Hi,
I have purchased a SRX320 to replace a working Netscreen-25 which is used as a VPN concentrator. I cannot get the config to work, here is from the kmd-logs (I masked the IP addresses in the logs, x.x.x.x is my public IP, y.y.y.y is the remote side:
IKE negotiation failed with error: IKE gateway configuration lookup failed during negotiation. IKE Version: 1, VPN: Not-Available Gateway: Not-Available, Local: x.x.x.x/500, Remote: y.y.y.y/500, Local IKE-ID: Not-Available, Remote IKE-ID: Not-Available, VR-ID: 0: Role: Responder
The initiator is on the remote side.
Part of my config:
# show security ike
traceoptions {
file ike-debug;
flag all;
}
proposal smartbox-proposal {
authentication-method pre-shared-keys;
dh-group group2;
authentication-algorithm sha1;
encryption-algorithm 3des-cbc;
}
policy ike-dyn-vpn-policy {
mode aggressive;
proposals smartbox-proposal;
pre-shared-key ascii-text "$9$VvYaGDikfTFYg3/AuIRlevw2GjHsYP5QnpuKM8Xs24jk.4o/Cp0RE-VbwaU.P56/AZU"; ## SECRET-DATA
}
gateway dyn-vpn-local-gw {
ike-policy ike-dyn-vpn-policy;
dynamic {
hostname dynvpn;
connections-limit 10;
ike-user-type group-ike-id;
}
external-interface ge-0/0/0.0;
xauth {
access-profile access-profile-smartbox;
}
}
# show security ipsec
traceoptions {
flag all;
}
proposal smartbox-phase2 {
protocol esp;
authentication-algorithm hmac-sha1-96;
encryption-algorithm 3des-cbc;
lifetime-seconds 600;
}
policy ipsec-dyn-vpn-policy {
proposals smartbox-phase2;
}
vpn dyn-vpn {
bind-interface st0.0;
ike {
gateway dyn-vpn-local-gw;
ipsec-policy ipsec-dyn-vpn-policy;
}
establish-tunnels immediately;
}
The IKE SA shows:
> show security ike sa detail
IKE peer y.y.y.y, Index 401858
Role: Responder, State: DOWN
Initiator cookie: 8bba78cf71fcc127, Responder cookie: 051fc7e75b033b82
Exchange type: Unknown, Authentication method: Unknown
:500, Remote: y.y.y.y:500
Reauth Lifetime: Disabled
Xauth assigned IP: 0.0.0.0
Algorithms:
Authentication : (null)
Diffie-Hellman group : unknown
Traffic statistics:
Input bytes : 396
Output bytes : 102
Input packets: 1
Output packets: 1
IPSec security associations: 0 created, 0 deleted
Phase 2 negotiations in progress: 0
Flags: IKE SA is created
