NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
sndk4asp
Apr 11, 2016Aspirant
FVS318Gv1 connected to a FVS318Gv2
Hello. I have a question about the two models in the subject.
My network was so composed:
Net A) One FVS318G directly connected to Internet with static IP. Local lan IP 192.127.0.0/24 It was used for VPN and also as a gateway/firewall for the office computers;
Net B) One FVS318G behind an ADSL natted router by Draytek (IKE port 500 forwarded to the FVS318 from the router ): local lan ip 192.127.1.0/24.
All went fine for nearly 3 years but few days ago the first firewall (which one on Net A) has died so I have replaced it with a new FVS318Gv2. I was unable to restore the configuration from a previous backup for incompatibilty between the two versions. So I recreated the VPN with the same parameters but I was unable to make them connect. I have tried many things such as:
- Using wizard on both devices;
- Creating VPN and IKE policies manually;
- I have upgraded both devices at the last available firmware (4.3.3-6 on v2 and 3.1.1-18 on v1)
None of that have sorted an effect and the log is always the same, for instance:
Mon Apr 11 16:37:57 2016 (GMT +0200): [FVS318Gv2] [IKE] NOTIFY: The packet is retransmitted by 88.14x.xxx.xxx[500].
Mon Apr 11 16:37:47 2016 (GMT +0200): [FVS318Gv2] [IKE] NOTIFY: The packet is retransmitted by 88.14x.xxx.xxx[500].
Mon Apr 11 16:37:37 2016 (GMT +0200): [FVS318Gv2] [IKE] INFO: for debugging :: changing portsMon Apr 11 16:37:37 2016 (GMT +0200): [FVS318Gv2] [IKE] INFO: port changed !!
Mon Apr 11 16:37:37 2016 (GMT +0200): [FVS318Gv2] [IKE] INFO: NAT detected: PEER
Mon Apr 11 16:37:37 2016 (GMT +0200): [FVS318Gv2] [IKE] INFO: NAT-D payload does not match for 88.14x.xxx.xxx[500]
Mon Apr 11 16:37:37 2016 (GMT +0200): [FVS318Gv2] [IKE] INFO: NAT-D payload matches for 93.14x.xxx.xxx[500]
Mon Apr 11 16:37:37 2016 (GMT +0200): [FVS318Gv2] [IKE] INFO: Received Vendor ID: KAME/racoon
Mon Apr 11 16:37:37 2016 (GMT +0200): [FVS318Gv2] [IKE] INFO: For 88.14x.xxx.xxx[500], Selected NAT-T version: RFC XXXX
Mon Apr 11 16:37:37 2016 (GMT +0200): [FVS318Gv2] [IKE] INFO: Received Vendor ID: KAME/racoon
Mon Apr 11 16:37:37 2016 (GMT +0200): [FVS318Gv2] [IKE] INFO: Received Vendor ID: DPD
Mon Apr 11 16:37:37 2016 (GMT +0200): [FVS318Gv2] [IKE] INFO: Received Vendor ID: RFC XXXX
Mon Apr 11 16:37:36 2016 (GMT +0200): [FVS318Gv2] [IKE] INFO: [isakmp_ident.c:190]: XXX: setting vendorid: 9
Mon Apr 11 16:37:36 2016 (GMT +0200): [FVS318Gv2] [IKE] INFO: [isakmp_ident.c:190]: XXX: setting vendorid: 8
Mon Apr 11 16:37:36 2016 (GMT +0200): [FVS318Gv2] [IKE] INFO: [isakmp_ident.c:190]: XXX: setting vendorid: 4
Mon Apr 11 16:37:36 2016 (GMT +0200): [FVS318Gv2] [IKE] INFO: [isakmp_ident.c:186]: XXX: NUMNATTVENDORIDS: 3
Mon Apr 11 16:37:36 2016 (GMT +0200): [FVS318Gv2] [IKE] INFO: Beginning Identity Protection mode.
Mon Apr 11 16:37:36 2016 (GMT +0200): [FVS318Gv2] [IKE] INFO: Initiating new phase 1 negotiation: 93.14x.xxx.xxx[500]<=>88.14x.xxx.xxx[500]
Mon Apr 11 16:37:36 2016 (GMT +0200): [FVS318Gv2] [IKE] INFO: Configuration found for 88.14x.xxx.xxx.
Mon Apr 11 16:37:36 2016 (GMT +0200): [FVS318Gv2] [IKE] INFO: Configuration found for 88.14x.xxx.xxx.
I have also tried to set, on IKE policy, the Manual Policy Parameters and in that case the connection goes up and appear to be stable but no packets are apparently routed through the tunnel, and there is no way to connect to PCs on other side.
I have exhausted my options. Have you any suggestions?? :'(
What are you using for the ike and vpn profiles in terms of md5/des, etc? Set each one to the lower possible setting on both routers and see what happens. Disable all dpd on both sides for now. Let's see if we can get the tunnel up and then increase security until it breaks again.
7 Replies
- SamirDProdigy
Try using aggressive vs main mode on both ends. I've had problems like this resolved on various brands by changing this setting.
- sndk4aspAspirant
Thanks SamirD, I have applied your suggestion and now the logs (taken from the v2) shows this:
Wed Apr 13 16:26:34 2016 (GMT +0200): [FVS318Gv2] [IKE] ERROR: invalid ID payload.
Wed Apr 13 16:26:34 2016 (GMT +0200): [FVS318Gv2] [IKE] WARNING: ID value mismatched.
Wed Apr 13 16:26:34 2016 (GMT +0200): [FVS318Gv2] [IKE] INFO: Received Vendor ID: DPD
Wed Apr 13 16:26:34 2016 (GMT +0200): [FVS318Gv2] [IKE] INFO: Received Vendor ID: draft-ietf-ipsec-nat-t-ike-02
Wed Apr 13 16:26:34 2016 (GMT +0200): [FVS318Gv2] [IKE] INFO: Received Vendor ID: KAME/racoon
Wed Apr 13 16:26:32 2016 (GMT +0200): [FVS318Gv2] [IKE] ERROR: invalid ID payload.
Wed Apr 13 16:26:32 2016 (GMT +0200): [FVS318Gv2] [IKE] WARNING: ID value mismatched.
Wed Apr 13 16:26:32 2016 (GMT +0200): [FVS318Gv2] [IKE] INFO: Received Vendor ID: DPD
Wed Apr 13 16:26:32 2016 (GMT +0200): [FVS318Gv2] [IKE] INFO: Received Vendor ID: draft-ietf-ipsec-nat-t-ike-02
Wed Apr 13 16:26:32 2016 (GMT +0200): [FVS318Gv2] [IKE] INFO: Received Vendor ID: KAME/racoon
Wed Apr 13 16:26:25 2016 (GMT +0200): [FVS318Gv2] [IKE] ERROR: invalid ID payload.
Wed Apr 13 16:26:25 2016 (GMT +0200): [FVS318Gv2] [IKE] WARNING: ID value mismatched.
Wed Apr 13 16:26:24 2016 (GMT +0200): [FVS318Gv2] [IKE] INFO: Received Vendor ID: DPD
Wed Apr 13 16:26:24 2016 (GMT +0200): [FVS318Gv2] [IKE] INFO: Received Vendor ID: draft-ietf-ipsec-nat-t-ike-02
Wed Apr 13 16:26:24 2016 (GMT +0200): [FVS318Gv2] [IKE] INFO: Received Vendor ID: KAME/racoon
Wed Apr 13 16:26:22 2016 (GMT +0200): [FVS318Gv2] [IKE] ERROR: invalid ID payload.
Wed Apr 13 16:26:22 2016 (GMT +0200): [FVS318Gv2] [IKE] WARNING: ID value mismatched.
Wed Apr 13 16:26:22 2016 (GMT +0200): [FVS318Gv2] [IKE] INFO: Received Vendor ID: DPD
Wed Apr 13 16:26:22 2016 (GMT +0200): [FVS318Gv2] [IKE] INFO: Received Vendor ID: draft-ietf-ipsec-nat-t-ike-02
Wed Apr 13 16:26:22 2016 (GMT +0200): [FVS318Gv2] [IKE] INFO: Received Vendor ID: KAME/racoon
Wed Apr 13 16:26:21 2016 (GMT +0200): [FVS318Gv2] [IKE] INFO: Configuration found for 88.14x.xxx.xxx.
Wed Apr 13 16:26:21 2016 (GMT +0200): [FVS318Gv2] [IKE] INFO: Configuration found for 88.14x.xxx.xxx.
Wed Apr 13 16:26:21 2016 (GMT +0200): [FVS318Gv2] [IKE] INFO: Using IPsec SA configuration: 192.127.0.0/24<->192.127.1.0/24- SamirDProdigy
Play with the Dead Peer Detection on both devices. Try it in all combinations--both on, both off, local on remote off, local off remote on.
Related Content
NETGEAR Academy

Boost your skills with the Netgear Academy - Get trained, certified and stay ahead with the latest Netgear technology!
Join Us!