Advertisement

09.11.2008 at 01:16PM PDT, ID: 23724487
[x]
Attachment Details

WATCHGUARD BOVPN X750e TO X550e

[x]
The Solution Rating System

With so many solutions, how can you tell which solutions are most likely to help you and which ones are not? To provide you with a tool to use, we rate our solutions based on various elements that most accurately determine if a solution is a quality solution. To explain what factors affect the solution rating, here are the elements we take into consideration when formulating our solution rating.

  • The Grade of the Solution
  • The Zone Rank of the Expert Providing the Solution
  • The Number of Author and Expert Comments
  • The Number of Experts Contributing
  • The Feedback of the Community

Your Input Matters
Because of the way the system is set up, the most important variable in this equation is you. As a member of Experts Exchange, you are able to cast your vote on the quality of the solutions in regard to how complete, accurate, helpful and easy to understand each solution is. When you provide your feedback, each rating is adjusted accordingly. So, if you see a solution that has a poor rating that you think is a good solution, let us know by rating it. As you do, the rating will be adjusted and will become more accurate for other members of our site.

If you have any suggestions that you would like to make for our rating system, please ask a question in the Suggestions Zone of Community Support.

Thank you!
8.0
Zones:

Watchguard Firewall, Virtual Private Networking (VPN), Network Software Firewalls

Tags:

WATCHGUARD, WSM 10.2.2, WATCHGUARD, X750E AND X550E
HELLO

I'm new to these devices and I've spent MORE THAN a few hours trying to setup a "back to back" vpn connection with these two watchguard devices and would really appreciate some help.

Traffic logs seem to show phase one completed, and then various (depending on settings) errors in phase 2 causing phase one to recycle, never establishing real working vpn.  I do see PHASE ONE COMPLETE MESSAGES

I have recently changed MTU settings to eliminate packet fragmentation issue

System manager always says 0 tunnels active - Which seems to explain why i cannot ping through tunnel from either side.

Really would just like someone that knows these things to have a look at my general config (below) and advise if I'm generally doing this right

I was not able to get the Watchguard Server products to install on my Vista Enterprise 64 workstation so am just trying to to MANUAL VPN config.

ENVIRONMENT:
RUNNING WSM 10.2.2
LOCAL OFFICE NAME CITY1
LOCAL OFFICE DEVICE IS 550
LOCAL OFFICE OUTSIDE IP 1.1.1.1
LOCAL OFFICE INSIDE IP 192.168.1.0/24

REMOTE OFFICE NAME IS CITY2
REMOTE OFFICE DEVICE IS 750 (yep, that's odd!)
REMOTE OFFICE OUTSIDE IP 2.2.2.2
REMOTE OFFICE INSIDE IP 192.168.200.0/24

AS I UNDERSTAND IT THE GENERAL CONFIG OF *GATEWAY* SHOULD BE:
LOCAL OFFICE (550) CONFIG:
GATEWAY NAME IS: CITY1
USING (WELL KNOWN) PSK - NO CERTS
ENDPOINTS: LOCAL GATEWAY:: TYPE=IP. ID= 1.1.1.1, IF=EXTERNAL"
ENDPOINTS: REMOTE GATEWAY:: ID= 2.2.2.2, TYPE=IP. ID= 2.2.2.2
PHASE ONE: MAIN MODE, NAT TRAVERSAL ENABLED, TRANSFORMS SHA1-3DES (THIS IS ALL DEFAULT)

REMOTE OFFICE (750) CONFIG:
GATEWAY NAME IS: CITY2
USING (WELL KNOWN) PSK - NO CERTS
ENDPOINTS: LOCAL GATEWAY:: TYPE=IP. ID= 2.2.2.2, IF=EXTERNAL"
ENDPOINTS: REMOTE GATEWAY:: ID= 1.1.1.1, TYPE=IP. ID= 1.1.1.1
PHASE ONE: MAIN MODE, NAT TRAVERSAL ENABLED, TRANSFORMS SHA1-3DES (THIS IS ALL DEFAULT)

AS I UNDERSTAND IT THE GENERAL CONFIG OF *TUNNEL* SHOULD BE:
ON 550
TUNNEL NAME P2P
GATEWAY: CITY1
LOCAL=192.168.1.0/24 DIR <====> REMOTE=192.168.200.0/24
PHASE 2 LEFT ALL DEFAULT: ESP-AES-SHA1

ON 750
TUNNEL NAME P2P
GATEWAY: CITY2
LOCAL=192.168.200.0/24 DIR <====> REMOTE=192.168.1.0/24
PHASE 2 LEFT ALL DEFAULT: ESP-AES-SHA1

THE 10.2.2 version of WSM sets up in/out policies on it's own - review of those policies looks correct and the doc says that they will allow all stations on either side to use the tunnel.
Start your 7 day free trial to see this answer
Answered By: ericjmail
Expert Since: 10/24/2003
Accepted Solutions: 1
ericjmail has been an Expert for 5 years 2 months, during which he has posted 2 comments and answered 1 question. ericjmail is just one of 256 experts in the Watchguard Firewall Zone. 1 expert collaborated on this answer, which was graded an "A" by the asker.
 
 
20081119-EE-VQP-48 / EE_QW_2_20070628