thas what I did.
Log into SSG320 A through the web interface
Configure your tunnel interface
Click Network -> Interfaces
Make sure the dropdown in the top left says Tunnel IF, and click New
I put mine in the Untrust zone because I want all of my VPN traffic to run throug my Untrust->Trust policy
Click unnumbered and select the untrust interface ( this case the untrust interface is what I configured with ip from my isp )
click OK
Configure your VPN Gateway
Click VPNs -> AutoKey Advanced -> Gateway
click New
Name the gateway "FWB-gw"
I select the custom security level
Enter the public IP address of Firewall B ( this is the public address when I go to internet isnt it? ) as 82.XXX.XXX.146/29
Carefully enter your preshared key
select untrust for your outgoing interface ( I select the zone that I created before for the isp interface )
click advanced
select User defined (custom)
in the first dropdown select pre-g2-aes128-sha
click return at the bottom
click OK at the bottom
Create the VPN
on the menu on the left select VPNs -> Autokey ike
click New
name it FWB-vpn
select Custom
leave predefined checked and select your FW-gw in the dropdown
click Advanced
select custom
in the first dropdown, select g2-esp-aes128-sha
turn on replay protection
Bind to tunnel interface, and select your tunnel interface you created in step 2
turn on VPN monitor (this will bring up the VPN right away and keep it up even when there´s no traffic on it) my case it didnt ...
click Return
click OK
add routes to the remote network. I will add a static.
menu click Network -> Routing -> Destination
click new
type in the network address behind Firewall B ( this is the private ip address behind the firewall B the One I m tying to reach. isnt it? I used as 172.22.1.XXX/32
Select Gateway
Select your tunnel interface in the dropdown ( selected tunnel 1 )
( no ip addresses added under the tunnel interface
click ok
Add policy to allow access to/from the remote network. Create an Untrust->Trust policy which allows access from the Network
behind FWB to hosts or the network behind FWB. You probably want to allow Ping at a minimum.
as from FWA trust zone to untrust zone --- > 172.16.1.XXX/32 to 172.22.1.XXX/32
and from FWA untrust zone to trust zone --- > 172.22.1.XXX/32 to 172.16.1.XXX/32
Repeat steps 1-6 on SSG320 B. Substituting SSG320 B´s data.
After I did all that
SSG320 B
VPn name - FWA-VPN
SA ID - 0000000c
policy id - -1/-1
Peer Gw ip - 82.145.XXX.XXX
TYPE - AutoIKE
SA status - inactive
SA link - inactive
SSG320 A
VPn name - FWB-VPN
SA ID - 00000001
policy id - -1/-1
Peer Gw ip - 82.145.YYY.Y
TYPE - AutoIKE
SA status - inactive
SA link - inactive
and event logs of both firewall.
SSG320 A
IKE 82.145.YYY.Y Phase 1: Retransmission limit has been reached
on firewall A thats the only error msg comes up
SSG320 B
Responder starts MAIN mode negotiations.
IKE 82.145.XXX.XXX Phase 1: Retransmission limit has been reached
Added Phase 2 session tasks to the task list.
and continues
please let me know where is what missing. thnx
