Can't start IPSEC On 2.4

[Guest]

[danodemano]

All,

I just installed 2.4 after the upgrade from 2.3 hosed up my system.  I decided that rather than restore the backup I would just configure it from scratch.  I got I think most everything set up but I cannot get the IPSEC to work properly.  I have the tunnel set up but I cannot enable it.  If I check the box, then click the button that I assume is the submit button (it actually says "This field may be left blank") the checkbox just disappears and it never enabled IPSEC, it still shows up as disabled on the status screen.  How can I get this working?  Here is a picture showing the VPN screen:


http://i60.photobucket.com//h33/danodemano/ipsec.png
(Make sure you remove the double //'s)

Thanks for your help!!!

[danodemano]

Well....I fudged it and got it to work, sort of.  I copied the "settings" file I had from my backup of 2.3 and uploaded it to /var/efw/vpn then rebooted.  IPSEC now starts and the tunnel comes up but I am not able to get through it.  From the remote site I can ping the LAN IP address of the Endian box itself but cannot ping anything else within the network.  Thoughts?

Thanks!

[danodemano]

So I spoke too soon.  Yes, it does in fact bring up the VPN, but now all traffic in the LAN ceases to connect to the internet.  The Endian box itself is connected but nothing else is.  I turned the VPN back off for now (by renaming that file) but would really like to get the VPN working and still have internet connectivity in my LAN.  Thoughts or suggestions?

Thanks!

[andym]

All you have to do in this case is to do an upgrade. There are some problems with the .ISO. Just go to the command line and type efw-upgrade. You also have be registered with endian because they ask for the user during this process. The username is your email address that you provided during registration.

You cannot enable IPSec VPN because there is no Save button present

Enjoy

[thanit]

Please try this from Christian.

public.endian.com/christian/EFW-COMMUNITY-2.4-201005280528.iso

Thanit

[danodemano]

Thanks, IPSEC is working now after I did an efw-upgrade.

However....it still seems like it kills the green connection whenever I turn it on.  The IPSEC connects, yes, but then none of the machine in my LAN can ping the green interface, let along get to the internet.  Is this another bug with the IPSEC?

[andym]

My problem is that i cannot ping or browse the remote green interface. I'm behind endian1 and the remote is behind endian2. I have a IPSec VPN between them that is working but the can't browse the remote green interface. I've put a rule in my outgoing firewall to allow SMB data packets. I also turned off IDS but still can't get in the remote network.

Behind endian1 i have an office and behind endian2 i have the file server. The office cannot get access to the server even if IPSec is working. I tried every rule possible. Please help.

Thanks

[danodemano]

That was also an issue.  From the remote end I cannot access the machine behind the Endian box on the green interface.  But likewise, these machines cannot access the internet at all.  The tunnel shows as up and from the remote end I can ping the local endian green interface but cannot ping anything.

[danodemano]

Let me try to explain this better....here is the setup:
|192. LAN|<==>|Endian|<==>|DSL Modem Bridged|<==>|Internet|<==>|Cisco 3640|<==>|Sonicwall|<==>|10. LAN|

With VPN disabled machines in the 192 and 10 LAN's cannot talk (obviously).  Both sides can access the internet without a problem.  When I enable the VPN, now the 10. side can talk to Endian's green interface and the tunnel shows as up on both sides.  All the machines in the 192 LAN though loose internet connectivity and can no longer ping the green interface of Endian (they also cannot talk to machines in the 10 network).  Also, machines in the 10 network cannot ping any machine (other than Endian) in the 192 LAN.  It seems like enabling the IPSEC in Endian breaks the green interface?  This was working perfectly with 2.3. 

[danodemano]

Ok, not enabling the IPSEC, actually having a tunnel defined.  I deleted the tunnel that I had then enabled IPSEC and I'm still able to ping the green interface and have internet access.  I'm going to try to define my VPN tunnel again and see if maybe I made a mistake with it....

[danodemano]

Filed as a bug: http://bugs.endian.com/bug_view_advanced_page.php?bug_id=2947

Creating a tunnel with IPSEC already enabled *ALSO* breaks the green interface.

[andym]

Both my sides can access the internet. Can't access the green interface but i can access the internet from both sides.