Need help with l2l-VPN, MikTik and Watchguard Firebox

Cartman · Tue Apr 15, 2014 11:12 pm

Hello World !!!

I am trying to establish a VPN between an RB/711 (ROS 6.12) and a Firebox XTM 22 (11.5.2.B338385).
IP of Firebox : 89.xxx.yyy.196 (static)
IP of MikTik : 213.xxx.yyy.46 (static)
Network on Firebox side : 10.0.0.0/24
Network on MikTik side : 192.168.3.0/24

Settings on Firebox (BOVPN):
Gateway :
PSK : test
Gateway endpoints :
Name : GW
local gateway : By IP address 89.xxx.yyy.196
remote gateway : Static IP address 213.xxx.yyy.46
gateway ID for tunnel authentication : 213.xxx.yyy.46

Phase 1 : Mode - aggressive
NAT Traversal 20 secs
DPD default

PH1 transform SHA1-3DES, DH2, SA life 8h

Tunnel :
Gateway : GW
Addresses :
Local 10.0.0.0/24
Remote : 192.168.3.0/24
bi-directional
Add to BOVPN-Allow

Phase 2 Proposals : ESP-AES-SHA1 (AES is 256 bit)

On MikTik :

/ip ipsec policy
add dst-address=10.0.0.254/32 proposal=proposal1 sa-dst-address=10.0.0.254 \
    sa-src-address=192.168.3.1 src-address=192.168.3.1/32 tunnel=yes

/ip ipsec peer
add address=89.xxx.yyy.196/32 enc-algorithm=aes-256 exchange-mode=aggressive \
    nat-traversal=yes secret=test

/ip ipsec proposal
set [ find default=yes ] enc-algorithms=3des
add enc-algorithms=3des,aes-256-cbc,aes-256-ctr name=proposal1

I am far from being a pro, but I think the setting should work.
There are absolutely no reactions on both systems.
I expect to see something in the FB´s logs showing 213.xxx.yyy.46, but it seems that
the MT does not even try to set up a connection.
In the MT logs there are also no messages about tries to connect.
If I could see errors, I could see that at least some packages were sent,
but there is no reaction on both sides.

Can somebody please help me to get this connection up ?
If more info is required, just ask.
Did not find anything helpful in the forum or Google.

Thx

rextended · Wed Apr 16, 2014 12:06 am

Use VPN with PPTP, is better,

and upgrade you WatchGuard XTM 22 to Fireware XTM 11.8.3.

Cartman · Wed Apr 16, 2014 12:45 am

Best would be not to use fireboxes. They are unusable, slow and completely undocumented.
The page does not work. No mail when I register. Their programmers should just let it be.

Back to topic:

The BOVPN on the firebox is already configured, I just try to connect the MikTik.
I have a few (~20) MikTik connected via VPN without problems, but the firebox
just refuses to work. Maybe the problem is in front of the screen, but there are no
resources for information about configuring fireboxes and I don´t want to, when
every click takes about 30 secs.

I just need a hint, how to connect to the firebox, taking it as a blackbox and not
wanting to touch it. All configuration should happen on the MikTik side.

TIA

ditonet · Wed Apr 16, 2014 1:05 am

I am far from being a pro, but I think the setting should work.

You are wrong, config on MikroTik side is completly messed up.
Do not use 'aggressive' mode, use 'main' instead.
NAT-Traversal should be 'no'.
Why do you have same addresses for 'dst-address' and 'sa-dst-address' ?
Same with 'src-address' and 'sa-src-address'.
Did you read MT Wiki about IPSec?
http://wiki.mikrotik.com/wiki/Manual:IP/IPsec

Regards,

Cartman · Wed Apr 16, 2014 1:43 am

The config was made based on the example on http://wiki.mikrotik.com/wiki/Manual:IP/IPsec
Switched mode to "main" on both sides.
Changed the mikTik settings to

add dst-address=10.0.0.254/32 proposal=proposal1 sa-dst-address=89.xxx.yyy.196 \
    sa-src-address=213.xxx.yyy.46 src-address=192.168.3.1/32 tunnel=yes

Now I get

phase1 negotiation failed due to time up

On the Firebox I get :

P1_Mode: recv 1st Msg failed in selecting IKE proposal

Don´t know if it is related to my device, but at that time of night, I might
be the only one.
At least there are messages now.

Off Topic : Does anyone know how to set up the clock in the firebox. It is set to "Berlin" but exactly 2 hours late, compared to
Berlin time. Time is only shown in the logs, not to find in the webinterface.

ditonet · Wed Apr 16, 2014 10:41 am

phase1 negotiation failed due to time up

In RouterOS, phase 1 settings are in 'IPSec/Peer'.
According to your previous post on Firebox side PH1 settings are:

PH1 transform SHA1-3DES, DH2, SA life 8h

On RouterOS side:

/ip ipsec peer
add address=89.xxx.yyy.196/32 enc-algorithm=aes-256 exchange-mode=aggressive \
nat-traversal=yes secret=test

It clearly shows difference in encryption algorithms used (3DES vs. AES-256).
Post your full 'IPSec' config, but using 'export verbose' method.

Regards,

Cartman · Wed Apr 16, 2014 4:34 pm

Here is a new export :

/ip ipsec mode-config
set (unknown) name=request-only send-dns=yes
/ip ipsec policy group
set default name=default
/ip ipsec proposal
set [ find default=yes ] auth-algorithms=sha1 disabled=no enc-algorithms=3des lifetime=30m name=default pfs-group=modp1024
add auth-algorithms=sha1 disabled=no enc-algorithms=aes-128-cbc,aes-192-cbc,aes-256-cbc,aes-128-ctr,aes-192-ctr,aes-256-ctr lifetime=30m name=proposal1 pfs-group=modp1024
/ip ipsec peer
# Unsafe configuration, suggestion to use certificates
add address=89.xxx.yyy.196/32 auth-method=pre-shared-key dh-group=modp1024 disabled=no dpd-interval=2m dpd-maximum-failures=5 enc-algorithm=3des exchange-mode=aggressive \
    generate-policy=no hash-algorithm=sha1 lifebytes=0 lifetime=1d local-address=192.168.2.105 my-id-user-fqdn=box.dyndns-office.com nat-traversal=yes passive=no port=500 \
    proposal-check=obey secret=test send-initial-contact=yes
/ip ipsec policy
add action=encrypt disabled=no dst-address=10.0.0.254/32 dst-port=any ipsec-protocols=esp level=require priority=0 proposal=proposal1 protocol=all sa-dst-address=\
    89.xxx.yyy.196 sa-src-address=192.168.2.105 src-address=192.168.2.105/32 src-port=any tunnel=yes

now I get :

 iked[910]: Process IKE Packet : mismatch length(0) in IsakmpHdr and InMsg(542)

The changes that were made :
- encryption set to 3DES
- static public IP on MT changed to fqdn, this is how it should work at the customer´s office
- MT´s IP 192.168.2.105, as it is located behind a DSL-router

I just tried to user PPTP, but did not get the routing to work.
BOVPN is the best choice for this, because the othe fireboxes are connected in that way.

If the dynamic IP is a problem, I will tell the customer to get a static IP without router as he has in the
other offices.

ditonet · Wed Apr 16, 2014 11:41 pm

If the dynamic IP is a problem, I will tell the customer to get a static IP without router as he has in the
other offices.

Yes, MT should be connect directly to WAN, with static IP address.

I found few mistakes in your config:

/ip ipsec peer
'local-address' must be your public (WAN) IP address, not local one
'exchange-mode' is still 'aggressive', should be 'main'
'my-id-user-fqdn' set to name which is resolved to your public IP
'nat-traversal' set to 'no'

/ip ipsec policy
'sa-src-address' set to your public IP address
'src-address' and 'dst-address' is set with mask /32, it means 'host-to-host' not 'subnet-to-subnet', change them to '/24'

'/ip ipsec proposal' is OK, my only advice is to remove unnecesary encryption algorithms, Firebox uses AES-256 as mentioned in your first post.

HTH,

Cartman · Tue May 06, 2014 11:04 pm

Did some other tests with one of my static IPs and it looks like phase 1 is working.

Firebox :

May  6 21:47:36 196-251-static 70A20651D126E (2014-05-06T19:47:36) iked[910]: MainMode: Completed pcy[gateway.lantzius] src 89.x.y.z dst 213.a.b.c:500 (P1SA 0xdc17c 1/11) as RESPONDER

On MT I get :

...
DPD R-U-There-Ack received
received an R-U-There Ack

then the log stays unchanged
Any hints how I get phase 2 to work ?

When the tunnel is up, does the MT add the routes to the external network automatically ?

thx

Cartman · Tue May 20, 2014 3:48 pm

Any idea ?

I am still stuck at

DPD R-U-THERE-ACK received

After that there is 2 minutes nothing and then :

18:36:13 ipsec,debug,packet DPD R-U-There-Ack received 
18:36:13 ipsec,debug,packet received an R-U-THERE-ACK 
18:38:13 ipsec,debug,packet DPD monitoring.... 
18:38:13 ipsec,debug,packet compute IV for phase2 
18:38:13 ipsec,debug,packet phase1 last IV: 
18:38:13 ipsec,debug,packet c71e1bef 84170d34 b4d6694d 
18:38:13 ipsec,debug,packet hash(sha1) 
18:38:13 ipsec,debug,packet encryption(3des) 
18:38:13 ipsec,debug,packet phase2 IV computed: 
18:38:13 ipsec,debug,packet 52a3dd6f 1b4909b8 
18:38:13 ipsec,debug,packet HASH with: 
18:38:13 ipsec,debug,packet b4d6694d 00000020 00000001 01108d28 0dc040cd 98d0f4d9 
1165bb58 bc83f1aa 
18:38:13 ipsec,debug,packet 000001be 
18:38:13 ipsec,debug,packet hmac(hmac_sha1) 
18:38:13 ipsec,debug,packet HASH computed: 
18:38:13 ipsec,debug,packet 9242fe75 945966bd 03cc9acc f08f02a4 80a9e78c 
18:38:13 ipsec,debug,packet begin encryption. 
18:38:13 ipsec,debug,packet encryption(3des) 
18:38:13 ipsec,debug,packet pad length = 8 
18:38:13 ipsec,debug,packet 0b000018 9242fe75 945966bd 03cc9acc f08f02a4 80a9e78c 
00000020 00000001 
18:38:13 ipsec,debug,packet 01108d28 0dc040cd 98d0f4d9 1165bb58 bc83f1aa 000001be 
86028adf 40c2d207 
18:38:13 ipsec,debug,packet encryption(3des) 
18:38:13 ipsec,debug,packet with key: 
18:38:13 ipsec,debug,packet 7a237713 427b7851 a71d9f53 18c7614f c2c21402 d49fd525 
18:38:13 ipsec,debug,packet encrypted payload by IV: 
18:38:13 ipsec,debug,packet 52a3dd6f 1b4909b8 
18:38:13 ipsec,debug,packet save IV for next: 
18:38:13 ipsec,debug,packet bec5e448 2021fd93 
18:38:13 ipsec,debug,packet encrypted. 
18:38:13 ipsec,debug,packet 92 bytes from 213.x.x.47[500] to 89.x.y.196[500
] 
18:38:13 ipsec,debug,packet sockname 213.x.y.47[500] 
18:38:13 ipsec,debug,packet send packet from 213.x.y.47[500] 
18:38:13 ipsec,debug,packet send packet to 89.x.y.196[500] 
18:38:13 ipsec,debug,packet src4 213.x.y.47[500] 
18:38:13 ipsec,debug,packet dst4 89.x.y.196[500] 
18:38:13 ipsec,debug,packet 1 times of 92 bytes message will be sent to 89.x.y.196[500] 
18:38:13 ipsec,debug,packet 0dc040cd 98d0f4d9 1165bb58 bc83f1aa 08100501 b4d6694d 
0000005c cedad27b 
18:38:13 ipsec,debug,packet 247d88dd 6c4ae712 97cb5033 33c90b69 883dee32 3c5feaeb 
cfa03c0c df80014f 
18:38:13 ipsec,debug,packet 2c3e988a d09d8701 fd6b57ca de59b99d 7498133e bec5e448 
2021fd93 
18:38:13 ipsec,debug,packet sendto Information notify. 
18:38:13 ipsec,debug,packet DPD R-U-There sent (0) 
18:38:13 ipsec,debug,packet rescheduling send_r_u (2). 
18:38:13 ipsec,debug,packet ========== 
18:38:13 ipsec,debug,packet 84 bytes message received from 89.x.y.196[500] to 2
13.158.104.47[500] 
18:38:13 ipsec,debug,packet 0dc040cd 98d0f4d9 1165bb58 bc83f1aa 08100501 b478b1a6 
00000054 5a777f4b 
18:38:13 ipsec,debug,packet f1369407 194c9cf4 0d15309c 71310528 33b5f537 9229a155 
2f15ab62 5db767c3 
18:38:13 ipsec,debug,packet e0eb8a25 163f5693 51690061 2a8005e3 7f235f9d 
18:38:13 ipsec,debug,packet receive Information. 
18:38:13 ipsec,debug,packet compute IV for phase2 
18:38:13 ipsec,debug,packet phase1 last IV: 
18:38:13 ipsec,debug,packet c71e1bef 84170d34 b478b1a6 
18:38:13 ipsec,debug,packet hash(sha1) 
18:38:13 ipsec,debug,packet encryption(3des) 
18:38:13 ipsec,debug,packet phase2 IV computed: 
18:38:13 ipsec,debug,packet aa624fcb ba7588a6 
18:38:13 ipsec,debug,packet encryption(3des) 
18:38:13 ipsec,debug,packet IV was saved for next processing: 
18:38:13 ipsec,debug,packet 2a8005e3 7f235f9d 
18:38:13 ipsec,debug,packet encryption(3des) 
18:38:13 ipsec,debug,packet with key: 
18:38:13 ipsec,debug,packet 7a237713 427b7851 a71d9f53 18c7614f c2c21402 d49fd525 
18:38:13 ipsec,debug,packet decrypted payload by IV: 
18:38:13 ipsec,debug,packet aa624fcb ba7588a6 
18:38:13 ipsec,debug,packet decrypted payload, but not trimed. 
18:38:13 ipsec,debug,packet 0b000018 8c4d685c 2292445f 09350d88 8ccfecc5 ee4c4842 
00000020 00000001 
18:38:13 ipsec,debug,packet 01108d29 0dc040cd 98d0f4d9 1165bb58 bc83f1aa 000001be 
18:38:13 ipsec,debug,packet padding len=191 
18:38:13 ipsec,debug,packet skip to trim padding. 
18:38:13 ipsec,debug,packet decrypted. 
18:38:13 ipsec,debug,packet 0dc040cd 98d0f4d9 1165bb58 bc83f1aa 08100501 b478b1a6 
00000054 0b000018 
18:38:13 ipsec,debug,packet 8c4d685c 2292445f 09350d88 8ccfecc5 ee4c4842 00000020 
00000001 01108d29 
18:38:13 ipsec,debug,packet 0dc040cd 98d0f4d9 1165bb58 bc83f1aa 000001be 
18:38:13 ipsec,debug,packet HASH with: 
18:38:13 ipsec,debug,packet b478b1a6 00000020 00000001 01108d29 0dc040cd 98d0f4d9 
1165bb58 bc83f1aa 
18:38:13 ipsec,debug,packet 000001be 
18:38:13 ipsec,debug,packet hmac(hmac_sha1) 
18:38:13 ipsec,debug,packet HASH computed: 
18:38:13 ipsec,debug,packet 8c4d685c 2292445f 09350d88 8ccfecc5 ee4c4842 
18:38:13 ipsec,debug,packet hash validated. 
18:38:13 ipsec,debug,packet begin. 
18:38:13 ipsec,debug,packet seen nptype=8(hash) 
18:38:13 ipsec,debug,packet seen nptype=11(notify) 
18:38:13 ipsec,debug,packet succeed. 
18:38:13 ipsec,debug,packet DPD R-U-There-Ack received 
18:38:13 ipsec,debug,packet received an R-U-THERE-ACK

There is not error, but I still cannot ping through the tunnel.
Or is the mistake somewhere else ?

Cartman · Tue May 20, 2014 5:23 pm

Shouldn´t the MikTik send a reply to the R-U-THERE-Ack ?
The messages above just loop every 120 secs.

Need help with l2l-VPN, MikTik and Watchguard Firebox

Need help with l2l-VPN, MikTik and Watchguard Firebox

Re: Need help with l2l-VPN, MikTik and Watchguard Firebox

Re: Need help with l2l-VPN, MikTik and Watchguard Firebox

Re: Need help with l2l-VPN, MikTik and Watchguard Firebox

Re: Need help with l2l-VPN, MikTik and Watchguard Firebox

Re: Need help with l2l-VPN, MikTik and Watchguard Firebox

Re: Need help with l2l-VPN, MikTik and Watchguard Firebox

Re: Need help with l2l-VPN, MikTik and Watchguard Firebox

Re: Need help with l2l-VPN, MikTik and Watchguard Firebox

Re: Need help with l2l-VPN, MikTik and Watchguard Firebox

Re: Need help with l2l-VPN, MikTik and Watchguard Firebox

Who is online