USG Flex 200 doesnt allow windows 11 IPSEC Phase 1 conection

AntonK

Hi my USG Flex was configured for low security ipsec vpn with linux clients

USG Flex 200 doesnt allow windows 11 IPSEC Phase 1 conection:

"Recv IKE sa: SA([0] protocol = IKE (1), AES CBC key len = 256, HMAC-SHA1 PRF, HMAC-SHA1-96, 384 bit ECP, AES CBC key len = 128, 256 bit ECP, 2048 bit MODP, 3DES, 1024 bit MODP, HMAC-MD5 PRF, HMAC-MD5-96, DES, 768 bit MODP; )."

so what can be done on usg flex side or windows 11 side to match connection - there is some force reg keys for regedit but no info about it…..

AntonK

Sorry, phase 1 passes, stuck at phase 2 without any detail info

zyman2008

Hi @AntonK ,

Using power shell command to change the phase 1 & phase 2 proposal.

1. Show phase 1 & phase 2 proposal of VPN connection

Get-VpnConnection -name "YourConnectionName" | Select-Object -ExpandProperty IPsecCustomPolicy

2. Set phase 1 & phase 2 proposal of VPN connection

Set-VpnConnectionIPsecConfiguration -ConnectionName "YourConnectionName" -EncryptionMethod <IKE  Encyption> -IntegrityCheckMethod <IKE Authentication> -DHGroup <DH Group> -CipherTransformConstants <ESP Encyprtion> -AuthenticationTransformConstants <ESP Authentication> -PfsGroup <PFS Group> -Force

Reference:

https://learn.microsoft.com/en-us/powershell/module/vpnclient/set-vpnconnectionipsecconfiguration?view=windowsserver2022-ps

AntonK

1. So i can choose in AuthenticationTransformConstants <ESP Authentication> : MD596, SHA196, SHA256128, GCMAE192,GCMAE256, None

and there in no such options in USG200

PeterUK

Windows default phase 2 is

encryption AES256

authentication SH1

PFS none

also L2TP over IPSec IKEv1 encapsulation is Transport

zyman2008

https://community.zyxel.com/en/discussion/comment/65179#Comment_65179

Here the string mapping between Windows and USG,

Windows: MD596 to USG: MD5

Windows: SHA196 to USG: SHA1

Windows: SHA256128 to USG: SHA256

mMontana

According to this release from Microsoft…

https://learn.microsoft.com/en-us/windows/release-health/status-windows-11-23h2#3291msgdesc

Is KB5036893 installed? Or Preview update of the end of april?

(Windows 10 is affected too, with the equivalent KB5036892)
https://learn.microsoft.com/en-us/windows/release-health/status-windows-10-22h2#3291msgdesc

AntonK

Thanks everyone for transport encapsulation and kb5036893, i've made changes and uninstall KB, and made some progress, - ZYXEL wrote that connection done, but windows think 1-2 minutes and breaks it with RasMan 809 Error

QuiteSmart

https://community.zyxel.com/en/discussion/comment/65186#Comment_65186

your post is gold!

QuiteSmart

Hello, i'm having a problem in phase 1 (logs on zywall say say proposal mismatch ) this in brief is my configuration on this IKEv2 vpn:

phase 1: encryption AES128, authentication SHA256, DH DH2

phase 2: encryption AES128, authentication SHA256, PFS None

THE cmdlet that i'm using in windows 10 is:

Set-VpnConnectionIPsecConfiguration -name "MyVPNName" -AuthenticationTransformConstants SHA256128 -CipherTransformConstants AES128 -DHGroup Group2 -EncryptionMethod AES128 -IntegrityCheckMethod SHA256 -PfsGroup None -force

do you see any error? I'm not sure about the import of the certificate, where do I have to import it?

PS this VPN works fine with Android (strongSwan) so I suppose that the problem is in the windows client configuration. I uninstalled the KB5036892 and rebooted but nothing changed.

ty

PeterUK

Yes you need to import the certificate are you using a self-signed certificate?

You can look at getting a DDNS and certificate as a self-signed certificate will be fixed to 1 IP and not domain name

will you be doing certificate mode or Enable Extended Authentication Protocol Server Mode user name and password?