GFI Forums: Kerio Control

Home » GFI User Forums » Kerio Control » IPsec Tunnel

Show: Today's Messages :: Show Polls :: Message Navigator
E-mail to friend

IPsec Tunnel [message #118864]

Mon, 26 January 2015 14:10

jaapzee
Messages: 2
Registered: January 2015

I'm trying to setup an IPsec tunnel to a third party (not using Kerio). I keep getting "None of the proposed crypto suites was acceptable."

Where can I configure the crypto suites?

Report message to a moderator

Re: IPsec Tunnel [message #118867 is a reply to message #118864]

Mon, 26 January 2015 17:49

Kerio/GFI Brian
Messages: 852
Registered: March 2004
Location: California

This KB article may help http://kb.kerio.com/1390

Brian Carmichael
Instructional Content Architect

Report message to a moderator

Re: IPsec Tunnel [message #118870 is a reply to message #118867]

Mon, 26 January 2015 18:15

jaapzee
Messages: 2
Registered: January 2015

I've read that article. This is the configuration I received from the third party:

Phase 1
crypto isakmp policy 10
encr aes
hash md5
authentication pre-share
group 2
lifetime 3600
!
crypto isakmp policy 20
encr aes 256
hash md5
authentication pre-share
group 2
lifetime 3600

Phase 2
esp-aes esp-md5-hmac

As far as I understand this should be supported, we're using preshared key (IKE ciphers displayed in the VPN Server Properties dialog are recommended. However, Kerio Control is able to work with ciphers described in this article). Or, am I wrong.

Report message to a moderator

Re: IPsec Tunnel [message #118931 is a reply to message #118870]

Wed, 28 January 2015 16:43

Kerio/GFI Brian
Messages: 852
Registered: March 2004
Location: California

I believe it should work, however it may require some investigation into the debug logs. I suggest to contact our technical support team.

Brian Carmichael
Instructional Content Architect

Report message to a moderator

Re: IPsec Tunnel [message #118944 is a reply to message #118864]

Thu, 29 January 2015 01:04

mlee (Kerio)
Messages: 211
Registered: October 2012
Location: Sydney

Check all checkboxes under IPsec in Debug log messages, retest the tunnel and post the result (Replace your private information if necessary), should be able to see more reasons with the issue.

M.

PTSD. BP. OCD. ASPD. BPD. Certified.

Report message to a moderator