Screen OS

Hello,

     I have an issue with one of our customer's IPSEC VPN . We are using Juniper SSG 140(recently migrated from NortelConnectivity 600) and the Remote peer is Nortel Device. We were able to migrate VPN Configurations from Nortel to Juniper. Butthese days what happens is VPN goes down for 5 to 10 minis and comes back. When the link goes down I can see few Negationerrors on Event Log (Attached Screen shot). I have disabled Vendor ID and Compression on Nortel Device,still no luck.....

      Does anyone has any ideas to solve this issue or Do we need to change any settings?

Thanks in advance,

Regards,

Rijo Varghese

According to the screenshot, phase 2 failed as the proposals did not match.

I would suggest checking the configuration on the SSG and the Nortel device, specifically the proposals and make sure they are the same.

Thanks Nadia.. I had verified proposals they are same... no changes... but the thing is these errors happens once in a day or sometimes in a week... automatically  link goes down for 5 to 10 mins and comes up automatically .. Is there any thing to do with Mode (Initiator) Main and Aggressive in juniper SSG?

Hi,

The error rejected an IKE packet because there were no acceptable Phase 2 proposals typically occurs if the Phase 2 proposals on both end points do not match. IKE debug provides full specifics regarding the proposal settings. To correct the problem, simply modify the Phase 2 proposal for one of the devices so it matches the other.

Gavrilo

Hi Rijo,

Sorry It lost half my text in my last response but I decided to provide a fuller explanation, so here goes.

IKE supports two modes of negotiation, Main mode and Aggressive mode. Main mode is the standard method used for site-to-site VPNs with static peers. Aggressive mode is typically used for VPN clients and sites with dynamic IP addresses.

In Main mode, the VPN tunnel initiator and the recipient send three two-way exchanges, a total of 6 messages. These are as follows:

• First exchange (messages 1 and 2): Propose and accept the encryption and authentication algorithms
• Second exchange (messages 3 and 4): Execute a DH exchange where the initiator and recipient each provide a nonce (a randomly generated number)
• Third exchange (messages 5 and 6): Send and verify identities

By exchanging identity information after the second exchange where an encryption method has been established, the identity information remains secure. In Aggressive mode, a secure tunnel is still established but requires only 2 exchanges with a total of 3 messages which are:

• First message: The VPN tunnel initiator proposes the SA, initiates a Diffie-Hellman key exchange, sends a nonce and its IKE identity
• Second message: The recipient accepts the SA, authenticates the initiator, sends a nonce, its IKE identity and its digital certificate (if digital certificates are in use)
• Third message: The initiator authenticates the recipient, confirms the exchange and sends its digital certificate (if digital certificates are in use)

Because the identities of both parties are sent in the clear, Aggressive mode does not provide identity protection. If you have different settings each end it is highly likly your VPN would never work.

Regards

Gavrilo

From the logging I conclude that everything goes well when the Juniper initiates the connection to the Nortel device.

So they accept your Phase2 proposal, you do not accept theirs. They (the Nortel side) probably have a bunch of Phase2 proposals.

You probably have just one, and they don't offer that when they initiate.

You could ask them to narrow down to just one Phase2 proposal.

Also be sure to check for the PFS (Perfect Forward Secrecy) setting.

 Hey, Many thanks it worked... I verified the PFS settings on both ends.. On Nortel side PFS was disabled..  we enabled it and I don't see any negotiations errors for the Tunnel ...Many thanks for your inputs..

But now I see retransmission errors on the tunnel... If clear IKE-cookies on my side, New SA initiates and establish the new session.. 

I'm not sure why  retransmission errors occurs.. ? Do you have any work around on this..? I am attaching a screen shot...

Thanks in advance,

Rijo

Hi

Do you try to check the phase 2 settings, including the proposals, you could create a personalized proposal, and try to use the PFS.