-12-16 11:43:15 - UDP Packet - Source:82.168.51.xx,500 Destination:195.240.118.xx,500 - [VPN-IPSEC rule match]
Tue, 2008-12-16 13:16:37 - UDP Packet - Source:82.168.51.xx,500 Destination:195.240.118.xx,500 - [VPN-IPSEC rule match]
Tue, 2008-12-16 13:24:52 - UDP Packet - Source:82.168.51.xx,500 Destination:195.240.118.xx,500 - [VPN-IPSEC rule match]
Tue, 2008-12-16 13:30:38 - UDP Packet - Source:82.168.51.xx,500 Destination:195.240.118.xx,500 - [VPN-IPSEC rule match]
Tue, 2008-12-16 16:28:55 - UDP Packet - Source:82.168.51.xx,500 Destination:195.240.118.xx,500 - [VPN-IPSEC rule match]
Tue, 2008-12-16 16:58:27 - UDP Packet - Source:82.168.51.xx,500 Destination:195.240.118.xx,500 - [VPN-IPSEC rule match]
Tue, 2008-12-16 17:09:44 - UDP Packet - Source:82.168.51.xx,500 Destination:195.240.118.xx,500 - [VPN-IPSEC rule match]
Tue, 2008-12-16 17:17:47 - UDP Packet - Source:82.168.51.xx,500 Destination:195.240.118.xx,500 - [VPN-IPSEC rule match]
Tue, 2008-12-16 17:24:50 - UDP Packet - Source:82.168.51.xx,500 Destination:195.240.118.xx,500 - [VPN-IPSEC rule match]
Tue, 2008-12-16 17:31:41 - UDP Packet - Source:82.168.51.xx,500 Destination:195.240.118.xx,500 - [VPN-IPSEC rule match]
Tue, 2008-12-16 17:40:34 - UDP Packet - Source:82.168.51.xx,500 Destination:195.240.118.xx,500 - [VPN-IPSEC rule match]

Netgear FVS336G setup:





VPN Log:

2008 Dec 16 17:05:57 [FVS336G] [IKE] accept a request to establish IKE-SA: 82.168.51.xx_
2008 Dec 16 17:05:57 [FVS336G] [IKE] Configuration found for 82.168.51.xx._
2008 Dec 16 17:05:57 [FVS336G] [IKE] Initiating new phase 1 negotiation: 192.168.1.5[500]<=>82.168.51.xx[500]_
2008 Dec 16 17:05:57 [FVS336G] [IKE] Beginning Identity Protection mode._
2008 Dec 16 17:06:28 [FVS336G] [IKE] Invalid SA protocol type: 0_
2008 Dec 16 17:06:28 [FVS336G] [IKE] Phase 2 negotiation failed due to time up waiting for phase1. _
2008 Dec 16 17:06:57 [FVS336G] [IKE] Phase 1 negotiation failed due to time up for 82.168.51.xx[500].d4a8531a6413a413:0000000000000000_

Can someone please help me? What am I doing wrong?

Thanks in advance.

[LuckY]

Welkom op Got :W


Kom het niet gewoon dat beiden Firewall/routers het zelfde ip krijgen over het wan ? (192.168.1.5)
en is het niet mogelijk die modem's in bridging te zetten dat ze op je router binnenkomen ?

offtopic:
En die 10 regels kan je niet in het nederlands typen ?

[ Voor 57% gewijzigd door LuckY op 17-12-2008 21:08 ]

[Equator]

Ten eerste: GoT is geen helpdesk, PNS al helemaal niet. Het dumpen van 13 screenshots en een bak met logging is nou niet echt de bedoeling.
Ten tweede is GoT een nederlands forum. Had je nou niet 3 minuten tijd kunnen nemen om de tekst in het NL te vertalen:?

Tenslotte is het vrij lastig routeren tussen 2 vestigingen waar hetzelfde IP subnet wordt gebruikt. IPsec krijgt de SA dan ook niet goed voor elkaar.. Verder gebruik je ook het zelfde IP voor beide routers (binnen de tunnel).
Het lijkt me dat je je eens in zou moeten lezen in hoe routing in zijn werk gaat

[ Voor 5% gewijzigd door Equator op 18-12-2008 08:09 ]