Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have an existing network setup that I inherited from my predecessor. Currently there are two sites, each with a Linksys RV042 VPN router running the 1.3.12.19-tm firmware. They are currently set up with a Gateway to Gateway VPN. One site has a static IP, the other has a Dynamic IP with a hostname set up on no-ip.com.

My company is looking to set up another site so I purchased another RV042 only this one was Cisco branded and it is running the latest firmware. I had assumed that I would be able to configure a vpn from our main office (the dynamic ip) to the new site with this router quite easily. However when I set up a new VPN tunnel on either device, it stays on Waiting for Connection and the Remote Gateway shows an ip address of 0.0.0.0 rather than the remote ip address.Working and Non-Functional VPN Summary

The other VPN tunnel is still working and I don't see any obvious misconfiguration on the new router. It seems that the router is not resolving the Dynamic DNS address and therefore not giving me the option to connect the VPN.

Does a Gateway to Gateway VPN work with Dynamic IP addresses on each end?

Are the firmware versions not compatible?

Is there something I've missed?

share|improve this question

1 Answer 1

Short answers: yes, no, yes.

(dynamic on both ends is fine. versions are compatible, you missed something. I've lost a LOT of hair setting up these things, it's easy to miss something!!)

I have a few (10?) of the RV042's set up at various locations, most without static IP's. [delete]I'm really surprised at the stability of these devices.[/delete] VPN's are a bit tricky-- so much so that I made a script that sets up the tunnels for me. If you miss just ONE setting it can make the tunnel not work, and you can stare at it for days and not see the tiny missing character or box that wasn't checked right.

The trick for dynamic-to-dynamic:

First set up dynamic dns and make sure it works. I'm using DynDNS. (go to Setup - DDNS in firmware 1.3.x, Setup - Dynamic DNS in 4.x)

Here are the important parts:

Click VPN. Click Gateway to Gateway. Give the tunnel any name- don't use spaces (earlier versions would fail with a space, I don't know if 4 does or not) Make sure the interface is a working WAN interface. In Remote gateway Security Type select Dynamic IP+Domain Name (FQDN) Authentication, the page will refresh. Enter the DNS name you configured for this end into Domain Name The IP Address and Subnet Mask are automatically filled in from your running configuration. Don't change them Under Remote Group Setup, select "IP Only" (it should be selected already based on your dynamic selection above) and then the next drop down from "IP Address" to "IP by DNS Resolved" Enter the remote dynamic dns name in the box to the right of "IP by DNS Resolved"

Now for the settings. I don't know if all of the options available actually work, but I do know that you'd better have them exactly the same at both ends. These are the settings I've found to work:

Keying Mode             [IKE with Preshared key]
Phase1 DH Group         [Group1]
Phase1 Encryption       [DES]
Phase1 Authentication   [MD5]
Phase1 SA Life Time     [28800]
Prefect Forward Secrecy [ ]   -- I can't get PFS to work between two rv042's
Phase1 Encryption       [Phase3DES]
Phase1 Authentication   [MD5]
Phase2 SA Life Time     [3600] seconds
Preshared Key:          [yourSecretKeyGoesHere]

Advanced:

[X] Aggressive Mode
[ ] Compress
[X] Keep-Alive
[ ] AH Hash Algorithm [any]
[ ] NetBIOS broadcast
[ ] NAT Traversal
[X] Dead Peer Detection (DPD) Interval [10] seconds

As soon as you try to send a packet between locations the tunnels should build. Good luck!

Jeremy

THE SCRIPT

You'll probably have to modify this to suit your needs. It expects 192.168.x.x subnets, and you'll need to be on windows, with IE working, and cscript operating normally. Script assumes < 4.x firmware-- not tested on 4.x at all.

' I never bothered to make this script take parameters. Just edit the values below.
' before this will work, you need to set up DDNS on both routers (and test it) and
' you need to enable remote administration via port SSL on port 8080. Turn that 
' back off if you aren't going to need it (and you shouldn't, because after the
' tunnel is set up you can access the administration interface using the LAN IP.

End_A_DNS = "one-end-of-tunnel.selfip.com"
End_A_Subnet = "16"   ' this is the third octet- 192.168.X.0

End_B_DNS = "the-other-end-of-tunnel.selfip.com"
End_B_Subnet = "24"

Secret = "putyoursecretkeyhere"

' where_am_i is the subnet you're sitting at. You usually can't access the 
' WAN ip address of the router you're behind, so the script just uses this 
' in case you are creating a tunnel to the network you're on. This script 
' will create tunnels between two rv042's out there on the internet if both
' of them are properly set up with DDNS and remote access via port 8080.

Where_am_i = "24"  


if end_a_subnet = where_am_i then
    router_address = "http://192.168." & where_am_i & ".1"  ' ASSUMES .1 IS THE ROUTER.
else
    router_address = "https://" & End_a_dns & ":8080"
end if

' set up the first half of the tunnel
SetTunnelEnd router_address, end_a_dns, end_b_dns, end_a_subnet, end_b_subnet, secret

if end_b_subnet = where_am_i then
    router_address = "http://192.168." & where_am_i & ".1"  ' ASSUMES .1 IS THE ROUTER.
else
    router_address = "https://" & End_b_dns & ":8080"
end if

' set up the second half of the tunnel
SetTunnelEnd router_address, end_b_dns, end_a_dns, end_b_subnet, end_a_subnet, secret



sub SetTunnelEnd(routerhttps, a_dns, b_dns, a_net, b_net, secret)

    Set IE = CreateObject("InternetExplorer.Application")
    IE.navigate routerhttps & "/gateway_to_gateway.htm"
    IE.Visible = True

    Do Until IE.readyState = 4
    Loop

    tunnelName = a_net & "-" & left(a_dns,6) & " to " & b_net & "-" & left(b_dns,6) 

    IE.document.forms("formgtg").tunnelName.value = tunnelName
    IE.document.forms("formgtg").typeLSW(1).value = 4
    IE.Navigate("javascript:falseSubmit(document.formgtg,'11');")

    Do Until IE.readyState = 4
    Loop

    IE.document.forms("formgtg").L_textFQDN(1).value= a_dns

    IE.document.forms("formgtg").typeRSW(1).value = 2
    IE.Navigate("javascript:falseSubmit(document.formgtg,'12');")

    Do Until IE.readyState = 4
    Loop

    IE.document.forms("formgtg").radioDnsResolve(1).value = 1
    IE.Navigate("javascript:showDnsResolve();")

    IE.document.forms("formgtg").ipRSW1(1).value= b_dns

    wscript.sleep(500)

    IE.Navigate("javascript:IPDNSCheck(document.formgtg.ipRSW1[1]);")

    wscript.sleep(1000)

    IE.document.forms("formgtg").textFQDN(1).value = b_dns

    IE.document.forms("formgtg").ipRSG1(1).value="192"
    IE.document.forms("formgtg").ipRSG2(1).value="168"
    IE.document.forms("formgtg").ipRSG3(1).value=b_net
    IE.document.forms("formgtg").ipRSG4(1).value="0"

    IE.document.forms("formgtg").PFSp(1).checked = 0
    IE.Navigate("javascript:falseSubmit(document.formgtg,'13');")

    Do Until IE.readyState = 4
    Loop

    IE.document.forms("formgtg").select5(1).value = 2

    IE.document.forms("formgtg").keyPreshared2(1).value = secret

    IE.Navigate("javascript:opAdvanced(document.formgtg.advancedStatus,document.formgtg);")

    Do Until IE.readyState = 4
    Loop

    IE.document.forms("formgtg").aggressiveMode.checked = 1
    IE.document.forms("formgtg").keepAlive.checked = 1
    IE.document.forms("formgtg").biosBC.checked = 0
    IE.document.forms("formgtg").DPD.checked = 1
    IE.document.forms("formgtg").DPDInterval.value = 10

    wscript.sleep(500)

    IE.document.forms("formgtg").submit()

    wscript.sleep(500)

    Do Until IE.readyState = 4
    Loop

    IE.quit
    set IE = nothing

    wscript.echo "tunnel created from " & tunnelName

end sub

Footnote, 8-10-2012: "I'm really surprised at the stability of these devices."

As I said, I had 10 of these in operation. After about 4 years, some will start to have "issues". So much so that I am not deploying them any longer. I need devices that last, reliably, for more than 4 years. 3 of the ten are absolutely unusable, and I expect the other 7 to start failing in time.

share|improve this answer
    
Dude! Nice answer!!! –  SpacemanSpiff May 2 '12 at 3:26

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.