1

Gateway to gateway tunnel from RV325 to RV320 (either direction) won't connect. I can't find any sort of error log.

Both are WAN1 (only one connected) and IKE PSK.

Both local and remote groups are IP only. RV325 local == RV320 remote for IP and subnet. RV325 remote == RV320 local as well.

IPSec settings are identical. I've tried a few variations keeping them identical. I read another post where someone said he'd never gotten it to work with Perfect Forward Security on, so that's off.

Am I missing something?

RadOD
  • 11
  • 1
  • 3
  • Yup. Either you should see errors, otherwise tunnel should be working. In latter case you should see SA installed. If there are valid SA on both end, there's a sligh chance that something blocks ipsec in transit, but this needs to be proven by the `tcpdump`. Investigate. – drookie Feb 01 '16 at 05:55

1 Answers1

1

The simplest way (yet secure) to implement a IPSec VPN is by using IKEv1 in Main Mode (you can see the scenarios to use aggressive mode).

So, assuming you are trying to use IKEv1 Main Mode:

First of all, IKEv1 phase 1 must be negotiated. IPSec only will be negoatiated after phase 1 is OK. (Phase 1 is also called ISAKMP).

To negotiate phase 1, you need to match the 'H.A.G.L.E' in both equipments:

  • Hashing (MD5/SHA1)
  • Authentication (PSK)
  • Group (Diffie Hellman group 1/2/5)
  • Lifetime (28000, 3600, you choose)
  • Encryption (3DES/AES/AES-256)

After this, the IPSec configs must also match in the following both equipments:

  • Hashing (MD5/SHA1)
  • Protocol (ESP/AH)
  • Encryption (3DES/AES/AES-256)
  • Lifetime (28000, 3600, you choose)

Using PFS in IPSec demands you to choose a Diffie-Hellman Group on IPSec too.

If all of this match, you should have no problem. The PSK and local/remote networks also must be ok.

Upload an image of the VPN config screen.

Felipe Oliveira
  • 11
  • 2