Networks

Ask something
Question Locked

VPN from inside SBS 2003

0 helpful
4 replies

by kenc

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

We do tech support through vpn's from within our network to other's. Anew connection using Avaya vpnremote client does not complete connection. I have opened ports 500 and 4500 with no luck and static routes on the server.
avaya log file:
1 INFO 09:12:2007 09:53:14 Initializing IPSec

2 INFO 09:12:2007 09:53:14 Init IPSec OK!

3 INFO 09:12:2007 09:53:14 IP Filter service already running

4 INFO 09:12:2007 09:53:14 PF Kernel initialized OK

5 INFO 09:12:2007 09:53:18 Flushing IKE configuration

6 INFO 09:12:2007 09:53:18 starting ike task nat flag = 0 cert = 0

7 DEBUG 09:12:2007 09:53:18 starting isakmp session for ui on sa=0x142c098

8 DEBUG 09:12:2007 09:53:18 Building phase 1 SA payload for 168.254.5.5

9 DEBUG 09:12:2007 09:53:18 Constructing key exchange payload for 168.254.5.5

10 DEBUG 09:12:2007 09:53:18 Construting id payload

11 DEBUG 09:12:2007 09:53:21 Retransmission timeout, count = 0

12 DEBUG 09:12:2007 09:53:24 Retransmission timeout, count = 1

13 DEBUG 09:12:2007 09:53:30 Retransmission timeout, count = 2

14 DEBUG 09:12:2007 09:53:39 Retransmission timeout, count = 3

15 DEBUG 09:12:2007 09:53:51 Retransmission timeout, count = 4

16 ERROR 09:12:2007 09:53:51 failed to build ike sa with primary gateway

17 INFO 09:12:2007 09:53:51 Terminating SAP thread

18 INFO 09:12:2007 09:53:52 Terminating VPN Session

19 INFO 09:12:2007 09:53:52 Removing IPSec tunnels

20 WARNING 09:12:2007 09:53:52 no phase1 sa to send intial contact

21 DEBUG 09:12:2007 09:53:52 IPSec Deleted all SAs

22 DEBUG 09:12:2007 09:53:52 IPSec Deleted all VPNs

23 INFO 09:12:2007 09:53:52 Removing ike xauth callbacks

24 INFO 09:12:2007 09:53:52 Terminating ike library

25 INFO 09:12:2007 09:53:52 Terminating PF kernel

26 INFO 09:12:2007 09:53:52 Terminating ipsec thread

27 INFO 09:12:2007 09:53:54 VPN Session terminated successfully

4 replies

by cg it

failure to build the IKE SA causes the VPN to terminate.

by kenc

Any idea why it would not build?

by cg it

because IKE is exact. both sides must agree to each and every security association, option by option or the connection will not be made. So somewhere during that mutual agreement one side doesn't agree.

you have to determine what option on what host both don't agree upon and change it so they both agree.

This discussion is closed to new replies.