Hello, i am trying new Juniper in my branch-office and i can't understad whats wrong (it's 5 branch with ipsev vpn, so i was expecting that everything will smoothly).
I tried to set up to ipsec tunnels, and got two diffrent errors.
1st:
Jan 29 20:43:07 Moscow-NO kmd[2046]: IKE negotiation failed with error: SA unusable. IKE Version: 1, VPN: ipsec- vpn-cfgr Gateway: ike-gate-cfgr, Local: 83.234.107.110/500, Remote: 217.12.253.226/500, Local IKE-ID: Not-Availab le, Remote IKE-ID: Not-Available, VR-ID: 0
2nd:
Jan 29 20:43:13 Moscow-NO kmd[2046]: IKE negotiation failed with error: No proposal chosen. IKE Version: 1, VPN: vpn-no-pod Gateway: gw-no-pod, Local: 83.234.107.110/500, Remote: 62.176.7.74/500, Local IKE-ID: Not-Available, Remote IKE-ID: Not-Available, VR-ID: 0
So, new one can't connect to any on existing routers, but provides diffrent errors for them...
on each host is done...
set security zones security-zone untrust host-inbound-traffic system-services ike
Config on new host:
ike
traceoptions { file ike-debug; flag all; } policy ike-policy-cfgr { mode main; proposal-set standard; pre-shared-key ascii-text "123"; ## SECRET-DATA } policy policy-no-pod { mode main; proposal-set standard; pre-shared-key ascii-text "123"; ## SECRET-DATA } gateway ike-gate-cfgr { ike-policy ike-policy-cfgr; address 217.12.253.226; dead-peer-detection { always-send; interval 20; threshold 5; } local-identity inet 83.234.107.110; external-interface fe-0/0/0.0; version v1-only; } gateway gw-no-pod { ike-policy policy-no-pod; address 62.176.7.74; dead-peer-detection { always-send; interval 20; threshold 5; } external-interface fe-0/0/0.0; version v1-only; } ipsec vpn-monitor-options { interval 10; threshold 10; } policy ipsec-policy-cfgr { perfect-forward-secrecy { keys group2; } proposal-set standard; } policy pol-no-pod { perfect-forward-secrecy { keys group2; } proposal-set standard; } vpn ipsec-vpn-cfgr { bind-interface st0.0; vpn-monitor { optimized; } ike { gateway ike-gate-cfgr; ipsec-policy ipsec-policy-cfgr; } establish-tunnels immediately; } vpn vpn-no-pod { bind-interface st0.1; vpn-monitor { optimized; } ike { gateway gw-no-pod; ipsec-policy pol-no-pod; } establish-tunnels immediately; }
1st "old host":
ike
policy ike-policy-cfgr { mode main; proposal-set standard; pre-shared-key ascii-text "123"; ## SECRET-DATA } gateway ike-gate-cfgr { ike-policy ike-policy-cfgr; address 83.243.107.110; dead-peer-detection { always-send; interval 20; threshold 5; } external-interface vlan.8; version v1-only; }
ipsec vpn-monitor-options { interval 10; threshold 10; } policy ipsec-policy-cfgr { perfect-forward-secrecy { keys group2; } proposal-set standard; } vpn ipsec-vpn-cfgr { bind-interface st0.1; vpn-monitor { optimized; } ike { gateway ike-gate-cfgr; ipsec-policy ipsec-policy-cfgr; } establish-tunnels immediately; }
2nd old host:
ike policy policy-pod-no { mode main; proposal-set standard; pre-shared-key ascii-text "123"; ## SECRET-DATA } gateway gw-pod-no { ike-policy policy-pod-no; address 83.234.107.110; dead-peer-detection { always-send; interval 20; threshold 5; } external-interface fe-0/0/0.0; version v1-only; } ipsec vpn-monitor-options { interval 10; threshold 10; } policy pol-pod-no { perfect-forward-secrecy { keys group2; } proposal-set standard; } vpn vpn-pod-no { bind-interface st0.6; vpn-monitor { optimized; } ike { gateway gw-pod-no; ipsec-policy pol-pod-no; } establish-tunnels immediately; }
Both "old" SRX devices connected through ipsec vpn with each other.