Hello all,
Having trouble with my VPN between a Sonicwall and a Juniper SSG5. I have the tunnel up but it is got one-way traffic. Followed the steps outlinned on the KB and not having much luck. Here's my VPN info, please let me know if I need to provide anything further.
get sa
HEX ID Gateway Port Algorithm SPI Life:sec kb Sta PID vsys
00000003< XXXX 500 esp:3des/sha1 bf18fb8f 2583 unlim A/D -1 0
00000003> XXXX 500 esp:3des/sha1 2aabdbf2 2583 unlim A/D -1 0
2017-10-06 13:59:37 system info 00536 IKE XXXX Phase 2 msg ID
53e3053a: Completed negotiations with
SPI bf18fb8f, tunnel ID 3, and
lifetime 3600 seconds/0 KB.
2017-10-06 13:59:37 system info 00536 IKE XXXX phase 2:The symmetric
crypto key has been generated
successfully.
2017-10-06 13:59:37 system info 00536 IKE XXXX Phase 2: Received a
message but did not check a policy
because id-mode was set to IP or
policy-checking was disabled.
2017-10-06 13:59:37 system info 00536 IKE XXXX Phase 2: Received a
message but did not check a policy
because id-mode was set to IP or
policy-checking was disabled.
2017-10-06 13:59:37 system info 00536 IKE XXXX Phase 2 msg ID
53e3053a: Responded to the peer's
first message.
2017-10-06 13:59:37 system info 00536 IKE XXXX Phase 2: Received a
message but did not check a policy
because id-mode was set to IP or
policy-checking was disabled.
sydneyrd-ssg5-> get vpn proxy-id
vpn-name tun-if local-ip/mask remote-ip/mask proto/port tunnel-id
------------------------------------------------------------------------------------
Coburg tunnel.1 192.168.4.0/24 192.168.2.0/24 0/0 0x00000003
sydneyrd-ssg5-> get int tunnel.1
Interface tunnel.1:
description tunnel.1
number 20, if_info 1768, if_index 1, mode route
link down, admin status up
vsys Root, zone Untrust, vr trust-vr
admin mtu 0, operating mtu 1500, default mtu 1500
*ip 0.0.0.0/0 unnumbered, source interface ethernet0/1
*manage ip 0.0.0.0
bound vpn:
Coburg
sydneyrd-ssg5-> get route ip 192.168.2.0
Dest for 192.168.2.0
--------------------------------------------------------------------------------------
trust-vr : => 0.0.0.0/0 (id=15) via 210.8.1.232 (vr: trust-vr)
Interface ethernet0/1 , metric 1
sydneyrd-ssg5-> get vpn Coburg
Name Gateway Mode RPlay 1st Proposal Monitor Use Cnt Interface
--------------- --------------- ---- ----- -------------------- ------- ------- ---------------
Coburg Coburg tunl No nopfs-esp-3des-sha on 0 eth0/1
all proposals: nopfs-esp-3des-sha
peer gateway = XXXX
outgoing interface <ethernet0/1>
IPv4 address XYXY.
vpn monitor src I/F <default>, dst-IP <default>, optimized NO, rekey OFF
l2tp over ipsec use count <0>
idle timeout value <0>
vpnflag <04010022>
df-bit <clear>
sa_list <00000003>
single proxy id, check disabled, init done, total <1>
proxy id:
local 192.168.4.0/255.255.255.0, remote 192.168.2.0/255.255.255.0, proto 0, port 0/0
Bound tunnel interface: tunnel.1
Next-Hop Tunnel Binding table
Flag Status Next-Hop(IP) tunnel-id VPN
DSCP-mark: disabled
sydneyrd-ssg5-> get policy all
Total regular policies 7, Default deny, Software based policy search, new policy enabled.
ID From To Src-address Dst-address Service Action State ASTLCB
12 Untrust Trust 192.168.2.0~ 192.168.4.0~ ANY Permit enabled ---X-X
11 Trust Untrust 192.168.4.0~ 192.168.2.0~ ANY Permit enabled ---X-X