Hi,
We have two networks that we need to connect with a VPN connection. The remote network is in AWS with the IP range 10.0.0.0/16 and our lokal network has the IP range 192.168.53.0/24. AWS kindly provides a setup file that can be used to configure the VPN tunnels. Using that file, I was able to get the tunnels to establish. The screenshots below show what the ScreenOS VPN Monitor and the AWS Tunnel Details display since the tunnels were created.
Our SSG-5 sits behind our router and its outgoing interface eth0/0 has the static IP address 192.168.53.200. Our router has the static IP 192.168.53.2. For now, devices that are in bgroup0 (192.168.1.0) should be able to access any 10.0.0.0/16 servers through the VPN, but when we try to ping an server in that range, nothing happens. Following the trouble shooting guide from AWS, we noticed that we also can't ping the inside IP's of the tunnels. As the tunnels are displayed as UP and the SA Status is active I believe that this must be an simple routing issue. I looked through many posts on this forum yet none of the solutions that were suggested in other posts solved my issue. I will post my config file below, maybe someone here sees an simple mistake in my routings or in other areas and can help me fix this.
Best wishes,
unset key protection enable set clock timezone 0 set vrouter trust-vr sharable set vrouter "untrust-vr" exit set vrouter "trust-vr" unset auto-route-export exit set alg appleichat enable unset alg appleichat re-assembly enable set alg sctp enable set auth-server "Local" id 0 set auth-server "Local" server-name "Local" set auth default auth server "Local" set auth radius accounting port 1646 set admin name "netscreen" set admin password "nKVUM2rwMUzPcrkG5sWIHdCtqkAibn" set admin auth web timeout 10 set admin auth dial-in timeout 3 set admin auth server "Local" set admin format dos set zone "Trust" vrouter "trust-vr" set zone "Untrust" vrouter "trust-vr" set zone "DMZ" vrouter "trust-vr" set zone "VLAN" vrouter "trust-vr" set zone "Untrust-Tun" vrouter "trust-vr" set zone "Trust" tcp-rst set zone "Trust" asymmetric-vpn set zone "Untrust" block unset zone "Untrust" tcp-rst unset zone "V1-Trust" tcp-rst unset zone "V1-Untrust" tcp-rst set zone "DMZ" tcp-rst unset zone "V1-DMZ" tcp-rst unset zone "VLAN" tcp-rst set zone "Untrust" screen tear-drop set zone "Untrust" screen syn-flood set zone "Untrust" screen ping-death set zone "Untrust" screen ip-filter-src set zone "Untrust" screen land set zone "V1-Untrust" screen tear-drop set zone "V1-Untrust" screen syn-flood set zone "V1-Untrust" screen ping-death set zone "V1-Untrust" screen ip-filter-src set zone "V1-Untrust" screen land set interface "ethernet0/0" zone "Untrust" set interface "ethernet0/1" zone "DMZ" set interface "bgroup0" zone "Trust" set interface "tunnel.1" zone "Trust" set interface "tunnel.2" zone "Trust" set interface bgroup0 port ethernet0/2 set interface bgroup0 port ethernet0/3 set interface bgroup0 port ethernet0/4 set interface bgroup0 port ethernet0/5 set interface bgroup0 port ethernet0/6 unset interface vlan1 ip set interface ethernet0/0 ip 192.168.53.200/24 set interface ethernet0/0 route set interface bgroup0 ip 192.168.1.1/24 set interface bgroup0 nat set interface tunnel.1 ip 169.254.23.174/30 set interface tunnel.2 ip 169.254.23.46/30 set interface tunnel.1 mtu 1436 set interface tunnel.2 mtu 1436 unset interface vlan1 bypass-others-ipsec unset interface vlan1 bypass-non-ip set interface ethernet0/0 ip manageable set interface bgroup0 ip manageable set interface ethernet0/0 manage ping set interface ethernet0/0 manage ssh set interface ethernet0/0 manage telnet set interface ethernet0/0 manage ssl set interface ethernet0/0 manage web set interface ethernet0/0 dhcp client enable unset interface ethernet0/0 dhcp client settings update-dhcpserver set interface bgroup0 dhcp server service set interface bgroup0 dhcp server auto set interface bgroup0 dhcp server option gateway 192.168.1.1 set interface bgroup0 dhcp server option netmask 255.255.255.0 set interface bgroup0 dhcp server option dns1 192.168.53.2 set interface bgroup0 dhcp server ip 192.168.1.33 to 192.168.1.126 unset interface bgroup0 dhcp server config next-server-ip set interface "serial0/0" modem settings "USR" init "AT&F" set interface "serial0/0" modem settings "USR" active set interface "serial0/0" modem speed 115200 set interface "serial0/0" modem retry 3 set interface "serial0/0" modem interval 10 set interface "serial0/0" modem idle-time 10 set flow tcp-mss unset flow no-tcp-seq-check set flow tcp-syn-check unset flow tcp-syn-bit-check set flow reverse-route clear-text prefer set flow reverse-route tunnel always set flow vpn-tcp-mss 1387 set pki authority default scep mode "auto" set pki x509 default cert-path partial set dns host dns1 192.168.53.2 set dns host dns2 0.0.0.0 set dns host dns3 0.0.0.0 set crypto-policy exit set ike p1-proposal "ike-prop-vpn-05257343a105a43-1" preshare group2 esp aes128 sha-1 second 28800 set ike p1-proposal "ike-prop-vpn-0525743a105a43-2" preshare group2 esp aes128 sha-1 second 28800 set ike p2-proposal "ipsec-prop-vpn-0525743a105a43-1" group2 esp aes128 sha-1 second 3600 set ike p2-proposal "ipsec-prop-vpn-0525743a105a43-2" group2 esp aes128 sha-1 second 3600 set ike gateway "gw-vpn-0525734c43a105a43-1" address 34.250.138.XXX Main outgoing-interface "ethernet0/0" preshare "CXAzrY7cNVnvXXXwu69ooukM48x8FcX0x1NTrdBdQ" proposal "ike-prop-vpn-05257343a105a43-1" set ike gateway "gw-vpn-0525734c43a105a43-1" dpd-liveness interval 10 set ike gateway "gw-vpn-0525734c43a105a43-1" dpd-liveness retry 3 set ike gateway "gw-vpn-0525734c43a105a43-2" address 52.31.30.XX Main outgoing-interface "ethernet0/0" preshare "2n1V8rgeNQN8XXXX4jmYKph8vbfkGABYm8LW3oAgz4KaqWiTUcI" proposal "ike-prop-vpn-0525743a105a43-2" set ike gateway "gw-vpn-0525734c43a105a43-2" dpd-liveness interval 10 set ike gateway "gw-vpn-0525734c43a105a43-2" dpd-liveness retry 3 set ike respond-bad-spi 1 set ike ikev2 ike-sa-soft-lifetime 60 unset ike ikeid-enumeration unset ike dos-protection unset ipsec access-session enable set ipsec access-session maximum 5000 set ipsec access-session upper-threshold 0 set ipsec access-session lower-threshold 0 set ipsec access-session dead-p2-sa-timeout 0 unset ipsec access-session log-error unset ipsec access-session info-exch-connected unset ipsec access-session use-error-log set vpn "IPSEC-vpn-0525734c43a105a43-1" gateway "gw-vpn-0525734c43a105a43-1" replay tunnel idletime 0 proposal "ipsec-prop-vpn-0525743a105a43-1" set vpn "IPSEC-vpn-0525734c43a105a43-1" id 0x1 bind interface tunnel.1 set vpn "IPSEC-vpn-0525734c43a105a43-2" gateway "gw-vpn-0525734c43a105a43-2" replay tunnel idletime 0 proposal "ipsec-prop-vpn-0525743a105a43-2" set vpn "IPSEC-vpn-0525734c43a105a43-2" id 0x2 bind interface tunnel.2 unset interface tunnel.1 acvpn-dynamic-routing unset interface tunnel.2 acvpn-dynamic-routing set url protocol websense exit set policy id 1 from "Trust" to "Untrust" "Any" "Any" "ANY" permit set policy id 1 exit set nsmgmt bulkcli reboot-timeout 60 set ssh version v2 set config lock timeout 5 unset license-key auto-update set telnet client enable set snmp port listen 161 set snmp port trap 162 set snmpv3 local-engine id "0162032007005954" set vrouter "untrust-vr" exit set vrouter "trust-vr" set protocol bgp 65000 set enable set hold-time 30 set neighbor 169.254.23.4X remote-as 64512 set neighbor 169.254.23.4X enable set neighbor 169.254.23.4X hold-time 30 set neighbor 169.254.23.1XX remote-as 64512 set neighbor 169.254.23.1XX enable set neighbor 169.254.23.1XX hold-time 30 unset ipv4 synchronization set ipv4 neighbor 169.254.23.4X activate set ipv4 neighbor 169.254.23.17X activate set ipv4 neighbor 169.254.23.17X advertise-def-route exit unset add-default-route exit set interface tunnel.1 protocol bgp set interface tunnel.2 protocol bgp set vrouter "untrust-vr" exit set vrouter "trust-vr" exit