This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Site-to-Site VPN IPSec

Hello,

 

i understand that a similar question has been asked in the very very past but i am still not able to understand it as i lack some understanding of how this works.

 

I have a virtual appliance at home as the next hop after the router and i also have a VPS (OpenVZ). I would like to create a Site-to-Site VPN between the two. I found and installed OpenSwan on the VPS. In the VPS, using Webmin, i created a new IPSec connection calling it home, using the following settings:

Connection name: Home
Compress data? Default (usually No)
Connection type Tunnel
Authentication method RSA
Perfect forwarding secrecy? Default (usually Yes)
Authentication mode Default (usually ESP)
Keying re-tries Default
ESP algorithm Default (usually MD5)
Accept this ESP algorithm only? No
Connection key lifetime Default
Keying channel lifetime Default
Public IP address {public hostname}
System identifier Default
Private subnet behind system None

When i try to connect to the UTM from the VPS, i get the following error:

000 initiating all conns with alias='home'
021 no connection named "home"

To do the setup on the UTM, i did create a remote gateway:

Gateway type: initiate connection
Gateway: (the ip address of the VPS)
Aythenticaiton type: RSA key
VPN ID type: IP Address
VPN ID: {the ip address of the VPS)
Remote networks: Any

and then i created the connection:

Remote gateway: VPS
Local interface: External
Policy: AES-128 (i know this is wrong, but i tried the others and none worked)
Local Networks: Internal
Automatic firewall rules: Yes

But of course it is not connecting.

Any ideas what am i doing wrong?

Thanks!


This thread was automatically locked due to age.
Parents
  • Hi Vasileios,

    Rather than RSA keys, start with a simple PSK until everything else works.

    Please insert pictures of the Edits of the Remote Gateway, the IPsec Connection and the IPsec Policy.  Also, pictures of the Edits of any Host/Network objects used.  Where ever there's an 'Advanced' section, be sure to open that, too.

     

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • Hi,

     

    I tried but still didn't work. Here is a screenshot of the settings

  • In your second screenshot you have "any" in remote networks. That's most likely not what you need, since it would mean to send all traffic not destined for your local network over the tunnel. You would also need "any" in the local network for the remote (OpenSWAN) side for this to work.

    You would most likely need to enter the OpenSWAN's private range in there (or at least the same as you have configured in OpenSWAN as Local network).


    Managing several Sophos firewalls both at work and at some home locations, dedicated to continuously improve IT-security and feeling well helping others with their IT-security challenges.

  • Good catch, my friend.  I didn't look closely at those because I figured the first problem was probably a failure to agree on a Policy.  I guess I'm just lazier than you! [;)]

    In fact, Vasileios, it's best practice never to use "Any" there even if you do want a Full Tunnel.  I would recommend the remote LANs plus the "Internet" object to create a Full tunnel.  I agree with apijnappels that it's unlikely that you want anything other than the remote subnet(s).

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • ok so this is how i did this part:

     

  • So, Vasileios, does your last post mean that the problem is solved?

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • Sorry my message was very vague:

     

    i did as you suggested but it is still not connecting. what's next i should do?

  • Hi Vasileiosg,

    What do you see in the IPSec logs? I haven't seen a log file through the post. Also, make sure ports are open from the NAT device, I hope I am not mistaken that one side of the IPSec connection is behind a NAT device.

    Thanks

    Sachin Gurung
    Team Lead | Sophos Technical Support
    Knowledge Base  |  @SophosSupport  |  Video tutorials
    Remember to like a post.  If a post (on a question thread) solves your question use the 'This helped me' link.

  • Hi,

     

    thanks for asking.

     

    This is all i get:

    2017:01:09-22:20:41 edge pluto[7114]: forgetting secrets
    2017:01:09-22:20:41 edge pluto[7114]: loading secrets from "/etc/ipsec.secrets"
    2017:01:09-22:20:41 edge pluto[7114]: loaded PSK secret for 192.168.178.2 %any 
    2017:01:09-22:20:41 edge pluto[7114]: listening for IKE messages
    2017:01:09-22:20:41 edge pluto[7114]: forgetting secrets
    2017:01:09-22:20:41 edge pluto[7114]: loading secrets from "/etc/ipsec.secrets"
    2017:01:09-22:20:41 edge pluto[7114]: loaded PSK secret for 192.168.178.2 %any 
    2017:01:09-22:20:41 edge pluto[7114]: loading ca certificates from '/etc/ipsec.d/cacerts'
    2017:01:09-22:20:41 edge pluto[7114]: loaded ca certificate from '/etc/ipsec.d/cacerts/SaVaGi Verification CA 1.pem'
    2017:01:09-22:20:41 edge pluto[7114]: loaded ca certificate from '/etc/ipsec.d/cacerts/VPN Signing CA.pem'
    2017:01:09-22:20:41 edge pluto[7114]: loading aa certificates from '/etc/ipsec.d/aacerts'
    2017:01:09-22:20:41 edge pluto[7114]: loading ocsp certificates from '/etc/ipsec.d/ocspcerts'
    2017:01:09-22:20:41 edge pluto[7114]: loading attribute certificates from '/etc/ipsec.d/acerts'
    2017:01:09-22:20:41 edge pluto[7114]: Changing to directory '/etc/ipsec.d/crls'
    2017:01:09-22:20:56 edge pluto[7114]: forgetting secrets
    2017:01:09-22:20:56 edge pluto[7114]: loading secrets from "/etc/ipsec.secrets"
    2017:01:09-22:20:56 edge pluto[7114]: loaded PSK secret for 192.168.178.2 %any 
    2017:01:09-22:20:56 edge pluto[7114]: loaded PSK secret for 192.168.178.2 212.24.106.208 
    2017:01:09-22:20:56 edge pluto[7114]: listening for IKE messages
    2017:01:09-22:20:56 edge pluto[7114]: forgetting secrets
    2017:01:09-22:20:56 edge pluto[7114]: loading secrets from "/etc/ipsec.secrets"
    2017:01:09-22:20:56 edge pluto[7114]: loaded PSK secret for 192.168.178.2 %any 
    2017:01:09-22:20:56 edge pluto[7114]: loaded PSK secret for 192.168.178.2 212.24.106.208 
    2017:01:09-22:20:56 edge pluto[7114]: loading ca certificates from '/etc/ipsec.d/cacerts'
    2017:01:09-22:20:56 edge pluto[7114]: loaded ca certificate from '/etc/ipsec.d/cacerts/SaVaGi Verification CA 1.pem'
    2017:01:09-22:20:56 edge pluto[7114]: loaded ca certificate from '/etc/ipsec.d/cacerts/VPN Signing CA.pem'
    2017:01:09-22:20:56 edge pluto[7114]: loading aa certificates from '/etc/ipsec.d/aacerts'
    2017:01:09-22:20:56 edge pluto[7114]: loading ocsp certificates from '/etc/ipsec.d/ocspcerts'
    2017:01:09-22:20:56 edge pluto[7114]: loading attribute certificates from '/etc/ipsec.d/acerts'
    2017:01:09-22:20:56 edge pluto[7114]: Changing to directory '/etc/ipsec.d/crls'
  • That says, "I'm waiting, but no one is calling."

    Let's look at pictures of the Edits of the current configuration on both sides.  Hover over the content of 'Local Networks' and 'Remote Networks' so we can see what subnets we're offering and expecting.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • Hi,

     

    I can do that, or if you would like, we can have a 5 minute session so you can look over me. 

     

    What do you prefer?

Reply Children
  • I can't, Vasileios, as that would conflict with my business.  If you are uncomfortable posting details, you can send them to me in a Private Message.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA