| A_m_i_B_e |
Bonjour,
Depuis que j'ai mis à jour le firmware de notre firewall, je n'arrive plus à me connecter par VPN au réseau de l'entreprise.
La phase 1 se passe correctement, c'est à la phase 2 que ça coince.
Voici le log (côté du SonicWALL VPN Client) :
16:00:49.433 My Connections\GroupVPN 10.1.0.0 - Initiating IKE Phase 1 (IP ADDR=212.147.75.130)
16:00:49.483 My Connections\GroupVPN 10.1.0.0 - SENDING>>>> ISAKMP OAK AG (SA, KE, NON, ID, VID, VID, VID, VID)
16:00:50.134 My Connections\GroupVPN 10.1.0.0 - RECEIVED<<< ISAKMP OAK AG (SA, KE, VID, NAT-D, NAT-D, NON, ID, VID, VID, VID, HASH)
16:00:50.134 My Connections\GroupVPN 10.1.0.0 - Peer is NAT-T capable
16:00:50.164 My Connections\GroupVPN 10.1.0.0 - SENDING>>>> ISAKMP OAK AG *(HASH, NAT-D, NAT-D, NOTIFY:STATUS_INITIAL_CONTACT)
16:00:50.164 My Connections\GroupVPN 10.1.0.0 - Established IKE SA
16:00:50.164 MY COOKIE 32 f 27 2b 10 8f 32 d9
16:00:50.164 HIS COOKIE 9a d6 be 45 5 62 3b 7
16:00:50.164 My Connections\GroupVPN 10.1.0.0 - Initiating IKE Phase 2 with Client IDs (message id: 761B1413)
16:00:50.164 Initiator = IP ADDR=212.147.25.236, prot = 0 port = 0
16:00:50.164 Responder = IP SUBNET/MASK=10.1.0.0/255.255.0.0, prot = 0 port = 0
16:00:50.164 My Connections\GroupVPN 10.1.0.0 - SENDING>>>> ISAKMP OAK QM *(HASH, SA, NON, ID, ID)
16:00:50.435 My Connections\GroupVPN 10.1.0.0 - RECEIVED<<< ISAKMP OAK INFO *(HASH, NOTIFY:NO_PROPOSAL_CHOSEN)
16:00:50.435 My Connections\GroupVPN 10.1.0.0 - Discarding IPSec SA negotiation (message id: 761B1413)
et voici le log côté firewall :
04/14/2004 15:24:21.416 IKE Responder: Received Aggressive Mode request (Phase 1)
04/14/2004 15:24:22.064 NAT Discovery : No NAT/NAPT device detected between IPSec Security gateways 212.147.25.236 212.147.75.130
04/14/2004 15:24:22.064 IKE Responder: Aggressive Mode complete (Phase 1) 212.147.25.236 212.147.75.130 DES SHA1 Group 2 lifeSeconds=28800
04/14/2004 15:24:22.080 IKE Responder: Received Quick Mode Request (Phase 2) 212.147.25.236 212.147.75.130
04/14/2004 15:24:22.080 IKE Responder: Default LAN gateway is set but peer is not proposing to use this SA as a default route 212.147.25.236 212.147.75.130 10.1.0.0/16
04/14/2004 15:24:22.080 IKE Responder: IPSec proposal does not match (Phase 2) 212.147.25.236 212.147.75.130 212.147.25.236/32 -> 10.1.0.0/16
Si quelqu'un a une idée de ce qui est faux, je lui en serai très reconnaissant... |
