We use Symantec Gateway Security 360R firewall appliances to protect the servers from malicious attacks, virus intrusions and to provide a way of establishing a secure connection for updates and investigating problems on the remote sites. Although the SGS 360R appliances are no longer sold by Symantec, they do have a limited amount of support.
For some reason, the Symantec Client VPN software stopped working on my main computer. I would attempt to launch the Client VPN and almost immediately would get an error.
“Error connecting tunnel . The server rejected the ISAKMP security association. Make sure that the Phase1 ID, shared key and IKE policy are correct. Terminating connect operation.”
ISAKMP (Internet Security Association and Key Management Protocol) is a protocol for establishing Security Associations (SA) and cryptographic keys in an Internet environment. Internet Key Exchange (IKE or IKEv2) is the protocol used to set up a security association (SA) in the IPsec protocol suite. IKE uses a Diffie-Hellman key exchange to set up a shared session secret, from which cryptographic keys are derived. Public key techniques or, alternatively, a pre-shared key, are used to mutually authenticate the communicating parties.
I tried reentering the Phase1 ID and the shared key and checked to ensure the IKE policy was correct. I checked the Symantec site for the error at Error: “Error connecting tunnel [appliance IP address]. The server rejected the ISAKMP security association . . .”. I uninstalled any software that was potentially blocking port 500. Port 500 is used by the Client VPN to make a connection. Nothing seemed to work.
I uninstalled the Client VPN software. I deleted any entries in the registry that Symantec may have left behind. I reinstalled the Client VPN software. Still it didn’t work. I deleted all of the IP connection addresses. I added them back in. Still it didn’t work. The same error kept popping up.
Finally in desperation, I asked Saint Anthony if he could help. Saint Anthony is the saint who helps to find things we’ve lost and, in this case, finds a solution to the problem. So before you knew it, the thought of deleting the user and password for the Client VPN came to me. This deleted not only the user, but all of the connections. I recreated the user and one by one added the IP connections. Sure enough, one by one they connected as they should. Problem solved after hours of frustration. Thanks Saint Anthony!!
