Dave,
Your assumptions were correct, however I did try what you said. No luck. I
can get either tunnel up when the other is disabled.
Is there an issue with two tunnels going to the same box?
---IPSEC A---
M0n0 1 WAN IP ---| |----- M0n0 2 WAN IP
---IPSEC B---
Maybe I am missing something with the "My Identifier" field. On
m0n0 1/Tunnel 1
My Identifier = My IP Address
m0n0 1/Tunnel 2
My Identifier = (Tried the following and then some)
IP Address = {WAN IP}
Domain name = {resolveable domain to WAN IP}
Domain name = {something made up}
User FQDN = {user@resolvable domain for WAN IP)
User FQDN = (my email)
m0n0 2/Tunnel 1
My Identifier = My IP Address
m0n0 2/Tunnel 2
My Identifier = (Tried the following and then some)
IP Address = {WAN IP}
IP Address =
Domain name = {resolveable domain to WAN IP}
Domain name = {something made up}
User FQDN = {user@resolvable domain for WAN IP)
User FQDN = (my email)
If I am not user "My IP Address", what should I be using? Both sides have
static IP address.
I am really at a loss here.
Thanks,
Andrew
> -----Original Message-----
> From: David Kitchens [mailto:spider at webweaver dot com]
> Sent: Saturday, February 28, 2009 7:39 PM
> To: 'Andrew Cotter'
> Subject: RE: [m0n0wall] Multiple IPSEC tunnels between two endpoints
>
> Andrew,
> So I have this straight, you need LAN1 to talk to LAN2 and
> iSCSI1 to talk to iSCSI2, correct? Does LAN1 need to talk to
> iSCSI2 at all? Or vice-verce? I wouldn't think so from your
> description. I'm not an ipsec expert by any means but I've
> got some weird things working in the past. I would make two
> tunnels, one lan to lan, and one scsi to scsi but make the
> phase1 identifiers different and use different encryption
> algos, 3DES for LAN, Blowfish for iSCSI, use different keys
> and then only check the box you need in phase2 for 3des on
> lan and blowfish for scsi, do not leave them all checked.
> Making different hash algos in phase2 as well may help. I do
> remember that my problems seemed to be close to yours, and by
> specifying different settings for each tunnel it finally worked.
>
> Dave
>
> -----Original Message-----
> From: Andrew Cotter [mailto:andrew dot cotter at somersetcapital dot com]
> Sent: Friday, February 27, 2009 12:53 PM
> To: m0n0wall at lists dot m0n0 dot ch
> Subject: [m0n0wall] Multiple IPSEC tunnels between two endpoints
>
> Hello,
>
> I am trying to setup two IPSEC site-to-site tunnels between
> two locations.
> The reason for the two tunnels is the range of IP addresses
> are not able to be combined in a single tunnel. We want the
> LANs to be able to talk and the iSCSI (Opt1) to be able to
> talk so our Equallogic SANs can replicate. I can get either
> of the two tunnels to connect properly when the other is
> disabled, but as soon as I enable the second tunnel both drop
> and will not come back regardless of what I try.
>
> Here is the general config of what I have (scrubbed for real
> external IPs) and keep in mind that the tunnels do work when
> individually running so encryption setting, lifetime, key,
> etc are correct. Both IPSEC tunnels use INTERFACE=WAN.
> Pinging works fine with a single tunnel up.
>
> We are using watchguard x500 boxes, both running 1.235
> (generic-pc image)
>
> SITE 1 - WG X500
> -----
> WAN: 64.252.1.1
> LAN: 10.0.0.0/17
> iSCSI: 172.16.30.0/24
> (three other ports but not relevant for this)
>
> SITE 2 - WG X500
> -----
> WAN: 64.252.2.2
> LAN: 10.1.0.0/17
> iSCSI: 172.16.40.0/24
> (three other ports but not relevant for this)
>
> The errors I see when I enable the second IPSEC VPN are as follows
>
> Feb 27 12:24:35 racoon: INFO: delete phase 2 handler.
> Feb 27 12:24:35 racoon: ERROR: phase2 negotiation
> failed due to time
> up waiting for phase1. ESP 64.252.2.2[0]->64.252.1.1[0] ....
> Feb 27 12:24:04 racoon: ERROR: HASH mismatched
> Feb 27 12:24:04 racoon: NOTIFY: couldn't find the
> proper pskey, try
> to get one by the peer's address.
> Feb 27 12:24:04 racoon: INFO: received Vendor ID: DPD
> Feb 27 12:24:04 racoon: INFO: begin Aggressive mode.
> Feb 27 12:24:04 racoon: INFO: initiate new phase 1 negotiation:
> 64.252.1.1[500]<=>64.252.2.2[500]
> Feb 27 12:24:04 racoon: INFO: IPsec-SA request for
> 64.252.2.2 queued
> due to no phase1 found.
> Feb 27 12:23:44 racoon: INFO: ISAKMP-SA deleted
> 64.252.1.1[500]-64.252.2.2[500] spi:679e84ed3d3441b8:39182976d3dc27b8
> Feb 27 12:23:43 racoon: INFO: purged ISAKMP-SA
> spi=679e34eded3441b8:39182974d3dc27b8.
> Feb 27 12:23:43 racoon: INFO: purged IPsec-SA spi=245980085.
> Feb 27 12:23:43 racoon: INFO: purging ISAKMP-SA
> spi=679e84cded3441b8:39182976d3dc17b8.
> Feb 27 12:23:42 racoon: INFO: purged IPsec-SA proto_id=ESP
> spi=185365844.
>
>
> I see some old posts about sainfo, particularly
> http://m0n0.ch/wall/list/showmsg.php?id=160/30 but I would
> need this to survive a reboot.
>
> Any insight as to what I can do to work around this?
>
> Thanks in advance!
>
> Andrew
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: m0n0wall dash unsubscribe at lists dot m0n0 dot ch
> For additional commands, e-mail: m0n0wall dash help at lists dot m0n0 dot ch
>
| 