SSG5 Dial-Up VPN Frustration
-
Hey Guys,
I’ve been banging my head on the wall on this for a couple of days now. I just started with this smaller company and I’m new to Juniper.
I’ve been through post after post trying to get this VPN working properly but it just doesn’t seem to be giving me a break. Using Shrew VPN, it says the tunnel is established but I cannot communicate with the target network (this small office). I know I’m missing something small but by now, I almost feel as though I’ve done more harm than good to the config after days of troubleshooting.
Below is the current running config (obviously edited of a few things). Not sure if it’s worth nothing but I have 3 site-to-site VPNs operational (not shown in config). It’s only the dial-up connections I’m having trouble with.
I know there has to be something small I’m missing here.
Thank you sooo much in advance!
Total Config size 12690: unset key protection enable set clock timezone -5 set clock dst recurring start-weekday 2 0 3 02:00 end-weekday 1 0 11 02:00 set vrouter trust-vr sharable set vrouter "untrust-vr" exit set vrouter "trust-vr" unset auto-route-export exit set alg appleichat enable unset alg appleichat re-assembly enable set alg sctp enable set auth-server "Local" id 0 set auth-server "Local" server-name "Local" set auth default auth server "Local" set auth radius accounting port 1646 set admin name "******" set admin password "*******" set admin auth web timeout 10 set admin auth dial-in timeout 3 set admin auth server "Local" set admin format dos set zone "Trust" vrouter "trust-vr" set zone "Untrust" vrouter "trust-vr" set zone "DMZ" vrouter "trust-vr" set zone "VLAN" vrouter "trust-vr" set zone "Untrust-Tun" vrouter "trust-vr" set zone "Trust" tcp-rst set zone "Untrust" block unset zone "Untrust" tcp-rst set zone "MGT" block unset zone "V1-Trust" tcp-rst unset zone "V1-Untrust" tcp-rst set zone "DMZ" tcp-rst unset zone "V1-DMZ" tcp-rst unset zone "VLAN" tcp-rst set zone "Untrust" screen tear-drop set zone "Untrust" screen syn-flood set zone "Untrust" screen ping-death set zone "Untrust" screen ip-filter-src set zone "Untrust" screen land set zone "V1-Untrust" screen tear-drop set zone "V1-Untrust" screen syn-flood set zone "V1-Untrust" screen ping-death set zone "V1-Untrust" screen ip-filter-src set zone "V1-Untrust" screen land set interface "ethernet0/0" zone "Untrust" set interface "ethernet0/1" zone "DMZ" set interface "bgroup0" zone "Trust" set interface "tunnel.1" zone "Untrust" set interface "tunnel.2" zone "Untrust" set interface "tunnel.3" zone "Untrust" set interface bgroup0 port ethernet0/2 set interface bgroup0 port ethernet0/3 set interface bgroup0 port ethernet0/4 set interface bgroup0 port ethernet0/5 set interface bgroup0 port ethernet0/6 unset interface vlan1 ip set interface ethernet0/0 ip XXX.XXX.XXX.81/28 set interface ethernet0/0 route set interface bgroup0 ip 10.10.0.1/24 set interface bgroup0 nat unset interface vlan1 bypass-others-ipsec unset interface vlan1 bypass-non-ip set interface ethernet0/0 ip manageable set interface bgroup0 ip manageable set interface ethernet0/0 manage ping set interface ethernet0/0 manage web set interface "serial0/0" modem settings "USR" init "AT&F" set interface "serial0/0" modem settings "USR" active set interface "serial0/0" modem speed 115200 set interface "serial0/0" modem retry 3 set interface "serial0/0" modem interval 10 set interface "serial0/0" modem idle-time 10 set flow tcp-mss unset flow no-tcp-seq-check set flow tcp-syn-check unset flow tcp-syn-bit-check set flow reverse-route clear-text prefer set flow reverse-route tunnel always set pki authority default scep mode "auto" set pki x509 default cert-path partial set dns host dns1 75.75.75.75 set dns host dns2 75.75.76.76 10.10 set dns host dns3 0.0.0.0 set address "Trust" "10.10.0.0/24" 10.10.0.0 255.255.255.0 set address "Trust" "10.10.0.0/32" 10.10.0.0 255.255.255.255 set address "Trust" "10.10.30.0/24" 10.10.30.0 255.255.255.0 set address "Trust" "10.10.30.0/32" 10.10.30.0 255.255.255.255 set address "Untrust" "VPN" 10.10.30.0 255.255.255.255 set ippool "vpn_pool1" 10.10.0.230 10.10.0.231 set ippool "VPNpool" 10.10.30.30 10.10.30.35 set user "joe" uid 12 set user "joe" type xauth set user "joe" password "**********" unset user "joe" type auth set user "joe" "enable" set user "vpnc1" uid 1 set user "vpnc1" ike-id fqdn "client.domain.biz" share-limit 5 set user "vpnc1" type ike set user "vpnc1" "enable" set user-group "vpngroup1" id 1 set user-group "vpngroup1" user "vpnc1" set crypto-policy exit set ike gateway "vpncleintgw1" dialup "vpngroup1" Aggr local-id "vpngw.domain.biz" outgoing-interface "ethernet0/0" preshare "******" proposal "pre-g2-3des-sha" "pre-g2-aes128-sha" "pre-g2-aes128-md5" set ike gateway "vpncleintgw1" dpd-liveness interval 30 unset ike gateway "vpncleintgw1" nat-traversal udp-checksum set ike gateway "vpncleintgw1" nat-traversal keepalive-frequency 20 set ike gateway "vpncleintgw1" xauth server "Local" unset ike gateway "vpncleintgw1" xauth do-edipi-auth unset ike gateway "vpncleintgw1" xauth do-edipi-auth set ike respond-bad-spi 1 set ike ikev2 ike-sa-soft-lifetime 60 unset ike ikeid-enumeration unset ike dos-protection unset ipsec access-session enable set ipsec access-session maximum 5000 set ipsec access-session upper-threshold 0 set ipsec access-session lower-threshold 0 set ipsec access-session dead-p2-sa-timeout 0 unset ipsec access-session log-error unset ipsec access-session info-exch-connected unset ipsec access-session use-error-log set xauth default ippool "vpn_pool1" set xauth default dns1 10.10.0.4 set xauth default wins1 10.10.0.4 set vpn "vpnclient_tunnel1" gateway "vpncleintgw1" replay tunnel idletime 0 proposal "nopfs-esp-3des-sha" "nopfs-esp-aes128-sha" "nopfs-esp-3des-md5" "nopfs-esp-aes128-md5" set url protocol websense exit set policy id 5 from "Untrust" to "Trust" "Dial-Up VPN" "172.16.0.0/24" "ANY" tunnel vpn "vpnclient_tunnel1" id 0x4 pair-policy 6 auth log set policy id 5 exit set policy id 6 from "Trust" to "Untrust" "172.16.0.0/24" "Dial-Up VPN" "ANY" tunnel vpn "vpnclient_tunnel1" id 0x4 pair-policy 5 auth server "Local" log set policy id 6 exit set policy id 1 from "Trust" to "Untrust" "Any" "Any" "ANY" permit set policy id 1 exit set policy id 20 name "VPN" from "Trust" to "Trust" "10.10.0.0/32" "10.10.0.0/24" "ANY" permit log set policy id 20 exit set nsmgmt bulkcli reboot-timeout 60 set ssh version v2 set config lock timeout 5 unset license-key auto-update set telnet client enable set snmp name "ssg5-serial" set snmp port listen 161 set snmp port trap 162 set snmpv3 local-engine id "******" set vrouter "untrust-vr" exit set vrouter "trust-vr" unset add-default-route set route 0.0.0.0/0 gateway XXX.XXX.XXX.XXX exit set vrouter "untrust-vr" exit set vrouter "trust-vr" exit
-
I know this is an annoying request and one that has been done over and over but as I said, I’m new to Juniper and kind of at a loss.
ANY help or direction here would be wonderful!
I’ve gone over these directions on Shrew’s site time and time again and still can’t find where I went wrong.
http://www.shrew.net/support/wiki/HowtoJuniperSsg
http://www.the-internet-guy.com/pdf/Juniper_firewall_setup_for_Shrewsoft_VPN_connectivity.pdf