Dear All,
I've been looking for some help setting up a hub-and-spoke VPN here at
work. So far I have seen two threads on the M0n0wall list that shows
it can be done but I could not find out any more details in
configuration. In my case, both the spokes are also Dynamic IP's for WAN
so I use remote IPsec to connect them.
My current setting looks like this
Remote or Hub Remote or
"Spoke" 1 "Spoke" 2
10.11.0.0/16 <-----> 10.12.0.0/16 <-----> 10.13.0.0/16
For the Hub I have:
Enable IPsec, enabled
Allowed mobile clients, enabled
Phase 1
Negotiation, aggressive
My Identifier, My IP address
Encrypt alg, 3DES
Hash, SHA1
DH, 2
Lifetime 1200
Authentication method, pre-shared key
Phase 2
Protocol: ESP
Encrypt, 3DES
Hash, SHA1
PFS key group, 2
lifetime 300
I then created a pair of Identifiers and Pre-shared keys for the two spokes.
For spoke 1:
tunnel 1
Interface: WAN
Local Subnet, Network, 10.11.0.0 / 16
Remote Subnet, 10.12.0.0 /16
Remote GW, Hub's public IP
Description, spoke 1 <-> hub tunnel
Phase 1
Negotiation, aggressive
My Identifier, User FQDN, vpn1 at spoke1 dash forexample dot com
...
tunnel 2
Interface: WAN
Local Subnet, Network, 10.11.0.0 / 16
Remote Subnet, 10.13.0.0 / 16
Remote GW, Hub's public IP
Description, spoke 1 <-> spoke 2 tunnel
Phase 1
Negotiation, aggressive
My Identifier, User FQDN, vpn2 at spoke1 dash forexample dot com
Spoke 2 has the same settings but had the local subnet and remote
subnets altered.
If I do not enable tunnel 2, the tunnel from spoke 1 and spoke 2 can
communicate with the hub without any further issue. Once I enable tunnel
2 though, then both tunnels will refuse to connect and I get logs that
read like this.
May 26 16:52:01 racoon: ERROR: ignore information because ISAKMP-SA has
not been established yet.
May 26 16:52:01 racoon: DEBUG: 6a73b0e9 bc47a0b2 b0723ef4 a344d896
08100501 c359c5f6 00000044 905bb718 cc771c49 b698e950 2f45d6d0 5653a2a3
980d10de 5d648abf ee282673 99bf4531 c8889518
May 26 16:52:01 racoon: DEBUG: decrypted.
May 26 16:52:01 racoon: DEBUG: skip to trim padding.
May 26 16:52:01 racoon: DEBUG: padding len=25
May 26 16:52:01 racoon: DEBUG: 905bb718 cc771c49 b698e950 2f45d6d0
5653a2a3 980d10de 5d648abf ee282673 99bf4531 c8889518
May 26 16:52:01 racoon: DEBUG: decrypted payload, but not trimed.
Anyone got any suggestions?
--
Kenman Wong
Systems Engineer
iASPEC Technologies and Services
Tel: (852) 3125-9000
Fax: (852) 2668-2166
Ext: (852) 3125-9157
**This email and any file attachments transmitted with it contains privileged and confidential
information intended only for the use of the individual's) or entity to which it is addressed.
Neither the confidentiality of nor any privilege in this email message is waived, lost, or destroyed
by reason that it has been transmitted other than to the addressee. If you are not the intended
recipient of this email message you are hereby notified that you must not copy or take any action in
reliance on it. If you have received this email message in error, please notify iASPEC Technologies
and Services as soon as possible and remove it immediately from your system.** | 