Hello community,
I have a bunch a of SSG-140 firewalls with ScreenOS 6.2.0r1.0 that I use as VPN concentrators for my clients.
My clients are what we can call "road warriors", so I have configured the firewalls with IKE (in order to use preshared keys, IKE users with U-FQDN) and XAUTH (to allow the use of a RADIUS server for authentication).
Each client has a dedicated IP Pool.
My problem is that when more than a client tries to connect at the same time to it's VPN, the same IP (the first of the ip pool) is sent back to the clients and they ultimatly get disconnected or cannot use the VPN anymore.
Here is a sample of a standard configuration on my firewalls :
set ippool "mezzo" 192.168.252.1 192.168.252.254
set user "mezzo_vpn" uid 6
set user "mezzo_vpn" ike-id u-fqdn "<removed>" share-limit 1
set user "mezzo_vpn" type ike
set user "mezzo_vpn" "enable"
set user-group "mezzo" id 8
set user-group "mezzo" location external
set user-group "mezzo" type xauth
set user-group "mezzo_IKE" id 6
set user-group "mezzo_IKE" user "mezzo_vpn"
#set ike gateway "mezzo_p1" dialup "mezzo_IKE" Aggr outgoing-interface "ethernet0/2" preshare <removed> proposal "pre-g2-des-sha" "pre-g2-3des-sha"
unset ike gateway "mezzo_p1" nat-traversal udp-checksum
set ike gateway "mezzo_p1" nat-traversal keepalive-frequency 5
set ike gateway "mezzo_p1" xauth server "radius-vpn" query-config user-group "mezzo"
set ike gateway "mezzo_p1" xauth accounting server "radius-vpn"
unset ike gateway "mezzo_p1" xauth do-edipi-auth
set vpn "mezzo_p2" gateway "mezzo_p1" no-replay tunnel idletime 0 proposal "nopfs-esp-des-md5" "nopfs-esp-3des-sha" "nopfs-esp-aes128-sha"
set vpn "mezzo_p2" monitor
set vpn "mezzo_p2" id 0x13 bind interface tunnel.8
set vpn "mezzo_p2" dscp-mark 0
set vpn "mezzo_p2" proxy-id local-ip 0.0.0.0/0 remote-ip 255.255.255.255/32 "ANY"
I have looked everywhere in the configuration trying to find where I should specify the IP POOL to use but nothing. I think that I need to set my user type to IKE + something in order to specify the client's IP POOL but I am sure not which one to choose.
Any clues ?
Thank you for your help.
Regards.
Message Edited by bengelly on 04-08-2009 02:19 AM
