IKEv2 Connection Not Working to RRAS

Options
13»

All Replies

  • NEP
    NEP Posts: 116 image  Ally Member
    First Comment Friend Collector Third Anniversary
    edited March 5

    As mentioned in the prior post, I selected the NAT rule and Inactivated (ie. disabled) it.

    As for clearing all sessions, the Help docs says, "Administrators can use these buttons to forcibly terminate selected TCP/UDP connections. Select one or multiple connections and then click Clear; click Clear All to terminate all connections displayed. Cleared sessions display on the Log > View Log screen."

    Is that your idea of a scream test? That doesn't sound like something I should do in the middle of the day ;-)

    What was your objective with that suggestion?

  • PeterUK
    PeterUK Posts: 4,426 image  Guru Member
    250 Answers 2500 Comments Friend Collector Eighth Anniversary

    There have been times that I had to do this and because you had the NAT rule even now its disabled the session handling does not reset itself for connections to Zywall.

    Also now that I understand more if you only have one WAN IP then you can't have VPN IKE, ESP, NATT either go to the Zywall or server after the ATP. Normally you need two WAN IP to do this there are ways to get around this but may not be idea for you to do the simplest is another WAN IP.

  • NEP
    NEP Posts: 116 image  Ally Member
    First Comment Friend Collector Third Anniversary

    I just tried what you said about clearing the sessions and it did not help. FYI, the "Clear All" button was dimmed, so I switched to "sessions by user" and cleared those. I was immediately disconnected and when I reconnected saw that the others were, as well as the - entry (it was a large number prior, so I assume that means everything else).

    Not sure where you got the idea that we only have one WAN IP. If I stated that somewhere I made a mistake. As the original post states, I configured a "separate Public IP to the RRAS server". The IPSec VPN that is not working now is a completely different Public IP.

  • Zyxel_Melen
    Zyxel_Melen Posts: 4,616 image  Zyxel Employee
    Zyxel Certified Network Engineer Level 1 - Switch Zyxel Certified Network Administrator - Switch Zyxel Certified Network Administrator - Nebula Zyxel Certified Sales Associate

    Hi @NEP

    Since I'm not familier with RRAS, it took sometimes to build it, but I still get some troubles.

    To better check this issue, I will send you a private message to get your firewall's configuration, RRAS's configuration, and related AD auth settings. Thanks.

    Zyxel Melen


  • NEP
    NEP Posts: 116 image  Ally Member
    First Comment Friend Collector Third Anniversary

    @Zyxel_Melen Thank you for setting up a test server. I have replied to your DM with relevant details.

  • NEP
    NEP Posts: 116 image  Ally Member
    First Comment Friend Collector Third Anniversary

    Been working on this for a bit now and have a Windows laptop working internally on our guest Wi-Fi network. The connection is near instantaneous. That to me means everything with RRAS and NPS is configured correctly.

    So, I tried to get it working from outside the organization again, but it continues to fail. Same as before. I don't have any new information, but with all the changes to get the other working I wanted to check the path. Added port 25 to the group with 500/4500 and found that the path is still open. I cannot check 500/4500 because it is UDP. However, the other traffic is passed to the RRAS server so that should be indicative of it being good.

    It still seems like the firewall is messing with the 500/4500 connection (probably due to the other VPN), though I cannot prove that.

Categories

Security Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）