5.1

!
!
prompt hostname context
Cryptochecksum:29c3cc49460831ff6c070671098085a9
: end
Configuring a WatchGuard Firebox X500
You can configure your WatchGuard Firebox X500 as a remote gateway.
NOTE Refer to your WatchGuard Firebox documentation for exact steps.
Procedure
1 In Firebox System Manager, select Tools > Policy Manager > .
2 In Policy Manager, select Network > Configuration.
3 Configure the interfaces and click OK.
4 (Optional) Select Network > Routes to configure a default route.
5 Select Network > Branch Office VPN > Manual IPSec to configure the remote gateway.
6 In the IPSec Configuration dialog box, click Gateways to configure the IPSEC Remote Gateway.
7 In the IPSec Configuration dialog box, click Tunnels to configure a tunnel.
8 In the IPSec Configuration dialog box, click Add to add a routing policy.
9 Click Close.
10 Confirm that the tunnel is up.
Troubleshooting vShield Edge Configuration Example
Use this information to help you troubleshoot negotiation problems with your setup.
Successful Negotiation (both Phase 1 and Phase 2)
The following examples display a successful negotiating result between vShield Edge and a Cisco device.
vShield Edge
From the vShield Edge command line interface (ipsec auto -status, part of show service ipsec command):
000 #2: "s1-c1":500 STATE_QUICK_I2 (sent QI2, IPsec SA established);
EVENT_SA_REPLACE in 2430s; newest IPSEC; eroute owner; isakmp#1; idle;
import:admin initiate
000 #2: "s1-c1" esp.f5f6877d@10.20.131.62 esp.7aaf335f@10.20.129.80
tun.0@10.20.131.62 tun.0@10.20.129.80 ref=0 refhim=4294901761
000 #1: "s1-c1":500 STATE_MAIN_I4 (ISAKMP SA established); EVENT_SA_REPLACE in
27623s; newest ISAKMP; lastdpd=0s(seq in:0 out:0); idle;
import:admin initiate
Cisco
ciscoasa# show crypto isakmp sa detail
Active SA: 1
Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
Total IKE SA: 1
Chapter 9 vShield Edge Management
VMware, Inc. 93