Quantcast
Channel: All ScreenOS Firewalls (NOT SRX) posts
Viewing all articles
Browse latest Browse all 2577

Re: Route based IPSEC VPN Config between SSG-550M and Cisco ASA

$
0
0

Hi Ishaik,

 

You should be able to use DH group under below stanza and call this proposal in your VPN config.

 

>set ike p2-proposal test ?
ah AH protocol
esp ESP protocol
group1 DH Group 1
group14 DH Group 14
group19 ECDH prime curve 256 bits
group2 DH Group 2
group20 ECDH prime curve 384 bits
group5 DH Group 5
no-pfs NO PFS in Phase 2

 

set vpn "VPN_NAME" gateway "VPN_NAME_GW" no-replay tunnel idletime 0 proposal <p2 proposal>

 

As I mentioned earlier, to make VPN monitor working please configure the complete flow ( source interface and  destination IP etc) , you  may also need to have security policy in place to allow this traffic. 

 

Do you see if the VPN monitor is failing in the "get event" output ? and if VPN monitor is not needed then you can simply delete the monitoring config.

 

For proxy-id , either please make sure both have the same proxy-id or you can try disabling it. e.g. "unset vpn test proxy-id check "

 

Thanks,

Vikas


Viewing all articles
Browse latest Browse all 2577

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>