User manual ZYXEL ZYWALL 10 GREENBOW VPN CLIENT

[. . . ] 0 ZyWall VPN Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 0 ZyWall VPN Configuration interface. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . [. . . ] 0 4. 6 « INVALID ID INFORMATION » error . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 0 4. 7 I clicked on "Open tunnel", but nothing happens. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 0 Contacts. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 0 5 IPSec VPN Router Configuration Property of TheGreenBow Sistech SA - © Sistech 2001-2005 2/12 Doc. Ref Doc. version VPN version tgbvpn_cg_ZyWall10_en 2. 0 ­ Nov. 2004 2. 5x 1 Introduction 1. 1 Goal of this document This document describes how to configure TheGreenBow VPN Client with a Zyxel ZyWall 10. 1. 2 Network topology In our example, we will connect TheGreenBow VPN client to the LAN behind the Zyxel ZyWall Router. The VPN client is connected to the Internet by a dialup connection from an ISP. All the addresses in this document are given for example purpose. 192. 168. 1. 3 80. 11. 8. 4 155. 2. 4. 36 192. 168. 1. 1 Internet Zyxel ZyWall 10 192. 168. 1. 78 192. 168. 100. 57 IPSec VPN Router Configuration Property of TheGreenBow Sistech SA - © Sistech 2001-2005 3/12 Doc. Ref Doc. version VPN version tgbvpn_cg_ZyWall10_en 2. 0 ­ Nov. 2004 2. 5x 2 ZyWall VPN Configuration ZyNOS Firmware version release of the Zyxel ZyWall 10 used during tests was ZyNOS 3. 52 (WA. 3) | 05/28/2003. 2. 1 ZyWall VPN Configuration interface Zywall VPN configuration can be achieved with a web browser. Once connected to your VPN gateway, click on "VPN" link in the Zyxel ZyWALL 10 VPN configuration interface. Select a VPN connection and click on "Edit": 2. 2 ZyWall IKE Mode Click on "Active". Select "IKE" and "Main" if you want to use IKE Main mode exchange. IPSec VPN Router Configuration Property of TheGreenBow Sistech SA - © Sistech 2001-2005 4/12 Doc. Ref Doc. version VPN version tgbvpn_cg_ZyWall10_en 2. 0 ­ Nov. 2004 2. 5x 2. 3 ZyWall Phase 2 IDs The settings "Local" and "Remote" are in fact Phase 2 IDs. In Local Address Type, you must select "Subnet Address" and fill the field "Starting IP Address" with the IP addresses of your LAN. 2. 4 ZyWall Phase 1 IDs Phase 1 IDs are set in the following view of the configuration interface. We choose to use IP Addresses as IDs. 2. 5 ZyWall IPSec Protocol Next step consists into selecting IPSec Protocol. [. . . ] You should have more information in the remote endpoint logs. 4. 4 « received remote ID other than expected » error 120348 Default (SA ZyWALL-P1) SEND phase 1 Main Mode [SA][VID] 120349 Default (SA ZyWALL-P1) RECV phase 1 Main Mode [SA][VID] 120349 Default (SA ZyWALL-P1) SEND phase 1 Main Mode [KEY][NONCE] 120351 Default (SA ZyWALL-P1) RECV phase 1 Main Mode [KEY][NONCE] 120351 Default (SA ZyWALL-P1) SEND phase 1 Main Mode [ID][HASH][NOTIFY] 120351 Default (SA ZyWALL-P1) RECV phase 1 Main Mode [ID][HASH][NOTIFY] 120351 Default ike_phase_1_recv_ID: received remote ID other than support@thegreenbow. fr expected The « Remote ID » value (see « Advanced » Button) do not match what the remote endpoint is expected. IPSec VPN Router Configuration Property of TheGreenBow Sistech SA - © Sistech 2001-2005 9/12 Doc. Ref Doc. version VPN version tgbvpn_cg_ZyWall10_en 2. 0 ­ Nov. 2004 2. 5x 4. 5 « NO PROPOSAL CHOSEN » error 115911 Default (SA ZyWALL-P1) SEND phase 1 Main Mode [SA][VID] 115913 Default (SA ZyWALL-P1) RECV phase 1 Main Mode [SA][VID] 115913 Default (SA ZyWALL-P1) SEND phase 1 Main Mode [KEY][NONCE] 115915 Default (SA ZyWALL-P1) RECV phase 1 Main Mode [KEY][NONCE] 115915 Default (SA ZyWALL-P1) SEND phase 1 Main Mode [ID][HASH][NOTIFY] 115915 Default (SA ZyWALL-P1) RECV phase 1 Main Mode [ID][HASH][NOTIFY] 115915 Default phase 1 done: initiator id c364cd70: 195. 100. 205. 112, responder id c364cd72: 195. 100. 205. 114, src: 195. 100. 205. 112 dst: 195. 100. 205. 114 115915 Default (SA ZyWALL-ZyWALL-P2) SEND phase 2 Quick Mode [SA][KEY][ID][HASH][NONCE] 115915 Default RECV Informational [HASH][NOTIFY] with NO_PROPOSAL_CHOSEN error 115915 Default RECV Informational [HASH][DEL] 115915 Default ZyWALL-P1 deleted If you have an « NO PROPOSAL CHOSEN » error, check that the « Phase 2 » encryption algorithms are the same on each side of the VPN Tunnel. A target on your remote LAN can receive pings but does not answer because there is a no "Default gateway" setting. [. . . ]