Screen OS

Hi,

We have two networks that we need to connect with a VPN connection. The remote network is in AWS with the IP range 10.0.0.0/16 and our lokal network has the IP range 192.168.53.0/24. AWS kindly provides a setup file that can be used to configure the VPN tunnels. Using that file, I was able to get the tunnels to establish. The screenshots below show what the ScreenOS VPN Monitor and the AWS Tunnel Details display since the tunnels were created.

Our SSG-5 sits behind our router and its outgoing interface eth0/0 has the static IP address 192.168.53.200. Our router has the static IP 192.168.53.2. For now, devices that are in bgroup0 (192.168.1.0) should be able to access any 10.0.0.0/16 servers through the VPN, but when we try to ping an server in that range, nothing happens. Following the trouble shooting guide from AWS, we noticed that we also can't ping the inside IP's of the tunnels. As the tunnels are displayed as UP and the SA Status is active I believe that this must be an simple routing issue. I looked through many posts on this forum yet none of the solutions that were suggested in other posts solved my issue. I will post my config file below, maybe someone here sees an simple mistake in my routings or in other areas and can help me fix this.

Best wishes,

unset key protection enable
set clock timezone 0
set vrouter trust-vr sharable
set vrouter "untrust-vr"
exit
set vrouter "trust-vr"
unset auto-route-export
exit
set alg appleichat enable
unset alg appleichat re-assembly enable
set alg sctp enable
set auth-server "Local" id 0
set auth-server "Local" server-name "Local"
set auth default auth server "Local"
set auth radius accounting port 1646
set admin name "netscreen"
set admin password "nKVUM2rwMUzPcrkG5sWIHdCtqkAibn"
set admin auth web timeout 10
set admin auth dial-in timeout 3
set admin auth server "Local"
set admin format dos
set zone "Trust" vrouter "trust-vr"
set zone "Untrust" vrouter "trust-vr"
set zone "DMZ" vrouter "trust-vr"
set zone "VLAN" vrouter "trust-vr"
set zone "Untrust-Tun" vrouter "trust-vr"
set zone "Trust" tcp-rst 
set zone "Trust" asymmetric-vpn
set zone "Untrust" block 
unset zone "Untrust" tcp-rst 
unset zone "V1-Trust" tcp-rst 
unset zone "V1-Untrust" tcp-rst 
set zone "DMZ" tcp-rst 
unset zone "V1-DMZ" tcp-rst 
unset zone "VLAN" tcp-rst 
set zone "Untrust" screen tear-drop
set zone "Untrust" screen syn-flood
set zone "Untrust" screen ping-death
set zone "Untrust" screen ip-filter-src
set zone "Untrust" screen land
set zone "V1-Untrust" screen tear-drop
set zone "V1-Untrust" screen syn-flood
set zone "V1-Untrust" screen ping-death
set zone "V1-Untrust" screen ip-filter-src
set zone "V1-Untrust" screen land
set interface "ethernet0/0" zone "Untrust"
set interface "ethernet0/1" zone "DMZ"
set interface "bgroup0" zone "Trust"
set interface "tunnel.1" zone "Trust"
set interface "tunnel.2" zone "Trust"
set interface bgroup0 port ethernet0/2
set interface bgroup0 port ethernet0/3
set interface bgroup0 port ethernet0/4
set interface bgroup0 port ethernet0/5
set interface bgroup0 port ethernet0/6
unset interface vlan1 ip
set interface ethernet0/0 ip 192.168.53.200/24
set interface ethernet0/0 route
set interface bgroup0 ip 192.168.1.1/24
set interface bgroup0 nat
set interface tunnel.1 ip 169.254.23.174/30
set interface tunnel.2 ip 169.254.23.46/30
set interface tunnel.1 mtu 1436
set interface tunnel.2 mtu 1436
unset interface vlan1 bypass-others-ipsec
unset interface vlan1 bypass-non-ip
set interface ethernet0/0 ip manageable
set interface bgroup0 ip manageable
set interface ethernet0/0 manage ping
set interface ethernet0/0 manage ssh
set interface ethernet0/0 manage telnet
set interface ethernet0/0 manage ssl
set interface ethernet0/0 manage web
set interface ethernet0/0 dhcp client enable
unset interface ethernet0/0 dhcp client settings update-dhcpserver
set interface bgroup0 dhcp server service
set interface bgroup0 dhcp server auto
set interface bgroup0 dhcp server option gateway 192.168.1.1 
set interface bgroup0 dhcp server option netmask 255.255.255.0 
set interface bgroup0 dhcp server option dns1 192.168.53.2 
set interface bgroup0 dhcp server ip 192.168.1.33 to 192.168.1.126 
unset interface bgroup0 dhcp server config next-server-ip
set interface "serial0/0" modem settings "USR" init "AT&F"
set interface "serial0/0" modem settings "USR" active
set interface "serial0/0" modem speed 115200
set interface "serial0/0" modem retry 3
set interface "serial0/0" modem interval 10
set interface "serial0/0" modem idle-time 10
set flow tcp-mss
unset flow no-tcp-seq-check
set flow tcp-syn-check
unset flow tcp-syn-bit-check
set flow reverse-route clear-text prefer
set flow reverse-route tunnel always
set flow vpn-tcp-mss 1387
set pki authority default scep mode "auto"
set pki x509 default cert-path partial
set dns host dns1 192.168.53.2
set dns host dns2 0.0.0.0
set dns host dns3 0.0.0.0
set crypto-policy
exit
set ike p1-proposal "ike-prop-vpn-05257343a105a43-1" preshare group2 esp aes128 sha-1 second 28800
set ike p1-proposal "ike-prop-vpn-0525743a105a43-2" preshare group2 esp aes128 sha-1 second 28800
set ike p2-proposal "ipsec-prop-vpn-0525743a105a43-1" group2 esp aes128 sha-1 second 3600
set ike p2-proposal "ipsec-prop-vpn-0525743a105a43-2" group2 esp aes128 sha-1 second 3600
set ike gateway "gw-vpn-0525734c43a105a43-1" address 34.250.138.XXX Main outgoing-interface "ethernet0/0" preshare "CXAzrY7cNVnvXXXwu69ooukM48x8FcX0x1NTrdBdQ" proposal "ike-prop-vpn-05257343a105a43-1"
set ike gateway "gw-vpn-0525734c43a105a43-1" dpd-liveness interval 10
set ike gateway "gw-vpn-0525734c43a105a43-1" dpd-liveness retry 3
set ike gateway "gw-vpn-0525734c43a105a43-2" address 52.31.30.XX Main outgoing-interface "ethernet0/0" preshare "2n1V8rgeNQN8XXXX4jmYKph8vbfkGABYm8LW3oAgz4KaqWiTUcI" proposal "ike-prop-vpn-0525743a105a43-2"
set ike gateway "gw-vpn-0525734c43a105a43-2" dpd-liveness interval 10
set ike gateway "gw-vpn-0525734c43a105a43-2" dpd-liveness retry 3
set ike respond-bad-spi 1
set ike ikev2 ike-sa-soft-lifetime 60
unset ike ikeid-enumeration
unset ike dos-protection
unset ipsec access-session enable
set ipsec access-session maximum 5000
set ipsec access-session upper-threshold 0
set ipsec access-session lower-threshold 0
set ipsec access-session dead-p2-sa-timeout 0
unset ipsec access-session log-error
unset ipsec access-session info-exch-connected
unset ipsec access-session use-error-log
set vpn "IPSEC-vpn-0525734c43a105a43-1" gateway "gw-vpn-0525734c43a105a43-1" replay tunnel idletime 0 proposal "ipsec-prop-vpn-0525743a105a43-1" 
set vpn "IPSEC-vpn-0525734c43a105a43-1" id 0x1 bind interface tunnel.1
set vpn "IPSEC-vpn-0525734c43a105a43-2" gateway "gw-vpn-0525734c43a105a43-2" replay tunnel idletime 0 proposal "ipsec-prop-vpn-0525743a105a43-2" 
set vpn "IPSEC-vpn-0525734c43a105a43-2" id 0x2 bind interface tunnel.2
unset interface tunnel.1 acvpn-dynamic-routing
unset interface tunnel.2 acvpn-dynamic-routing
set url protocol websense
exit
set policy id 1 from "Trust" to "Untrust"  "Any" "Any" "ANY" permit 
set policy id 1
exit
set nsmgmt bulkcli reboot-timeout 60
set ssh version v2
set config lock timeout 5
unset license-key auto-update
set telnet client enable
set snmp port listen 161
set snmp port trap 162
set snmpv3 local-engine id "0162032007005954"
set vrouter "untrust-vr"
exit
set vrouter "trust-vr"
set protocol bgp 65000
set enable
set hold-time 30
set neighbor 169.254.23.4X remote-as 64512
set neighbor 169.254.23.4X enable
set neighbor 169.254.23.4X hold-time 30
set neighbor 169.254.23.1XX remote-as 64512
set neighbor 169.254.23.1XX enable
set neighbor 169.254.23.1XX hold-time 30
unset ipv4 synchronization
set ipv4 neighbor 169.254.23.4X activate
set ipv4 neighbor 169.254.23.17X activate
set ipv4 neighbor 169.254.23.17X advertise-def-route
exit
unset add-default-route
exit
set interface tunnel.1 protocol bgp
set interface tunnel.2 protocol bgp
set vrouter "untrust-vr"
exit
set vrouter "trust-vr"
exit

Hi,

Is AWS pushing a route for 10.0.x.x network to you via BGP?

Can you share the output of 'get route' from the SSG?

You may also want to advertise the 192.168.1.x network to AWS for return traffic routing.

Hi Gokul,

Thanks for the reply. Yes as far as I understand it AWS should be pushing 0.0.0.0/0 through the VPN. We have enabled route propagation for the two route tables that go with our VPC. Just in case, we've added a route from our 192.168.53.0/24 to the virtual private gateway (vgw-07dd....) which is attached to the VPN. This can be seen on the screenshot below.

Applying this small change to the route table in AWS didn't solve the issue.

When running your suggested 'get route' it returns the following information:

Any ideas what I'm missing or what I've miss configured wrong?

Best wishes,

Christopher

hi christopher,

    can you please post the ike errors from your ssg? if this is an ike gateway timeout then clearly its a routing issue.  

  based on my experience with SRX vpn towards Azure, the issue was Azure's natting. How they handle routing within their premises.

   you can ask support for AWS if you have and do the tshooting. 

Hi dwayne,

It doesn't seem to be an ike gateway timeout. When looking at the event log, I can't see any issues with it. The event log can be seen below.

2019-05-04 08:36:18 system info  00542 BGP peer 169.254.23.17X changed to
                                       Established state
2019-05-04 08:36:17 system info  00542 BGP peer 169.254.23.4X changed to
                                       Established state
2019-05-04 08:36:16 system info  00536 IKE 34.250.138.25X Phase 2 msg ID
                                       3c52af4a: Completed negotiations with
                                       SPI 0d3a492c, tunnel ID 1, and
                                       lifetime 3600 seconds/0 KB.
2019-05-04 08:36:16 system info  00536 IKE 34.250.138.25X phase 2:The
                                       symmetric crypto key has been
                                       generated successfully.
2019-05-04 08:36:16 system info  00536 IKE 34.250.138.25X Phase 2: Initiated
                                       negotiations.
2019-05-04 08:36:15 system info  00536 IKE 52.31.30.3X Phase 2 msg ID
                                       d825cdfa: Completed negotiations with
                                       SPI 0d3a492b, tunnel ID 2, and
                                       lifetime 3600 seconds/0 KB.
2019-05-04 08:36:15 system info  00536 IKE 52.31.30.3X phase 2:The symmetric
                                       crypto key has been generated
                                       successfully.
2019-05-04 08:36:15 system info  00536 IKE 52.31.30.3X Phase 2: Initiated
                                       negotiations.

Could this be an issue with the routes in the SSG?

Best wishes,

Christopher