10-19-2008 04:32 PM
I have configured IPSec in SSG20 with other brand firewall. I configured tunnel, policy, gateway,AutoIKE, Static route everything and also match cetificate as well. But my tunnel doen't come up and I got below message in my event log.
"Phase 1: Retransmission limit has been reached"
I can't find this proble. Please help me out.
10-19-2008 11:13 PM
The message You get can cover more issues(Preshared key, Proxy ID and more).
Have You tried doing a "debug ike detail" it can give a better picture of what exactly is the problem.
The following is a link to a knowledgebase article which is a great help in configuring and troubleshooting VPN.
If this worked for you then please flag my post as an "Accepted Solution" so others can benefit from it. A kudo would be nice if you think I earned it
10-20-2008 10:56 PM
Definitely check out the Juniper VPN Resolution Guide.
Retransmission limit reached implies that you are sending out UDP 500 packets, but not getting a reply. Can you confirm on the remote peer whether or not you are seeing IKE packets received? If not then check for any other routers/NAT devices/firewalls between your SSG20 and the remote peer.
10-21-2008 10:51 AM
your tunnel interface must be in the state of "ready" , double check whether you have enabled "vpn monitor", disable that one. Also check the remote peer's configurations. Further more verify the pre-shared key, Proxy ID, and proposals, that all must be same on both sides.
JNCIE-M/T # 756
+92-301-8247638 begin_of_the_skype_highlighting +92-301-8247638 end_of_the_skype_highlighting
+92-321-2370510 begin_of_the_skype_highlighting +92-321-2370510 end_of_the_skype_highlighting
10-22-2008 12:13 AM
10-22-2008 10:48 PM
Proxy ID may definitely come into play at some point. But since phase 1 is not even able to complete we are not there yet. Pre-shared keys hasn't really come into play yet either as based on retransmission messages, it is clear that we are not seeing any IKE packets returning hence the retransmission.
My advice is to troubleshoot the ability to send/receive UDP 500 packets between your two peers. That means you may also have to check the remote peer side to determine if there is another device between the two peers that is blocking UDP 500 traffic. Perhaps another firewall or a router with ACL configured?