I am attempting to get a working configuration that will allow the 'road scholars' (as opposed to 'road warriors') at my company use the current Shrew Soft VPN client software to create an IPSec VPN with our Vyatta router. We are using the Vyatta VSE6.5R3 x64 OS. I will be happy to share the final, working configuration settings with your users, assuming I can get this working. We have paid-for support with Vyatta, so if I can get a few questions answered, I believe I have a good chance of making this work.
(1) Much like the Vyatta to Cisco ASA connections, I need to configure "no-xauth" and "no-config-mode" at both ends of the Vyatta-to-Shrewsoft tunnel. (Vyatta does not currently support either "xauth" or "config-mode" when setting up the tunnel.) The documentation for your latest VPN client (ver. 2.1.7) connection to Cisco ASA shows the " re-xauth disable " setting. I wish to be certain this will completely disable "xauth". (2) Similar to question (1), how do I completely disable the "config-mode" on this client? (Again, Vyatta does not currently support "config-mode".) (3) I need to use a pre-shared-key, at least at first. Is there a setting that requires Main Mode to be used rather than Aggressive Mode? The Vyatta OS will not use Aggressive Mode for the RA sessions. (4) If I have multiple users authenticate with separate usernames and passwords, do I need to use a single PSK for all RA users, or can I set up unique PSKs for each user? (5) The debug messages state " 13/04/22 11:53:01 DB : phase1 found 13/04/22 11:53:01 ii : processing informational packet ( 92 bytes ) 13/04/22 11:53:01 == : new informational iv ( 16 bytes ) 13/04/22 11:53:01 =< : cookies 16adb235e902b8cf:1bbf7eaa4ce7f460 13/04/22 11:53:01 =< : message 4839f1be 13/04/22 11:53:01 =< : decrypt iv ( 16 bytes ) 13/04/22 11:53:01 == : decrypt packet ( 92 bytes ) 13/04/22 11:53:01 <= : trimmed packet padding ( 8 bytes ) 13/04/22 11:53:01 <= : stored iv ( 16 bytes ) 13/04/22 11:53:01 << : hash payload 13/04/22 11:53:01 << : notification payload 13/04/22 11:53:01 == : informational hash_i ( computed ) ( 20 bytes ) 13/04/22 11:53:01 == : informational hash_c ( received ) ( 20 bytes ) 13/04/22 11:53:01 ii : informational hash verified 13/04/22 11:53:01 ii : received peer DPDV1-R-U-THERE-ACK notification 13/04/22 11:53:01 ii : - 111.222.333.444:500 -> 10.17.9.17:500 13/04/22 11:53:01 ii : - isakmp spi = 16adb235e902b8cf:1bbf7eaa4ce7f460 13/04/22 11:53:01 ii : - data size 4 13/04/22 11:53:01 ii : DPD ARE-YOU-THERE-ACK sequence 1dfca67e accepted 13/04/22 11:53:01 ii : next tunnel DPD request in 15 secs for peer 111.222.333.444:500 13/04/22 11:53:16 DB : phase1 found 13/04/22 11:53:16 ii : sending peer DPDV1-R-U-THERE notification 13/04/22 11:53:16 ii : - 10.17.9.17:500 -> 111.222.333.444:500 13/04/22 11:53:16 ii : - isakmp spi = 16adb235e902b8cf:1bbf7eaa4ce7f460 13/04/22 11:53:16 ii : - data size 4 13/04/22 11:53:16 >> : hash payload 13/04/22 11:53:16 >> : notification payload 13/04/22 11:53:16 == : new informational hash ( 20 bytes ) 13/04/22 11:53:16 == : new informational iv ( 16 bytes ) 13/04/22 11:53:16 >= : cookies 16adb235e902b8cf:1bbf7eaa4ce7f460 13/04/22 11:53:16 >= : message 47019083 13/04/22 11:53:16 >= : encrypt iv ( 16 bytes ) 13/04/22 11:53:16 == : encrypt packet ( 84 bytes ) 13/04/22 11:53:16 == : stored iv ( 16 bytes ) 13/04/22 11:53:16 -> : send IKE packet 10.17.9.17:500 ->111.222.333.444:500 ( 120 bytes ) 13/04/22 11:53:16 ii : DPD ARE-YOU-THERE sequence 1dfca67f requested 13/04/22 11:53:16 <- : recv IKE packet 111.222.333.444:500 -> 10.17.9.17:500( 92 bytes ) 13/04/22 11:53:16 DB : phase1 found 13/04/22 11:53:16 ii : processing informational packet ( 92 bytes ) 13/04/22 11:53:16 == : new informational iv ( 16 bytes ) 13/04/22 11:53:16 =< : cookies 16adb235e902b8cf:1bbf7eaa4ce7f460 13/04/22 11:53:16 =< : message 27d6214b 13/04/22 11:53:16 =< : decrypt iv ( 16 bytes ) 13/04/22 11:53:16 == : decrypt packet ( 92 bytes ) 13/04/22 11:53:16 <= : trimmed packet padding ( 8 bytes ) 13/04/22 11:53:16 <= : stored iv ( 16 bytes ) 13/04/22 11:53:16 << : hash payload 13/04/22 11:53:16 << : notification payload 13/04/22 11:53:16 == : informational hash_i ( computed ) ( 20 bytes ) 13/04/22 11:53:16 == : informational hash_c ( received ) ( 20 bytes ) 13/04/22 11:53:16 ii : informational hash verified 13/04/22 11:53:16 ii : received peer DPDV1-R-U-THERE-ACK notification 13/04/22 11:53:16 ii : - 111.222.333.444:500 -> 10.17.9.17:500 13/04/22 11:53:16 ii : - isakmp spi = 16adb235e902b8cf:1bbf7eaa4ce7f460 13/04/22 11:53:16 ii : - data size 4 13/04/22 11:53:16 ii : DPD ARE-YOU-THERE-ACK sequence 1dfca67f accepted 13/04/22 11:53:16 ii : next tunnel DPD request in 15 secs for peer 111.222.333.444:500 13/04/22 11:53:18 K< : recv pfkey ACQUIRE UNSPEC message 13/04/22 11:53:18 DB : policy found 13/04/22 11:53:18 ii : ignoring init phase2 by acquire, tunnel is nailed 13/04/22 11:53:25 <A : peer tunnel disable message 13/04/22 11:53:25 DB : policy found 13/04/22 11:53:25 ii : removing IPSEC INBOUND policy ANY:0.0.0.0/0:* -> ANY:10.17.9.17:* 13/04/22 11:53:25 K> : send pfkey X_SPDDELETE2 UNSPEC message 13/04/22 11:53:25 DB : policy found 13/04/22 11:53:25 ii : removing IPSEC OUTBOUND policy ANY:10.17.9.17:* -> ANY:0.0.0.0/0:* 13/04/22 11:53:25 K> : send pfkey X_SPDDELETE2 UNSPEC message 13/04/22 11:53:25 K< : recv pfkey X_SPDDELETE2 UNSPEC message 13/04/22 11:53:25 DB : policy found 13/04/22 11:53:25 ii : removing NONE INBOUND policy ANY:10.17.1.1:* -> ANY:10.17.9.17:* 13/04/22 11:53:25 K> : send pfkey X_SPDDELETE2 UNSPEC message 13/04/22 11:53:25 DB : policy found 13/04/22 11:53:25 ii : removing NONE OUTBOUND policy ANY:10.17.9.17:* -> ANY:10.17.1.1:* 13/04/22 11:53:25 K> : send pfkey X_SPDDELETE2 UNSPEC message 13/04/22 11:53:25 DB : policy found 13/04/22 11:53:25 ii : removing NONE INBOUND policy ANY:111.222.333.444:* -> ANY:10.17.9.17:* 13/04/22 11:53:25 K> : send pfkey X_SPDDELETE2 UNSPEC message 13/04/22 11:53:25 DB : policy found 13/04/22 11:53:25 ii : removing NONE OUTBOUND policy ANY:10.17.9.17:* -> ANY:111.222.333.444:* 13/04/22 11:53:25 K> : send pfkey X_SPDDELETE2 UNSPEC message 13/04/22 11:53:25 ii : removed NONE policy route for ANY:111.222.333.444:* 13/04/22 11:53:25 DB : policy found 13/04/22 11:53:25 DB : policy deleted ( obj count = 5 ) 13/04/22 11:53:25 K< : recv pfkey X_SPDDELETE2 UNSPEC message 13/04/22 11:53:25 DB : policy found 13/04/22 11:53:25 K< : recv pfkey X_SPDDELETE2 UNSPEC message 13/04/22 11:53:25 DB : policy found 13/04/22 11:53:25 DB : policy deleted ( obj count = 4 ) 13/04/22 11:53:25 K< : recv pfkey X_SPDDELETE2 UNSPEC message 13/04/22 11:53:25 DB : policy found 13/04/22 11:53:25 DB : policy deleted ( obj count = 3 ) 13/04/22 11:53:25 K< : recv pfkey X_SPDDELETE2 UNSPEC message 13/04/22 11:53:25 DB : policy found 13/04/22 11:53:25 DB : policy deleted ( obj count = 2 ) 13/04/22 11:53:25 K< : recv pfkey X_SPDDELETE2 UNSPEC message 13/04/22 11:53:25 DB : policy found 13/04/22 11:53:25 DB : policy deleted ( obj count = 1 ) 13/04/22 11:53:25 DB : tunnel dpd event canceled ( ref count = 4 ) 13/04/22 11:53:25 DB : tunnel stats event canceled ( ref count = 3 ) 13/04/22 11:53:25 DB : removing tunnel config references 13/04/22 11:53:25 DB : config deleted ( obj count = 0 ) 13/04/22 11:53:25 DB : removing tunnel phase2 references 13/04/22 11:53:25 DB : removing tunnel phase1 references 13/04/22 11:53:25 DB : phase1 soft event canceled ( ref count = 3 ) 13/04/22 11:53:25 DB : phase1 hard event canceled ( ref count = 2 ) 13/04/22 11:53:25 DB : phase1 dead event canceled ( ref count = 1 ) 13/04/22 11:53:25 ii : sending peer DELETE message 13/04/22 11:53:25 ii : - 10.17.9.17:500 -> 111.222.333.444:500 13/04/22 11:53:25 ii : - isakmp spi = 16adb235e902b8cf:1bbf7eaa4ce7f460 13/04/22 11:53:25 ii : - data size 0 13/04/22 11:53:25 >> : hash payload 13/04/22 11:53:25 >> : delete payload 13/04/22 11:53:25 == : new informational hash ( 20 bytes ) 13/04/22 11:53:25 == : new informational iv ( 16 bytes ) 13/04/22 11:53:25 >= : cookies 16adb235e902b8cf:1bbf7eaa4ce7f460 13/04/22 11:53:25 >= : message 6d0d7075 13/04/22 11:53:25 >= : encrypt iv ( 16 bytes ) 13/04/22 11:53:25 == : encrypt packet ( 80 bytes ) 13/04/22 11:53:25 == : stored iv ( 16 bytes ) 13/04/22 11:53:25 -> : send IKE packet 10.17.9.17:500 -> 111.222.333.444:500 ( 120 bytes ) 13/04/22 11:53:25 ii : phase1 removal before expire time 13/04/22 11:53:25 DB : phase1 deleted ( obj count = 0 ) 13/04/22 11:53:25 DB : tunnel deleted ( obj count = 0 ) 13/04/22 11:53:25 DB : removing all peer tunnel references 13/04/22 11:53:25 DB : peer deleted ( obj count = 0 ) 13/04/22 11:53:25 ii : ipc client process thread exit ... Thank you for your time and assistance. thehelpdeskguy
_______________________________________________ vpn-help mailing list [email protected] https://lists.shrew.net/mailman/listinfo/vpn-help
