This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Site-to-Site VPN IPSec

Hello,

 

i understand that a similar question has been asked in the very very past but i am still not able to understand it as i lack some understanding of how this works.

 

I have a virtual appliance at home as the next hop after the router and i also have a VPS (OpenVZ). I would like to create a Site-to-Site VPN between the two. I found and installed OpenSwan on the VPS. In the VPS, using Webmin, i created a new IPSec connection calling it home, using the following settings:

Connection name: Home
Compress data? Default (usually No)
Connection type Tunnel
Authentication method RSA
Perfect forwarding secrecy? Default (usually Yes)
Authentication mode Default (usually ESP)
Keying re-tries Default
ESP algorithm Default (usually MD5)
Accept this ESP algorithm only? No
Connection key lifetime Default
Keying channel lifetime Default
Public IP address {public hostname}
System identifier Default
Private subnet behind system None

When i try to connect to the UTM from the VPS, i get the following error:

000 initiating all conns with alias='home'
021 no connection named "home"

To do the setup on the UTM, i did create a remote gateway:

Gateway type: initiate connection
Gateway: (the ip address of the VPS)
Aythenticaiton type: RSA key
VPN ID type: IP Address
VPN ID: {the ip address of the VPS)
Remote networks: Any

and then i created the connection:

Remote gateway: VPS
Local interface: External
Policy: AES-128 (i know this is wrong, but i tried the others and none worked)
Local Networks: Internal
Automatic firewall rules: Yes

But of course it is not connecting.

Any ideas what am i doing wrong?

Thanks!


This thread was automatically locked due to age.
  • So, Vasileios, does your last post mean that the problem is solved?

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • Sorry my message was very vague:

     

    i did as you suggested but it is still not connecting. what's next i should do?

  • Hi Vasileiosg,

    What do you see in the IPSec logs? I haven't seen a log file through the post. Also, make sure ports are open from the NAT device, I hope I am not mistaken that one side of the IPSec connection is behind a NAT device.

    Thanks

    Sachin Gurung
    Team Lead | Sophos Technical Support
    Knowledge Base  |  @SophosSupport  |  Video tutorials
    Remember to like a post.  If a post (on a question thread) solves your question use the 'This helped me' link.

  • Hi,

     

    thanks for asking.

     

    This is all i get:

    2017:01:09-22:20:41 edge pluto[7114]: forgetting secrets
    2017:01:09-22:20:41 edge pluto[7114]: loading secrets from "/etc/ipsec.secrets"
    2017:01:09-22:20:41 edge pluto[7114]: loaded PSK secret for 192.168.178.2 %any 
    2017:01:09-22:20:41 edge pluto[7114]: listening for IKE messages
    2017:01:09-22:20:41 edge pluto[7114]: forgetting secrets
    2017:01:09-22:20:41 edge pluto[7114]: loading secrets from "/etc/ipsec.secrets"
    2017:01:09-22:20:41 edge pluto[7114]: loaded PSK secret for 192.168.178.2 %any 
    2017:01:09-22:20:41 edge pluto[7114]: loading ca certificates from '/etc/ipsec.d/cacerts'
    2017:01:09-22:20:41 edge pluto[7114]: loaded ca certificate from '/etc/ipsec.d/cacerts/SaVaGi Verification CA 1.pem'
    2017:01:09-22:20:41 edge pluto[7114]: loaded ca certificate from '/etc/ipsec.d/cacerts/VPN Signing CA.pem'
    2017:01:09-22:20:41 edge pluto[7114]: loading aa certificates from '/etc/ipsec.d/aacerts'
    2017:01:09-22:20:41 edge pluto[7114]: loading ocsp certificates from '/etc/ipsec.d/ocspcerts'
    2017:01:09-22:20:41 edge pluto[7114]: loading attribute certificates from '/etc/ipsec.d/acerts'
    2017:01:09-22:20:41 edge pluto[7114]: Changing to directory '/etc/ipsec.d/crls'
    2017:01:09-22:20:56 edge pluto[7114]: forgetting secrets
    2017:01:09-22:20:56 edge pluto[7114]: loading secrets from "/etc/ipsec.secrets"
    2017:01:09-22:20:56 edge pluto[7114]: loaded PSK secret for 192.168.178.2 %any 
    2017:01:09-22:20:56 edge pluto[7114]: loaded PSK secret for 192.168.178.2 212.24.106.208 
    2017:01:09-22:20:56 edge pluto[7114]: listening for IKE messages
    2017:01:09-22:20:56 edge pluto[7114]: forgetting secrets
    2017:01:09-22:20:56 edge pluto[7114]: loading secrets from "/etc/ipsec.secrets"
    2017:01:09-22:20:56 edge pluto[7114]: loaded PSK secret for 192.168.178.2 %any 
    2017:01:09-22:20:56 edge pluto[7114]: loaded PSK secret for 192.168.178.2 212.24.106.208 
    2017:01:09-22:20:56 edge pluto[7114]: loading ca certificates from '/etc/ipsec.d/cacerts'
    2017:01:09-22:20:56 edge pluto[7114]: loaded ca certificate from '/etc/ipsec.d/cacerts/SaVaGi Verification CA 1.pem'
    2017:01:09-22:20:56 edge pluto[7114]: loaded ca certificate from '/etc/ipsec.d/cacerts/VPN Signing CA.pem'
    2017:01:09-22:20:56 edge pluto[7114]: loading aa certificates from '/etc/ipsec.d/aacerts'
    2017:01:09-22:20:56 edge pluto[7114]: loading ocsp certificates from '/etc/ipsec.d/ocspcerts'
    2017:01:09-22:20:56 edge pluto[7114]: loading attribute certificates from '/etc/ipsec.d/acerts'
    2017:01:09-22:20:56 edge pluto[7114]: Changing to directory '/etc/ipsec.d/crls'
  • That says, "I'm waiting, but no one is calling."

    Let's look at pictures of the Edits of the current configuration on both sides.  Hover over the content of 'Local Networks' and 'Remote Networks' so we can see what subnets we're offering and expecting.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • Hi,

     

    I can do that, or if you would like, we can have a 5 minute session so you can look over me. 

     

    What do you prefer?

  • I can't, Vasileios, as that would conflict with my business.  If you are uncomfortable posting details, you can send them to me in a Private Message.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • i want to build a ipsec site to site connection. sophos to tp link tl-r600vpn could you guys help me?

  • Get started on your own by reading one of the following and then open a thread to ask a question when you have a problem.

    From the most-difficult and most-secure to the easiest and least-secure:

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • Yes, we will be happy to help, but not until you make the effort to start and then ask specific questions.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA