topic Re: sa 3110 ipsec sample doc in Appliance Servers

sa 3110 ipsec sample doc

J. Mc Clymont — Mon, 10 Mar 2003 13:41:42 GMT

hello,

we try to get an ipsec connection to the sa3110 v7.01 BUT nothing worked.

does anybody knows an detailed sample document which explain the ipsec configuration.

we want to use an one armed router.

we have no problem to dial a 0190 number to get help.

greetings from germany

Re: sa 3110 ipsec sample doc

BR699722 — Mon, 10 Mar 2003 14:21:53 GMT

Hi,

With the HP3110 comes a CD. On this CD there are detailed Informations about several configurations.
The second source is HP webSite or the HP Support Center at Ratingen.
The third source is the Intel Website, because the HP3xx0 Appliances were original build by Intel. Look at:
www.intel.com/support/netstructure/vpn/client/index.htm

As we set up IPSEC-Tunnels last year, we??ve got some problems with the firmware. Try 7.0 ore 6.9.
Another problem is the client.
With 2000/xp you have to disable the IPSEC-policy agent (Richtlinien-Agent) ( (control--> services) from Microsoft.

Hope that helps

Re: sa 3110 ipsec sample doc

J. Mc Clymont — Mon, 10 Mar 2003 16:04:33 GMT

hi,

in the meantime i found docs on the intel site. BUT, i get a connection and my w2k gives me a ckient ip address which i have defined noplace. this ip looks close to my real address. one of the official addresses are 195.212.87.xxx and the client ip are defined to 195.212.78.253. i have NOT defined the 78 or the 87 net in the config. when i show tunnel in the manager i got the right addresses i gave in the config and debug all or show route on the sa3110 looks also very well. NOWHERE stands the mysterios 78 ip. under w2k in the ipconfig the 78 also defined. whats going on there?

when the sa in original is the intel netstructure, can i use the firmware by intel? the patchlevel is higher than by the sa?

thanks for help

Re: sa 3110 ipsec sample doc

BR699722 — Tue, 11 Mar 2003 07:49:28 GMT

hi,

to your second question. I haven??t tested the firmware from Intel, so i wouldn??t use it, although it could work with the HP3110. With the HP Firmware 7.0 (not 7.01)it works fine.

For the first question, there are several possibilties for the "mysterious IP". But without background about your configuration, its difficult to specify it.
In our configuration the IP-Assignment uses a special defined IP-Range from the internal net.
We??ve defined this Range in the configuration manager in "Tunnels--> Remote Group --> IPSEC"
then "New Client IP"

The SA then works as an DHCP Server for the incoming VPN-Clients.

Maybe that helps