<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Paul,<br>
<br>
Disabling nat transversal made it work from all of the workstations
behind the server on the left but the server itself can't ping. Thanks
for the suggestion.<br>
<br>
Paul Wouters wrote:
<blockquote
cite="mid:alpine.LFD.1.10.1002161028020.5532@newtla.xelerance.com"
type="cite">
<pre wrap="">On Mon, 15 Feb 2010, Michael Leonetti wrote:
</pre>
<blockquote type="cite">
<pre wrap="">conn sonicwall
left=(leftip)
leftsubnet=10.1.1.0/24
leftid=(leftid)
right=(rightip)
rightsubnet=10.10.12.0/24
rightid=(rightid)
keyingtries=0
pfs=no
aggrmode=yes
auto=add
auth=esp
esp=3des-sha1
ike=3des-sha1
authby=secret
xauth=no
keyexchange=ike
</pre>
</blockquote>
<pre wrap=""><!---->
</pre>
<blockquote type="cite">
<pre wrap="">fortissimo linux # ipsec auto --up sonicwall
003 "sonicwall" #5: multiple transforms were set in aggressive mode. Only first one used.
003 "sonicwall" #5: transform (5,2,2,0) ignored.
</pre>
</blockquote>
<pre wrap=""><!---->
This log does not match the config above? It claims you have multiple ike= proposals,
instead of just one?
</pre>
<blockquote type="cite">
<pre wrap="">When I try to reach anything in the network:
fortissimo linux # ping 10.10.12.199
PING 10.10.12.199 (10.10.12.199) 56(84) bytes of data.
>From 130.81.12.202 icmp_seq=6 Destination Net Unreachable
</pre>
</blockquote>
<pre wrap=""><!---->
If this is on the server itself, you need to add a leftsourceip= or
use ping -I to ensure packets match your subnet (and not your public ip)
</pre>
<blockquote type="cite">
<pre wrap="">fortissimo linux # ping 10.10.12.1
PING 10.10.12.1 (10.10.12.1) 56(84) bytes of data.
64 bytes from 10.10.12.1: icmp_seq=1 ttl=243 time=21.1 ms
</pre>
</blockquote>
<pre wrap=""><!---->
If the remote server is doing NAT and IPsec, you need to exclude NATing
IPsec packets.
If the remote server is not the default gateway of 10.10.12.199, you might
need to add some routing to those machines.
Paul
</pre>
</blockquote>
</body>
</html>