1

Gateway to gateway tunnel from RV325 to RV320 (either direction) won't connect. I can't find any sort of error log.

Both are WAN1 (only one connected) and IKE PSK.

Both local and remote groups are IP only. RV325 local == RV320 remote for IP and subnet. RV325 remote == RV320 local as well.

IPSec settings are identical. I've tried a few variations keeping them identical. I read another post where someone said he'd never gotten it to work with Perfect Forward Security on, so that's off.

Am I missing something?

1
  • Yup. Either you should see errors, otherwise tunnel should be working. In latter case you should see SA installed. If there are valid SA on both end, there's a sligh chance that something blocks ipsec in transit, but this needs to be proven by the tcpdump. Investigate.
    – drookie
    Feb 1 '16 at 5:55
1

The simplest way (yet secure) to implement a IPSec VPN is by using IKEv1 in Main Mode (you can see the scenarios to use aggressive mode).

So, assuming you are trying to use IKEv1 Main Mode:

First of all, IKEv1 phase 1 must be negotiated. IPSec only will be negoatiated after phase 1 is OK. (Phase 1 is also called ISAKMP).

To negotiate phase 1, you need to match the 'H.A.G.L.E' in both equipments:

  • Hashing (MD5/SHA1)
  • Authentication (PSK)
  • Group (Diffie Hellman group 1/2/5)
  • Lifetime (28000, 3600, you choose)
  • Encryption (3DES/AES/AES-256)

After this, the IPSec configs must also match in the following both equipments:

  • Hashing (MD5/SHA1)
  • Protocol (ESP/AH)
  • Encryption (3DES/AES/AES-256)
  • Lifetime (28000, 3600, you choose)

Using PFS in IPSec demands you to choose a Diffie-Hellman Group on IPSec too.

If all of this match, you should have no problem. The PSK and local/remote networks also must be ok.

Upload an image of the VPN config screen.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.