Contivity 1050 and 221 VPN Setup

[hall5942]

I have a Contivity 1050 @ the Main Branch and a 221 and the remote site. I am trying to setup a branch tunnel with no luck. In the logs it shows "Phase 1 IKE SA process done" then shows "!! No proposal chosen". The manual says make sure that you are using the correct IPSec parameters. I have the 221 setup to use ESP-DES Sha1, that is also checked on the 1050. What am I missing?

Thanks.

 

[MagnaRGP]

You need to carefully review the IPSec settings on both sites:

In the 1050 tunnel profile, ensure that ALL encryption types are allowed except AH only.

You also need to verify the Diffie Hellman settings.

It will take some trial and error, but you'll get it.

 

[hall5942]

On the 1050 is the only place to enable the encryption under
Profiles-->Branch Office-->then configure under Group/Base
That is the only place that I see anything.

On the 1050, I setup a group under base (Base/XYZ company)I have the XYZ company group inherite from Base group and have everything checked but AH only.
My Diffie-Hellman is set to 56-Bit DES with Group 1 (768-bit prime). I also changed it to all the other settings as well with no luck. However, I don't see a Diffie-Hellman setting on the 221 side.

Thanks for your help on this.

 

[HungryHouse]

Sounds like you are not getting phase 2 up which means the security association is failing. Most common cause is the routing negotiation is disparate between the two. Check available network/routes that each side is advertising.
Branch tunnels fail often for this reason.

 

[hall5942]

Is there a place in the 1050 to check the phase 2 Authentication. I Changed all of the Phase 2 settings to every combination I can and still no luck.

 

[HungryHouse]

Under Profiles--> Branch Office--> Check to be certain that the 'local' and 'remote' networks being advertised are the same respectively.
On the 221, it will be under VPN, branch office, IP Policy, edit.
There are several things for phase 2...you wont see (1)place for everything...this is just the most common aspect that often is messed up.

 

[hall5942]

Everything matches

 

[HungryHouse]

IS are there are any NAT routers between the Contivities?

 

[hall5942]

no. I even set then NAT Transversal on to try but it still does the same thing.

 

[HungryHouse]

What version of code on each contivity?

 

[hall5942]

on the 221 the software is VE221_2.0.0.0.013 | 12/01/2003

on the 1050 the software is V04_07.021

is that what you needed?

 

[hall5942]

It finally connected. Thanks for all of your help.

 

[HungryHouse]

Hall5942, what was the resolution? Now, I'm curious.

 

[hall5942]

Perfect Forward Secrecy was disabled on the 1050 and enabled on the 221. Thanks for all of your help.

 

[HungryHouse]

Ok- excellent...glad its nor resolved. Take care.