форумы  помощь  поиск  регистрация  майллист  вход/выход  слежка

Вариант для распечатки		Пред. тема | След. тема
Форум Маршрутизаторы CISCO и др. оборудование. (VPN, VLAN, туннель)
Изначальное сообщение		[ Отслеживать ]

"IPSEC+GRE"	+/–
Сообщение от McS555 (ok) on 04-Янв-13, 18:38
Добрый вечер. Подскажите, почему не работает gre+ipsec между двумя роутерами?? Причем, по точно такой же схеме с другими маршрутизаторами (да и между собой, только поверх другой сети) все чудесно работает Роутер №1 --------------------------- ! crypto isakmp policy 10 encr 3des hash md5 authentication pre-share group 2 ! crypto isakmp policy 101 encr aes authentication pre-share group 5 crypto isakmp key 1234 address 53.15.120.134 crypto isakmp keepalive 30 10 ! ! crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac mode transport crypto ipsec fragmentation after-encryption crypto ipsec df-bit clear ! crypto ipsec profile PROFILE set transform-set ESP-3DES-MD5 ! ! interface Tunnel1 bandwidth 10000 ip address 10.0.22.5 255.255.255.252 ip mtu 1400 ip flow ingress ip tcp adjust-mss 1360 load-interval 30 tunnel source 53.15.120.138 tunnel destination 53.15.120.134 tunnel protection ipsec profile PROFILE ! Роутер №2 --------------------------- ! crypto isakmp policy 10 encr 3des hash md5 authentication pre-share group 2 crypto isakmp key 1234 address 53.15.120.138 crypto isakmp keepalive 30 10 ! crypto ipsec security-association lifetime seconds 86400 ! crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac mode transport crypto ipsec fragmentation after-encryption crypto ipsec df-bit clear ! crypto ipsec profile PROFILE set transform-set ESP-3DES-MD5 ! ! interface Tunnel1 bandwidth 10000 ip address 10.0.22.6 255.255.255.252 ip mtu 1400 ip flow ingress ip tcp adjust-mss 1360 tunnel source 53.15.120.134 tunnel destination 53.15.120.138 tunnel protection ipsec profile PROFILE ! -------------------------------------------- sh cry is sa IPv4 Crypto ISAKMP SA dst             src             state          conn-id status 53.15.120.138   53.15.120.134   MM_NO_STATE       1361 ACTIVE (deleted) Дебаг Cryptographic Subsystem:   Crypto ISAKMP debugging is on   Crypto ISAKMP Error debugging is on   Crypto ISAKMP High Availability debugging is on   Crypto IPSEC debugging is on   Crypto IPSEC Error debugging is on   Crypto IPSEC High Availability debugging is on Jan  5 01:30:21.916: ISAKMP (0): received packet from 53.15.120.134 dport 500 sport 500 Global (N) NEW SA Jan  5 01:30:21.916: ISAKMP: Found a peer struct for 53.15.120.134, peer port 500 Jan  5 01:30:21.916: ISAKMP: Locking peer struct 0x305438BC, refcount 2 for crypto_isakmp_process_block Jan  5 01:30:21.916: ISAKMP: local port 500, remote port 500 Jan  5 01:30:21.916: ISAKMP:(0):insert sa successfully sa = 312417AC Jan  5 01:30:21.916: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH Jan  5 01:30:21.916: ISAKMP:(0):Old State = IKE_READY  New State = IKE_R_MM1 Jan  5 01:30:21.916: ISAKMP:(0): processing SA payload. message ID = 0 Jan  5 01:30:21.916: ISAKMP:(0): processing vendor id payload Jan  5 01:30:21.916: ISAKMP:(0): vendor ID seems Unity/DPD but major 69 mismatch Jan  5 01:30:21.916: ISAKMP (0): vendor ID is NAT-T RFC 3947 Jan  5 01:30:21.916: ISAKMP:(0): processing vendor id payload Jan  5 01:30:21.916: ISAKMP:(0): vendor ID seems Unity/DPD but major 245 mismatch Jan  5 01:30:21.916: ISAKMP (0): vendor ID is NAT-T v7 Jan  5 01:30:21.916: ISAKMP:(0): processing vendor id payload Jan  5 01:30:21.916: ISAKMP:(0): vendor ID seems Unity/DPD but major 157 mismatch Jan  5 01:30:21.916: ISAKMP:(0): vendor ID is NAT-T v3 Jan  5 01:30:21.916: ISAKMP:(0): processing vendor id payload Jan  5 01:30:21.916: ISAKMP:(0): vendor ID seems Unity/DPD but major 123 mismatch Jan  5 01:30:21.916: ISAKMP:(0): vendor ID is NAT-T v2 Jan  5 01:30:21.916: ISAKMP:(0):found peer pre-shared key matching 53.15.120.134 Jan  5 01:30:21.916: ISAKMP:(0): local preshared key found Jan  5 01:30:21.920: ISAKMP:(0): Authentication by xauth preshared Jan  5 01:30:21.920: ISAKMP:(0):Checking ISAKMP transform 1 against priority 10 policy Jan  5 01:30:21.920: ISAKMP:      encryption 3DES-CBC Jan  5 01:30:21.920: ISAKMP:      hash MD5 Jan  5 01:30:21.920: ISAKMP:      default group 2 Jan  5 01:30:21.920: ISAKMP:      auth pre-share Jan  5 01:30:21.920: ISAKMP:      life type in seconds Jan  5 01:30:21.920: ISAKMP:      life duration (VPI) of  0x0 0x1 0x51 0x80 Jan  5 01:30:21.920: ISAKMP:(0):atts are acceptable. Next payload is 0 Jan  5 01:30:21.920: ISAKMP:(0):Acceptable atts:actual life: 0 Jan  5 01:30:21.920: ISAKMP:(0):Acceptable atts:life: 0 Jan  5 01:30:21.920: ISAKMP:(0):Fill atts in sa vpi_length:4 Jan  5 01:30:21.920: ISAKMP:(0):Fill atts in sa life_in_seconds:86400 Jan  5 01:30:21.920: ISAKMP:(0):Returning Actual lifetime: 86400 Jan  5 01:30:21.920: ISAKMP:(0)::Started lifetime timer: 86400. Jan  5 01:30:21.920: ISAKMP:(0): processing vendor id payload Jan  5 01:30:21.920: ISAKMP:(0): vendor ID seems Unity/DPD but major 69 mismatch Jan  5 01:30:21.920: ISAKMP (0): vendor ID is NAT-T RFC 3947 Jan  5 01:30:21.920: ISAKMP:(0): processing vendor id payload Jan  5 01:30:21.920: ISAKMP:(0): vendor ID seems Unity/DPD but major 245 mismatch Jan  5 01:30:21.920: ISAKMP (0): vendor ID is NAT-T v7 Jan  5 01:30:21.920: ISAKMP:(0): processing vendor id payload Jan  5 01:30:21.920: ISAKMP:(0): vendor ID seems Unity/DPD but major 157 mismatch Jan  5 01:30:21.920: ISAKMP:(0): vendor ID is NAT-T v3 Jan  5 01:30:21.920: ISAKMP:(0): processing vendor id payload Jan  5 01:30:21.920: ISAKMP:(0): vendor ID seems Unity/DPD but major 123 mismatch Jan  5 01:30:21.920: ISAKMP:(0): vendor ID is NAT-T v2 Jan  5 01:30:21.920: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE Jan  5 01:30:21.920: ISAKMP:(0):Old State = IKE_R_MM1  New State = IKE_R_MM1 Jan  5 01:30:21.920: ISAKMP:(0): constructed NAT-T vendor-rfc3947 ID Jan  5 01:30:21.920: ISAKMP:(0): sending packet to 53.15.120.134 my_port 500 peer_port 500 (R) MM_SA_SETUP Jan  5 01:30:21.920: ISAKMP:(0):Sending an IKE IPv4 Packet. Jan  5 01:30:21.920: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE Jan  5 01:30:21.920: ISAKMP:(0):Old State = IKE_R_MM1  New State = IKE_R_MM2 Jan  5 01:30:21.944: ISAKMP (0): received packet from 53.15.120.134 dport 500 sport 500 Global (R) MM_SA_SETUP Jan  5 01:30:21.944: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH Jan  5 01:30:21.944: ISAKMP:(0):Old State = IKE_R_MM2  New State = IKE_R_MM3 Jan  5 01:30:21.944: ISAKMP:(0): processing KE payload. message ID = 0 Jan  5 01:30:21.972: ISAKMP:(0): processing NONCE payload. message ID = 0 Jan  5 01:30:21.972: ISAKMP:(0):found peer pre-shared key matching 53.15.120.134 Jan  5 01:30:21.972: ISAKMP:(1359): processing vendor id payload Jan  5 01:30:21.972: ISAKMP:(1359): vendor ID is DPD Jan  5 01:30:21.972: ISAKMP:(1359): processing vendor id payload Jan  5 01:30:21.972: ISAKMP:(1359): speaking to another IOS box! Jan  5 01:30:21.972: ISAKMP:(1359): processing vendor id payload Jan  5 01:30:21.972: ISAKMP:(1359): vendor ID seems Unity/DPD but major 39 mismatch Jan  5 01:30:21.972: ISAKMP:(1359): vendor ID is XAUTH Jan  5 01:30:21.972: ISAKMP:received payload type 20 Jan  5 01:30:21.972: ISAKMP (1359): His hash no match - this node outside NAT Jan  5 01:30:21.972: ISAKMP:received payload type 20 Jan  5 01:30:21.972: ISAKMP (1359): No NAT Found for self or peer Jan  5 01:30:21.972: ISAKMP:(1359):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE Jan  5 01:30:21.972: ISAKMP:(1359):Old State = IKE_R_MM3  New State = IKE_R_MM3 Jan  5 01:30:21.972: ISAKMP:(1359): sending packet to 53.15.120.134 my_port 500 peer_port 500 (R) MM_KEY_EXCH Jan  5 01:30:21.972: ISAKMP:(1359):Sending an IKE IPv4 Packet. Jan  5 01:30:21.972: ISAKMP:(1359):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE Jan  5 01:30:21.972: ISAKMP:(1359):Old State = IKE_R_MM3  New State = IKE_R_MM4 Jan  5 01:30:22.024: ISAKMP (1359): received packet from 53.15.120.134 dport 500 sport 500 Global (R) MM_KEY_EXCH Jan  5 01:30:22.024: ISAKMP:(1359):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH Jan  5 01:30:22.024: ISAKMP:(1359):Old State = IKE_R_MM4  New State = IKE_R_MM5 Jan  5 01:30:22.024: ISAKMP:(1359): processing ID payload. message ID = 0 Jan  5 01:30:22.024: ISAKMP (1359): ID payload         next-payload : 8         type         : 1         address      : 53.15.120.134         protocol     : 17         port         : 500         length       : 12 Jan  5 01:30:22.024: ISAKMP:(0):: peer matches *none* of the profiles Jan  5 01:30:22.024: ISAKMP:(1359): processing HASH payload. message ID = 0 Jan  5 01:30:22.024: ISAKMP:received payload type 17 Jan  5 01:30:22.024: ISAKMP:(1359): processing NOTIFY INITIAL_CONTACT protocol 1         spi 0, message ID = 0, sa = 0x312417AC Jan  5 01:30:22.024: ISAKMP:(1359):SA authentication status:         authenticated Jan  5 01:30:22.024: ISAKMP:(1359):SA has been authenticated with 53.15.120.134 Jan  5 01:30:22.024: ISAKMP:(1359):SA authentication status:         authenticated Jan  5 01:30:22.024: ISAKMP:(1359): Process initial contact, bring down existing phase 1 and 2 SA's with local 53.15.120.138 remote 53.15.120.134 remote port 500 Jan  5 01:30:22.024: ISAKMP:(1359):returning IP addr to the address pool Jan  5 01:30:22.028: ISAKMP:(1359):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE Jan  5 01:30:22.028: ISAKMP:(1359):Old State = IKE_R_MM5  New State = IKE_R_MM5 Jan  5 01:30:22.028: IPSEC(key_engine): got a queue event with 1 KMI message(s) Jan  5 01:30:22.028: ISAKMP:(1359):SA is doing pre-shared key authentication using id type ID_IPV4_ADDR Jan  5 01:30:22.028: ISAKMP (1359): ID payload         next-payload : 8         type         : 1         address      : 53.15.120.138         protocol     : 17         port         : 500         length       : 12 Jan  5 01:30:22.028: ISAKMP:(1359):Total payload length: 12 Jan  5 01:30:22.028: ISAKMP:(1359): sending packet to 53.15.120.134 my_port 500 peer_port 500 (R) MM_KEY_EXCH Jan  5 01:30:22.028: ISAKMP:(1359):Sending an IKE IPv4 Packet. Jan  5 01:30:22.028: ISAKMP:(1359):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE Jan  5 01:30:22.032: ISAKMP:(1359):Old State = IKE_R_MM5  New State = IKE_P1_COMPLETE Jan  5 01:30:22.032: ISAKMP:(1359):Need XAUTH Jan  5 01:30:22.032: ISAKMP: set new node 1476990510 to CONF_XAUTH Jan  5 01:30:22.032: ISAKMP/xauth: request attribute XAUTH_USER_PASSWORD_V2 Jan  5 01:30:22.032: ISAKMP/xauth: request attribute XAUTH_REQ_NUMBER Jan  5 01:30:22.032: ISAKMP:(1359): initiating peer config to 53.15.120.134. ID = 1476990510 Jan  5 01:30:22.032: ISAKMP:(1359): sending packet to 53.15.120.134 my_port 500 peer_port 500 (R) CONF_XAUTH Jan  5 01:30:22.032: ISAKMP:(1359):Sending an IKE IPv4 Packet. Jan  5 01:30:22.032: ISAKMP:(1359):Input = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE Jan  5 01:30:22.032: ISAKMP:(1359):Old State = IKE_P1_COMPLETE  New State = IKE_XAUTH_REQ_SENT Jan  5 01:30:22.052: ISAKMP (1359): received packet from 53.15.120.134 dport 500 sport 500 Global (R) CONF_XAUTH Jan  5 01:30:22.052: ISAKMP (1359): received packet from 53.15.120.134 dport 500 sport 500 Global (R) CONF_XAUTH Jan  5 01:30:22.052: ISAKMP: set new node -1500484847 to CONF_XAUTH Jan  5 01:30:22.052: ISAKMP:(1359): processing HASH payload. message ID = -1500484847 Jan  5 01:30:22.052: ISAKMP:received payload type 18 Jan  5 01:30:22.052: ISAKMP:(1359):Processing delete with reason payload Jan  5 01:30:22.052: ISAKMP:(1359):delete doi = 1 Jan  5 01:30:22.052: ISAKMP:(1359):delete protocol id = 1 Jan  5 01:30:22.052: ISAKMP:(1359):delete spi_size =  16 Jan  5 01:30:22.052: ISAKMP:(1359):delete num spis = 1 Jan  5 01:30:22.052: ISAKMP:(1359):delete_reason = 28 Jan  5 01:30:22.052: ISAKMP:(1359): processing DELETE_WITH_REASON payload, message ID = -1500484847, reason: Unknown delete reason! Jan  5 01:30:22.052: ISAKMP:(1359):peer does not do paranoid keepalives. Jan  5 01:30:22.052: ISAKMP:(1359):peer does not do paranoid keepalives. Jan  5 01:30:22.052: ISAKMP:(1359):deleting SA reason "IKMP_ERR_NO_RETRANS" state (R) CONF_XAUTH    (peer 53.15.120.134) Jan  5 01:30:22.052: ISAKMP:(1359):deleting node -1500484847 error FALSE reason "Informational (in) state 1" Jan  5 01:30:22.056: IPSEC(key_engine): got a queue event with 1 KMI message(s) Jan  5 01:30:22.056: IPSEC(key_engine_delete_sas): rec'd delete notify from ISAKMP Jan  5 01:30:22.056: IPSEC(key_engine_delete_sas): delete all SAs shared with peer 53.15.120.134 Jan  5 01:30:22.056: ISAKMP: set new node -1018464447 to CONF_XAUTH Jan  5 01:30:22.056: ISAKMP:(1359): sending packet to 53.15.120.134 my_port 500 peer_port 500 (R) CONF_XAUTH Jan  5 01:30:22.056: ISAKMP:(1359):Sending an IKE IPv4 Packet. Jan  5 01:30:22.056: ISAKMP:(1359):purging node -1018464447 Jan  5 01:30:22.056: ISAKMP:(1359):Input = IKE_MESG_INTERNAL, IKE_PHASE1_DEL Jan  5 01:30:22.056: ISAKMP:(1359):Old State = IKE_XAUTH_REQ_SENT  New State = IKE_DEST_SA Jan  5 01:30:22.056: ISAKMP:(1359):deleting SA reason "IKMP_ERR_NO_RETRANS" state (R) CONF_XAUTH    (peer 53.15.120.134) Jan  5 01:30:22.056: ISAKMP: Unlocking peer struct 0x305438BC for isadb_mark_sa_deleted(), count 1 Jan  5 01:30:22.056: ISAKMP:(1359):deleting node 1476990510 error FALSE reason "IKE deleted" Jan  5 01:30:22.056: ISAKMP:(1359):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH Jan  5 01:30:22.056: ISAKMP:(1359):Old State = IKE_DEST_SA  New State = IKE_DEST_SA
Ответить | Правка | Cообщить модератору

Сообщения по теме

[Сортировка по времени | RSS]

1. "IPSEC+GRE"	+/–
Сообщение от BJ (ok) on 04-Янв-13, 19:23
Добавьте в конце строчки с ключем no-xauth
Ответить | Правка | ^ к родителю #0 | Наверх | Cообщить модератору

	2. "IPSEC+GRE"	+/–
	Сообщение от McS555 (ok) on 04-Янв-13, 19:33
	> Добавьте в конце строчки с ключем no-xauth Добавил. Пинг на туннель не пошел :( Продолжает MM_NO_STATE       1057 ACTIVE (deleted)
	Ответить | Правка | ^ к родителю #1 | Наверх | Cообщить модератору

	3. "IPSEC+GRE"	+/–
	Сообщение от McS555 (ok) on 04-Янв-13, 19:34
	А что значит это no-xauth ??
	Ответить | Правка | ^ к родителю #1 | Наверх | Cообщить модератору

	4. "IPSEC+GRE"	+/–
	Сообщение от spiegel (ok) on 05-Янв-13, 17:18
	Добавьте: interface Tunnel1   tunnel mode ipsec ipv4
	Ответить | Правка | ^ к родителю #3 | Наверх | Cообщить модератору

	5. "IPSEC+GRE"	+/–
	Сообщение от BJ (ok) on 05-Янв-13, 19:24
	> Добавьте: > interface Tunnel1 >   tunnel mode ipsec ipv4 mode transport тогда надо убрать, а то не полетит.
	Ответить | Правка | ^ к родителю #4 | Наверх | Cообщить модератору

	7. "IPSEC+GRE"	+/–
	Сообщение от McS555 (ok) on 07-Янв-13, 12:04
	>> Добавьте: >> interface Tunnel1 >>   tunnel mode ipsec ipv4 > mode transport тогда надо убрать, а то не полетит. Чего?? Другие туннели работать с режимом tunnel mode ipsec и с mode transport. Но попробую, поменяю. Спасибо
	Ответить | Правка | ^ к родителю #5 | Наверх | Cообщить модератору

	6. "IPSEC+GRE"	+/–
	Сообщение от McS555 (ok) on 07-Янв-13, 12:02
	> Добавьте: > interface Tunnel1 >   tunnel mode ipsec ipv4 ну.. поставил... опять! tunnel mode ipsec ipv4  убрал, когда пытался менять настройки!
	Ответить | Правка | ^ к родителю #4 | Наверх | Cообщить модератору

	8. "IPSEC+GRE"	+/–
	Сообщение от McS555 (ok) on 07-Янв-13, 12:08
	не работает (((
	Ответить | Правка | ^ к родителю #6 | Наверх | Cообщить модератору

	9. "IPSEC+GRE"	+/–
	Сообщение от spiegel (ok) on 07-Янв-13, 12:37
	> не работает ((( выкладывайте конфиг.
	Ответить | Правка | ^ к родителю #8 | Наверх | Cообщить модератору

	10. "IPSEC+GRE"	+/–
	Сообщение от McS555 (ok) on 08-Янв-13, 11:23
	>> не работает ((( > выкладывайте конфиг. ! crypto isakmp policy 10 encr 3des hash md5 authentication pre-share group 2 ! crypto isakmp policy 101 encr aes authentication pre-share group 5 crypto isakmp key 1234 address 53.15.120.134 crypto isakmp keepalive 30 10 ! ! crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac crypto ipsec fragmentation after-encryption crypto ipsec df-bit clear ! crypto ipsec profile PROFILE set transform-set ESP-3DES-MD5 ! ! interface Tunnel1 bandwidth 10000 ip address 10.0.22.5 255.255.255.252 ip mtu 1400 ip flow ingress ip tcp adjust-mss 1360 load-interval 30 tunnel source 53.15.120.138 tunnel mode ipsec ipv4 tunnel destination 53.15.120.134 tunnel protection ipsec profile PROFILE ! ! interface GigabitEthernet0/0 no ip address no ip route-cache cef no ip route-cache duplex auto speed auto no cdp enable ! ! interface GigabitEthernet0/0.2 encapsulation dot1Q 2 ip address 53.15.120.138 255.255.255.252 no ip route-cache ! ! ip route 0.0.0.0 0.0.0.0 53.15.120.137 Роутер №2 --------------------------- ! crypto isakmp policy 10 encr 3des hash md5 authentication pre-share group 2 crypto isakmp key 1234 address 53.15.120.138 crypto isakmp keepalive 30 10 ! crypto ipsec security-association lifetime seconds 86400 ! crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac crypto ipsec fragmentation after-encryption crypto ipsec df-bit clear ! crypto ipsec profile PROFILE set transform-set ESP-3DES-MD5 ! ! interface Tunnel1 bandwidth 10000 ip address 10.0.22.6 255.255.255.252 ip mtu 1400 ip flow ingress ip tcp adjust-mss 1360 tunnel source 53.15.120.134 tunnel mode ipsec ipv4 tunnel destination 53.15.120.138 tunnel protection ipsec profile PROFILE ! interface GigabitEthernet0/0 no ip address no ip route-cache cef no ip route-cache duplex auto speed auto no cdp enable ! ! interface GigabitEthernet0/0.2 encapsulation dot1Q 2 ip address 53.15.120.134 255.255.255.252 no ip route-cache ! ip route 0.0.0.0 0.0.0.0 53.15.120.133
	Ответить | Правка | ^ к родителю #9 | Наверх | Cообщить модератору

	11. "IPSEC+GRE"	+/–
	Сообщение от spiegel (ok) on 08-Янв-13, 12:08
	Какая версия IOS на обоих?
	Ответить | Правка | ^ к родителю #10 | Наверх | Cообщить модератору

	12. "IPSEC+GRE"	+/–
	Сообщение от McS555 (ok) on 08-Янв-13, 12:55
	> Какая версия IOS на обоих? c1900-universalk9-mz.SPA.151-3.T1.bin на обоих. Повторюсь. Может это провайдер "режет". Но как это ему "доказать". При этом нормально все строится на этих внешних ip только к другим маршрутерам. А вот между собой - не хочет
	Ответить | Правка | ^ к родителю #11 | Наверх | Cообщить модератору

	13. "IPSEC+GRE"	+/–
	Сообщение от spiegel (ok) on 08-Янв-13, 14:44
	>> Какая версия IOS на обоих? >  c1900-universalk9-mz.SPA.151-3.T1.bin > на обоих. > Повторюсь. Может это провайдер "режет". Но как это ему "доказать". При этом > нормально все строится на этих внешних ip только к другим маршрутерам. > А вот между собой - не хочет Попробуйте c1900-universalk9-mz.SPA.151-4.M4.bin. T-релизы частенько с багами идут.
	Ответить | Правка | ^ к родителю #12 | Наверх | Cообщить модератору

	14. "IPSEC+GRE"	+/–
	Сообщение от Николай (??) on 08-Янв-13, 17:16
	ГЭнии и гуру циско! Вы теоретически понимаете как вообще ИПСЕК это работает? Какие баги... какие х-ауз. У человека баннально на одной циске Дифи Хелман 2 на другой DH 5 стоит вот и срет она кирпичами.
	Ответить | Правка | ^ к родителю #13 | Наверх | Cообщить модератору

	15. "IPSEC+GRE"	+/–
	Сообщение от spiegel (ok) on 08-Янв-13, 17:49
	> ГЭнии и гуру циско! Вы теоретически понимаете как вообще ИПСЕК это работает? > Какие баги... какие х-ауз. > У человека баннально на одной циске Дифи Хелман 2 на другой DH > 5 стоит вот и срет она кирпичами. Интересно, где вы это увидели? R1: crypto isakmp policy 10 encr 3des hash md5 authentication pre-share group 2 ! R2: crypto isakmp policy 10 encr 3des hash md5 authentication pre-share group 2 По дебагу видно, что первая фаза проходит, но далее зачем-то требует расширенную аутентификацию. Поэтому попросил конфиг. В конфиге ее нет, тогда похоже баг IOS. В GNS3 конфиг проходит без проблем, но с другим IOS
	Ответить | Правка | ^ к родителю #14 | Наверх | Cообщить модератору

	16. "IPSEC+GRE"	+/–
	Сообщение от McS555 (ok) on 08-Янв-13, 18:07
	Счас, после всех изминений и проб конфиг такой : ! crypto isakmp policy 1 encr aes authentication pre-share group 2 lifetime 43200 crypto isakmp key 123456 address 53.15.120.134 no-xauth crypto isakmp keepalive 30 10 crypto isakmp aggressive-mode disable ! ! crypto ipsec security-association lifetime seconds 86400 ! crypto ipsec transform-set VPN_AES esp-aes esp-sha-hmac mode transport crypto ipsec fragmentation after-encryption crypto ipsec df-bit clear ! ! crypto ipsec profile VPN set transform-set VPN_AES ! ! ! ! ! ! interface Tunnel1 bandwidth 10000 ip address 10.0.222.5 255.255.255.252 ip mtu 1400 ip flow ingress ip tcp adjust-mss 1360 load-interval 30 tunnel source 53.15.120.138 tunnel mode ipsec ipv4 tunnel destination 53.15.120.134 tunnel protection ipsec profile VPN ! ! interface GigabitEthernet0/0 no ip address no ip route-cache cef no ip route-cache duplex auto speed auto no cdp enable ! ! interface GigabitEthernet0/0.2 encapsulation dot1Q 2 ip address 53.15.120.138 255.255.255.252 ! -------------------------------------------------------------------- ! crypto isakmp policy 1 encr aes authentication pre-share group 2 lifetime 43200 crypto isakmp key 123456 address 53.15.120.138 no-xauth crypto isakmp keepalive 30 10 ! crypto ipsec security-association lifetime seconds 86400 ! crypto ipsec transform-set TRANS-ESP-3DES-MD5 esp-3des esp-md5-hmac crypto ipsec transform-set VPN_AES esp-aes esp-sha-hmac mode transport crypto ipsec fragmentation after-encryption crypto ipsec df-bit clear ! ! crypto ipsec profile VPN set transform-set VPN_AES ! ! ! ! ! interface Tunnel1 bandwidth 10000 ip address 10.0.22.6 255.255.255.252 ip mtu 1400 ip flow ingress ip tcp adjust-mss 1360 tunnel source 53.15.120.134 tunnel mode ipsec ipv4 tunnel destination 53.15.120.138 tunnel protection ipsec profile VPN ! ! interface GigabitEthernet0/0 no ip address duplex auto speed auto no cdp enable ! ! interface GigabitEthernet0/0.2 encapsulation dot1Q 2 ip address 53.15.120.134 255.255.255.252 ! ------------------------------- Дебаг Jan  9 01:00:07.811: ISAKMP:(4711): retransmitting phase 2 CONF_XAUTH    1830283032 ... Jan  9 01:00:07.811: ISAKMP (4711): incrementing error counter on node, attempt 1 of 5: retransmit phase 2 Jan  9 01:00:07.811: ISAKMP (4711): incrementing error counter on sa, attempt 1 of 5: retransmit phase 2 Jan  9 01:00:07.811: ISAKMP:(4711): retransmitting phase 2 1830283032 CONF_XAUTH Jan  9 01:00:07.811: ISAKMP:(4711): sending packet to 53.15.120.134 my_port 500 peer_port 500 (R) CONF_XAUTH Jan  9 01:00:07.811: ISAKMP:(4711):Sending an IKE IPv4 Packet. Jan  9 01:00:07.831: ISAKMP (4711): received packet from 53.15.120.134 dport 500 sport 500 Global (R) CONF_XAUTH Jan  9 01:00:07.831: ISAKMP: set new node 936682827 to CONF_XAUTH Jan  9 01:00:07.831: ISAKMP:(4711): processing HASH payload. message ID = 936682827 Jan  9 01:00:07.831: ISAKMP:received payload type 18 Jan  9 01:00:07.831: ISAKMP:(4711):Processing delete with reason payload Jan  9 01:00:07.831: ISAKMP:(4711):delete doi = 1 Jan  9 01:00:07.831: ISAKMP:(4711):delete protocol id = 1 Jan  9 01:00:07.831: ISAKMP:(4711):delete spi_size =  16 Jan  9 01:00:07.831: ISAKMP:(4711):delete num spis = 1 Jan  9 01:00:07.831: ISAKMP:(4711):delete_reason = 28 Jan  9 01:00:07.831: ISAKMP:(4711): processing DELETE_WITH_REASON payload, message ID = 936682827, reason: Unknown delete reason! Jan  9 01:00:07.831: ISAKMP:(4711):peer does not do paranoid keepalives. Jan  9 01:00:07.831: ISAKMP:(4711):peer does not do paranoid keepalives. Jan  9 01:00:07.831: ISAKMP:(4711):deleting SA reason "IKMP_ERR_NO_RETRANS" state (R) CONF_XAUTH    (peer 53.15.120.134) Jan  9 01:00:07.831: ISAKMP:(4711):deleting node 936682827 error FALSE reason "Informational (in) state 1" Jan  9 01:00:07.831: IPSEC(key_engine): got a queue event with 1 KMI message(s) Jan  9 01:00:07.831: IPSEC(key_engine_delete_sas): rec'd delete notify from ISAKMP Jan  9 01:00:07.831: IPSEC(key_engine_delete_sas): delete all SAs shared with peer 53.15.120.134 Jan  9 01:00:07.835: ISAKMP: set new node 879882076 to CONF_XAUTH Jan  9 01:00:07.835: ISAKMP:(4711): sending packet to 53.15.120.134 my_port 500 peer_port 500 (R) CONF_XAUTH Jan  9 01:00:07.835: ISAKMP:(4711):Sending an IKE IPv4 Packet. Jan  9 01:00:07.835: ISAKMP:(4711):purging node 879882076 Jan  9 01:00:07.835: ISAKMP:(4711):Input = IKE_MESG_INTERNAL, IKE_PHASE1_DEL Jan  9 01:00:07.835: ISAKMP:(4711):Old State = IKE_XAUTH_REQ_SENT  New State = IKE_DEST_SA Jan  9 01:00:07.835: ISAKMP:(4711):deleting SA reason "IKMP_ERR_NO_RETRANS" state (R) CONF_XAUTH    (peer 53.15.120.134) Jan  9 01:00:07.835: ISAKMP: Unlocking peer struct 0x305438BC for isadb_mark_sa_deleted(), count 1 Jan  9 01:00:07.835: ISAKMP:(4711):deleting node 1830283032 error FALSE reason "IKE deleted" Jan  9 01:00:07.835: ISAKMP:(4711):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH Jan  9 01:00:07.835: ISAKMP:(4711):Old State = IKE_DEST_SA  New State = IKE_DEST_SA Jan  9 01:00:11.235: IPSEC(key_engine): request timer fired: count = 2,   (identity) local= 53.15.120.138:0, remote= 53.15.120.134:0,     local_proxy= 0.0.0.0/0.0.0.0/0/0 (type=4),     remote_proxy= 0.0.0.0/0.0.0.0/0/0 (type=4) Jan  9 01:00:11.391: ISAKMP:(4708):purging SA., sa=288B1194, delme=288B1194 Jan  9 01:00:11.391: ISAKMP:(4708):purging node -1982597897 Jan  9 01:00:11.391: ISAKMP:(4708):purging node 1364189168 Jan  9 01:00:27.831: ISAKMP:(4709):purging node -1206203109 Jan  9 01:00:31.391: ISAKMP:(4710):purging node 214309471 Jan  9 01:00:37.835: ISAKMP:(4709):purging SA., sa=2889D518, delme=2889D518 Jan  9 01:00:37.835: ISAKMP:(4709):purging node -1345495204 Jan  9 01:00:41.391: ISAKMP:(4710):purging SA., sa=301EF7DC, delme=301EF7DC Jan  9 01:00:41.391: ISAKMP:(4710):purging node 169975317 Jan  9 01:00:41.391: ISAKMP:(4710):purging node -1024689344 Jan  9 01:00:57.831: ISAKMP:(4711):purging node 936682827 office#1# Jan  9 01:01:07.835: ISAKMP:(4711):purging SA., sa=29A126D8, delme=29A126D8 Jan  9 01:01:07.835: ISAKMP:(4711):purging node 1830283032 office#1# Jan  9 01:01:11.235: %SEC-6-IPACCESSLOGP: list IPSEC permitted udp 53.15.120.134(500) (GigabitEthernet0/0.267 0023.3368.dbc0) -> 53.15.120.138(500), 53 packets Jan  9 01:01:11.235: IPSEC(sa_request): ,   (key eng. msg.) OUTBOUND local= 53.15.120.138:500, remote= 53.15.120.134:500,     local_proxy= 0.0.0.0/0.0.0.0/0/0 (type=4),     remote_proxy= 0.0.0.0/0.0.0.0/0/0 (type=4),     protocol= ESP, transform= esp-aes esp-sha-hmac  (Tunnel),     lifedur= 86400s and 4608000kb,     spi= 0x0(0), conn_id= 0, keysize= 128, flags= 0x0 Jan  9 01:01:11.235: ISAKMP:(0): SA request profile is (NULL) Jan  9 01:01:11.235: ISAKMP: Found a peer struct for 53.15.120.134, peer port 500 Jan  9 01:01:11.235: ISAKMP: Locking peer struct 0x305438BC, refcount 2 for isakmp_initiator Jan  9 01:01:11.235: ISAKMP: local port 500, remote port 500 Jan  9 01:01:11.235: ISAKMP: set new node 0 to CONF_XAUTH Jan  9 01:01:11.235: ISAKMP:(0):insert sa successfully sa = 2889D518 Jan  9 01:01:11.235: %CRYPTO-5-IKMP_AG_MODE_DISABLED: Unable to initiate or respond to Aggressive Mode while disabled Jan  9 01:01:11.235: ISAKMP:(0):Can not start Aggressive mode, trying Main mode. Jan  9 01:01:11.235: ISAKMP:(0):found peer pre-shared key matching 53.15.120.134 Jan  9 01:01:11.235: ISAKMP:(0): constructed NAT-T vendor-rfc3947 ID Jan  9 01:01:11.235: ISAKMP:(0): constructed NAT-T vendor-07 ID Jan  9 01:01:11.235: ISAKMP:(0): constructed NAT-T vendor-03 ID Jan  9 01:01:11.235: ISAKMP:(0): constructed NAT-T vendor-02 ID Jan  9 01:01:11.235: ISAKMP:(0):Input = IKE_MESG_FROM_IPSEC, IKE_SA_REQ_MM Jan  9 01:01:11.235: ISAKMP:(0):Old State = IKE_READY  New State = IKE_I_MM1 Jan  9 01:01:11.235: ISAKMP:(0): beginning Main Mode exchange Jan  9 01:01:11.235: ISAKMP:(0): sending packet to 53.15.120.134 my_port 500 peer_port 500 (I) MM_NO_STATE Jan  9 01:01:11.235: ISAKMP:(0):Sending an IKE IPv4 Packet. Jan  9 01:01:11.259: ISAKMP (0): received packet from 53.15.120.134 dport 500 sport 500 Global (I) MM_NO_STATE Jan  9 01:01:11.259: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH Jan  9 01:01:11.259: ISAKMP:(0):Old State = IKE_I_MM1  New State = IKE_I_MM2 Jan  9 01:01:11.259: ISAKMP:(0): processing SA payload. message ID = 0 Jan  9 01:01:11.259: ISAKMP:(0): processing vendor id payload Jan  9 01:01:11.259: ISAKMP:(0): vendor ID seems Unity/DPD but major 69 mismatch Jan  9 01:01:11.259: ISAKMP (0): vendor ID is NAT-T RFC 3947 Jan  9 01:01:11.259: ISAKMP:(0):found peer pre-shared key matching 53.15.120.134 Jan  9 01:01:11.259: ISAKMP:(0): local preshared key found Jan  9 01:01:11.259: ISAKMP:(0): Authentication by xauth preshared Jan  9 01:01:11.259: ISAKMP:(0):Checking ISAKMP transform 1 against priority 1 policy Jan  9 01:01:11.259: ISAKMP:      encryption AES-CBC Jan  9 01:01:11.259: ISAKMP:      keylength of 128 Jan  9 01:01:11.259: ISAKMP:      hash SHA Jan  9 01:01:11.259: ISAKMP:      default group 2 Jan  9 01:01:11.259: ISAKMP:      auth pre-share Jan  9 01:01:11.259: ISAKMP:      life type in seconds Jan  9 01:01:11.259: ISAKMP:      life duration (basic) of 43200 Jan  9 01:01:11.259: ISAKMP:(0):atts are acceptable. Next payload is 0 Jan  9 01:01:11.259: ISAKMP:(0):Acceptable atts:actual life: 0 Jan  9 01:01:11.259: ISAKMP:(0):Acceptable atts:life: 0 Jan  9 01:01:11.259: ISAKMP:(0):Basic life_in_seconds:43200 Jan  9 01:01:11.259: ISAKMP:(0):Returning Actual lifetime: 43200 Jan  9 01:01:11.259: ISAKMP:(0)::Started lifetime timer: 43200. Jan  9 01:01:11.259: ISAKMP:(0): processing vendor id payload Jan  9 01:01:11.259: ISAKMP:(0): vendor ID seems Unity/DPD but major 69 mismatch Jan  9 01:01:11.259: ISAKMP (0): vendor ID is NAT-T RFC 3947 Jan  9 01:01:11.259: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE Jan  9 01:01:11.259: ISAKMP:(0):Old State = IKE_I_MM2  New State = IKE_I_MM2 Jan  9 01:01:11.259: ISAKMP:(0): sending packet to 53.15.120.134 my_port 500 peer_port 500 (I) MM_SA_SETUP Jan  9 01:01:11.259: ISAKMP:(0):Sending an IKE IPv4 Packet. Jan  9 01:01:11.259: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE Jan  9 01:01:11.259: ISAKMP:(0):Old State = IKE_I_MM2  New State = IKE_I_MM3 Jan  9 01:01:11.311: ISAKMP (0): received packet from 53.15.120.134 dport 500 sport 500 Global (I) MM_SA_SETUP Jan  9 01:01:11.311: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH Jan  9 01:01:11.311: ISAKMP:(0):Old State = IKE_I_MM3  New State = IKE_I_MM4 Jan  9 01:01:11.311: ISAKMP:(0): processing KE payload. message ID = 0 Jan  9 01:01:11.343: ISAKMP:(0): processing NONCE payload. message ID = 0 Jan  9 01:01:11.343: ISAKMP:(0):found peer pre-shared key matching 53.15.120.134 Jan  9 01:01:11.343: ISAKMP:(4712): processing vendor id payload Jan  9 01:01:11.343: ISAKMP:(4712): vendor ID is Unity Jan  9 01:01:11.343: ISAKMP:(4712): processing vendor id payload Jan  9 01:01:11.343: ISAKMP:(4712): vendor ID is DPD Jan  9 01:01:11.343: ISAKMP:(4712): processing vendor id payload Jan  9 01:01:11.343: ISAKMP:(4712): speaking to another IOS box! Jan  9 01:01:11.343: ISAKMP:received payload type 20 Jan  9 01:01:11.343: ISAKMP (4712): His hash no match - this node outside NAT Jan  9 01:01:11.343: ISAKMP:received payload type 20 Jan  9 01:01:11.343: ISAKMP (4712): No NAT Found for self or peer Jan  9 01:01:11.343: ISAKMP:(4712):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE Jan  9 01:01:11.343: ISAKMP:(4712):Old State = IKE_I_MM4  New State = IKE_I_MM4 Jan  9 01:01:11.343: ISAKMP:(4712):Send initial contact Jan  9 01:01:11.343: ISAKMP:(4712):SA is doing pre-shared key authentication using id type ID_IPV4_ADDR Jan  9 01:01:11.343: ISAKMP (4712): ID payload         next-payload : 8         type         : 1cle c         address      : 53.15.120.138         protocol     : 17         port         : 500         length       : 12 Jan  9 01:01:11.343: ISAKMP:(4712):Total payload length: 12 Jan  9 01:01:11.343: ISAKMP:(4712): sending packet to 53.15.120.134 my_port 500 peer_port 500 (I) MM_KEY_EXCH Jan  9 01:01:11.343: ISAKMP:(4712):Sending an IKE IPv4 Packet. Jan  9 01:01:11.343: ISAKMP:(4712):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE Jan  9 01:01:11.343: ISAKMP:(4712):Old State = IKE_I_MM4  New State = IKE_I_MM5 Jan  9 01:01:11.367: ISAKMP (4712): received packet from 53.15.120.134 dport 500 sport 500 Global (I) MM_KEY_EXCH Jan  9 01:01:11.367: ISAKMP:(4712): processing ID payload. message ID = 0 Jan  9 01:01:11.367: ISAKMP (4712): ID payload         next-payload : 8         type         : 1         address      : 53.15.120.134         protocol     : 17         port         : 500         length       : 12 Jan  9 01:01:11.367: ISAKMP:(0):: peer matches *none* of the profiles Jan  9 01:01:11.367: ISAKMP:(4712): processing HASH payload. message ID = 0 Jan  9 01:01:11.367: ISAKMP:(4712):SA authentication status:         authenticated Jan  9 01:01:11.367: ISAKMP:(4712):SA has been authenticated with 53.15.120.134 Jan  9 01:01:11.367: ISAKMP:(4712):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH Jan  9 01:01:11.367: ISAKMP:(4712):Old State = IKE_I_MM5  New State = IKE_I_MM6 Jan  9 01:01:11.367: ISAKMP:(4712):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE Jan  9 01:01:11.367: ISAKMP:(4712):Old State = IKE_I_MM6  New State = IKE_I_MM6 Jan  9 01:01:11.367: ISAKMP:(4712):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE Jan  9 01:01:11.367: ISAKMP:(4712):Old State = IKE_I_MM6  New State = IKE_P1_COMPLETE Jan  9 01:01:11.367: ISAKMP:(4712):Need XAUTH Jan  9 01:01:11.367: ISAKMP: set new node 734794627 to CONF_XAUTH Jan  9 01:01:11.367: ISAKMP/xauth: request attribute XAUTH_USER_PASSWORD_V2 Jan  9 01:01:11.367: ISAKMP/xauth: request attribute XAUTH_REQ_NUMBER Jan  9 01:01:11.367: ISAKMP:(4712): initiating peer config to 53.15.120.134. ID = 734794627 Jan  9 01:01:11.367: ISAKMP:(4712): sending packet to 53.15.120.134 my_port 500 peer_port 500 (I) CONF_XAUTH Jan  9 01:01:11.367: ISAKMP:(4712):Sending an IKE IPv4 Packet. Jan  9 01:01:11.367: ISAKMP:(4712):Input = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE Jan  9 01:01:11.367: ISAKMP:(4712):Old State = IKE_P1_COMPLETE  New State = IKE_XAUTH_REQ_SENT Jan  9 01:01:11.391: ISAKMP (4712): received packet from 53.15.120.134 dport 500 sport 500 Global (I) CONF_XAUTH Jan  9 01:01:11.391: ISAKMP: set new node 36450315 to CONF_XAUTH Jan  9 01:01:11.391: ISAKMP:(4712): processing HASH payload. message ID = 36450315 Jan  9 01:01:11.391: ISAKMP:received payload type 18 Jan  9 01:01:11.391: ISAKMP:(4712):Processing delete with reason payload Jan  9 01:01:11.391: ISAKMP:(4712):delete doi = 1 Jan  9 01:01:11.391: ISAKMP:(4712):delete protocol id = 1 Jan  9 01:01:11.391: ISAKMP:(4712):delete spi_size =  16 Jan  9 01:01:11.391: ISAKMP:(4712):delete num spis = 1 Jan  9 01:01:11.391: ISAKMP:(4712):delete_reason = 28 Jan  9 01:01:11.391: ISAKMP:(4712): processing DELETE_WITH_REASON payload, message ID = 36450315, reason: Unknown delete reason! Jan  9 01:01:11.391: ISAKMP:(4712):peer does not do paranoid keepalives. Jan  9 01:01:11.391: ISAKMP:(4712):peer does not do paranoid keepalives. Jan  9 01:01:11.391: ISAKMP:(4712):deleting SA reason "IKMP_ERR_NO_RETRANS" state (I) CONF_XAUTH    (peer 53.15.120.134) Jan  9 01:01:11.391: ISAKMP:(4712):deleting node 36450315 error FALSE reason "Informational (in) state 1" Jan  9 01:01:11.391: IPSEC(key_engine): got a queue event with 1 KMI message(s) Jan  9 01:01:11.391: IPSEC(key_engine_delete_sas): rec'd delete notify from ISAKMP Jan  9 01:01:11.391: IPSEC(key_engine_delete_sas): delete all SAs shared with peer 53.15.120.134 Jan  9 01:01:11.391: ISAKMP: set new node -391262669 to CONF_XAUTH Jan  9 01:01:11.391: ISAKMP:(4712): sending packet to 53.15.120.134 my_port 500 peer_port 500 (I) CONF_XAUTH Jan  9 01:01:11.391: ISAKMP:(4712):Sending an IKE IPv4 Packet. Jan  9 01:01:11.391: ISAKMP:(4712):purging node -391262669 Jan  9 01:01:11.391: ISAKMP:(4712):Input = IKE_MESG_INTERNAL, IKE_PHASE1_DEL Jan  9 01:01:11.391: ISAKMP:(4712):Old State = IKE_XAUTH_REQ_SENT  New State = IKE_DEST_SA Jan  9 01:01:11.391: ISAKMP:(4712):deleting SA reason "IKMP_ERR_NO_RETRANS" state (I) CONF_XAUTH    (peer 53.15.120.134) ry sa Jan  9 01:01:11.391: ISAKMP: Unlocking peer struct 0x305438BC for isadb_mark_sa_deleted(), count 1 Jan  9 01:01:11.391: ISAKMP:(4712):deleting node 402029958 error FALSE reason "IKE deleted" Jan  9 01:01:11.391: ISAKMP:(4712):deleting node 734794627 error FALSE reason "IKE deleted" Jan  9 01:01:11.391: ISAKMP:(4712):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH Jan  9 01:01:11.391: ISAKMP:(4712):Old State = IKE_DEST_SA  New State = IKE_DEST_SA Jan  9 01:01:22.699: ISAKMP (0): received packet from 53.15.120.134 dport 500 sport 500 Global (N) NEW SA Jan  9 01:01:22.699: ISAKMP: Found a peer struct for 53.15.120.134, peer port 500 Jan  9 01:01:22.699: ISAKMP: Locking peer struct 0x305438BC, refcount 2 for crypto_isakmp_process_block Jan  9 01:01:22.699: ISAKMP: local port 500, remote port 500 Jan  9 01:01:22.699: ISAKMP:(0):insert sa successfully sa = 31A02CAC Jan  9 01:01:22.699: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH Jan  9 01:01:22.699: ISAKMP:(0):Old State = IKE_READY  New State = IKE_R_MM1 Jan  9 01:01:22.699: ISAKMP:(0): processing SA payload. message ID = 0 Jan  9 01:01:22.699: ISAKMP:(0): processing vendor id payload Jan  9 01:01:22.699: ISAKMP:(0): vendor ID seems Unity/DPD but major 69 mismatch Jan  9 01:01:22.699: ISAKMP (0): vendor ID is NAT-T RFC 3947 Jan  9 01:01:22.699: ISAKMP:(0): processing vendor id payload Jan  9 01:01:22.699: ISAKMP:(0): vendor ID seems Unity/DPD but major 245 mismatch Jan  9 01:01:22.699: ISAKMP (0): vendor ID is NAT-T v7 Jan  9 01:01:22.699: ISAKMP:(0): processing vendor id payload Jan  9 01:01:22.699: ISAKMP:(0): vendor ID seems Unity/DPD but major 157 mismatch Jan  9 01:01:22.699: ISAKMP:(0): vendor ID is NAT-T v3 Jan  9 01:01:22.699: ISAKMP:(0): processing vendor id payload Jan  9 01:01:22.699: ISAKMP:(0): vendor ID seems Unity/DPD but major 123 mismatch Jan  9 01:01:22.699: ISAKMP:(0): vendor ID is NAT-T v2 Jan  9 01:01:22.699: ISAKMP:(0):found peer pre-shared key matching 53.15.120.134 Jan  9 01:01:22.699: ISAKMP:(0): local preshared key found Jan  9 01:01:22.699: ISAKMP:(0): Authentication by xauth preshared Jan  9 01:01:22.699: ISAKMP:(0):Checking ISAKMP transform 1 against priority 1 policy Jan  9 01:01:22.699: ISAKMP:      encryption AES-CBC Jan  9 01:01:22.699: ISAKMP:      keylength of 128 Jan  9 01:01:22.699: ISAKMP:      hash SHA Jan  9 01:01:22.699: ISAKMP:      default group 2 Jan  9 01:01:22.699: ISAKMP:      auth pre-share Jan  9 01:01:22.699: ISAKMP:      life type in seconds Jan  9 01:01:22.699: ISAKMP:      life duration (basic) of 43200 Jan  9 01:01:22.699: ISAKMP:(0):atts are acceptable. Next payload is 0 Jan  9 01:01:22.699: ISAKMP:(0):Acceptable atts:actual life: 0 Jan  9 01:01:22.699: ISAKMP:(0):Acceptable atts:life: 0 Jan  9 01:01:22.699: ISAKMP:(0):Basic life_in_seconds:43200 Jan  9 01:01:22.699: ISAKMP:(0):Returning Actual lifetime: 43200 Jan  9 01:01:22.699: ISAKMP:(0)::Started lifetime timer: 43200. Jan  9 01:01:22.699: ISAKMP:(0): processing vendor id payload Jan  9 01:01:22.699: ISAKMP:(0): vendor ID seems Unity/DPD but major 69 mismatch Jan  9 01:01:22.699: ISAKMP (0): vendor ID is NAT-T RFC 3947 Jan  9 01:01:22.699: ISAKMP:(0): processing vendor id payload Jan  9 01:01:22.699: ISAKMP:(0): vendor ID seems Unity/DPD but major 245 mismatch Jan  9 01:01:22.699: ISAKMP (0): vendor ID is NAT-T v7 Jan  9 01:01:22.699: ISAKMP:(0): processing vendor id payload Jan  9 01:01:22.699: ISAKMP:(0): vendor ID seems Unity/DPD but major 157 mismatch Jan  9 01:01:22.699: ISAKMP:(0): vendor ID is NAT-T v3 Jan  9 01:01:22.699: ISAKMP:(0): processing vendor id payload Jan  9 01:01:22.699: ISAKMP:(0): vendor ID seems Unity/DPD but major 123 mismatch Jan  9 01:01:22.699: ISAKMP:(0): vendor ID is NAT-T v2 Jan  9 01:01:22.699: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE Jan  9 01:01:22.699: ISAKMP:(0):Old State = IKE_R_MM1  New State = IKE_R_MM1 Jan  9 01:01:22.703: ISAKMP:(0): constructed NAT-T vendor-rfc3947 ID Jan  9 01:01:22.703: ISAKMP:(0): sending packet to 53.15.120.134 my_port 500 peer_port 500 (R) MM_SA_SETUP Jan  9 01:01:22.703: ISAKMP:(0):Sending an IKE IPv4 Packet. Jan  9 01:01:22.703: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE Jan  9 01:01:22.703: ISAKMP:(0):Old State = IKE_R_MM1  New State = IKE_R_MM2 Jan  9 01:01:22.723: ISAKMP (0): received packet from 53.15.120.134 dport 500 sport 500 Global (R) MM_SA_SETUP Jan  9 01:01:22.723: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH Jan  9 01:01:22.723: ISAKMP:(0):Old State = IKE_R_MM2  New State = IKE_R_MM3 Jan  9 01:01:22.723: ISAKMP:(0): processing KE payload. message ID = 0 Jan  9 01:01:22.755: ISAKMP:(0): processing NONCE payload. message ID = 0 Jan  9 01:01:22.755: ISAKMP:(0):found peer pre-shared key matching 53.15.120.134 Jan  9 01:01:22.755: ISAKMP:(4713): processing vendor id payload Jan  9 01:01:22.755: ISAKMP:(4713): vendor ID is DPD Jan  9 01:01:22.755: ISAKMP:(4713): processing vendor id payload Jan  9 01:01:22.755: ISAKMP:(4713): speaking to another IOS box! Jan  9 01:01:22.755: ISAKMP:(4713): processing vendor id payload Jan  9 01:01:22.755: ISAKMP:(4713): vendor ID seems Unity/DPD but major 172 mismatch Jan  9 01:01:22.755: ISAKMP:(4713): vendor ID is XAUTH Jan  9 01:01:22.755: ISAKMP:received payload type 20 Jan  9 01:01:22.755: ISAKMP (4713): His hash no match - this node outside NAT Jan  9 01:01:22.755: ISAKMP:received payload type 20 Jan  9 01:01:22.755: ISAKMP (4713): No NAT Found for self or peer Jan  9 01:01:22.755: ISAKMP:(4713):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE Jan  9 01:01:22.755: ISAKMP:(4713):Old State = IKE_R_MM3  New State = IKE_R_MM3 Jan  9 01:01:22.755: ISAKMP:(4713): sending packet to 53.15.120.134 my_port 500 peer_port 500 (R) MM_KEY_EXCH Jan  9 01:01:22.755: ISAKMP:(4713):Sending an IKE IPv4 Packet. Jan  9 01:01:22.755: ISAKMP:(4713):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE Jan  9 01:01:22.755: ISAKMP:(4713):Old State = IKE_R_MM3  New State = IKE_R_MM4 Jan  9 01:01:22.807: ISAKMP (4713): received packet from 53.15.120.134 dport 500 sport 500 Global (R) MM_KEY_EXCH Jan  9 01:01:22.807: ISAKMP:(4713):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH Jan  9 01:01:22.807: ISAKMP:(4713):Old State = IKE_R_MM4  New State = IKE_R_MM5 Jan  9 01:01:22.807: ISAKMP:(4713): processing ID payload. message ID = 0 Jan  9 01:01:22.807: ISAKMP (4713): ID payload         next-payload : 8         type         : 1         address      : 53.15.120.134         protocol     : 17         port         : 500         length       : 12 Jan  9 01:01:22.807: ISAKMP:(0):: peer matches *none* of the profiles Jan  9 01:01:22.807: ISAKMP:(4713): processing HASH payload. message ID = 0 Jan  9 01:01:22.807: ISAKMP:received payload type 17 Jan  9 01:01:22.807: ISAKMP:(4713): processing NOTIFY INITIAL_CONTACT protocol 1         spi 0, message ID = 0, sa = 0x31A02CAC Jan  9 01:01:22.807: ISAKMP:(4713):SA authentication status:         authenticated Jan  9 01:01:22.807: ISAKMP:(4713):SA has been authenticated with 53.15.120.134 Jan  9 01:01:22.807: ISAKMP:(4713):SA authentication status:         authenticated Jan  9 01:01:22.807: ISAKMP:(4713): Process initial contact, bring down existing phase 1 and 2 SA's with local 53.15.120.138 remote 53.15.120.134 remote port 500 Jan  9 01:01:22.807: ISAKMP:(4713):returning IP addr to the address pool Jan  9 01:01:22.811: ISAKMP:(4713):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE Jan  9 01:01:22.811: ISAKMP:(4713):Old State = IKE_R_MM5  New State = IKE_R_MM5 Jan  9 01:01:22.811: IPSEC(key_engine): got a queue event with 1 KMI message(s) Jan  9 01:01:22.811: ISAKMP:(4713):SA is doing pre-shared key authentication using id type ID_IPV4_ADDR Jan  9 01:01:22.811: ISAKMP (4713): ID payload         next-payload : 8         type         : 1         address      : 53.15.120.138         protocol     : 17         port         : 500         length       : 12 Jan  9 01:01:22.811: ISAKMP:(4713):Total payload length: 12 Jan  9 01:01:22.811: ISAKMP:(4713): sending packet to 53.15.120.134 my_port 500 peer_port 500 (R) MM_KEY_EXCH Jan  9 01:01:22.811: ISAKMP:(4713):Sending an IKE IPv4 Packet. Jan  9 01:01:22.811: ISAKMP:(4713):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE Jan  9 01:01:22.811: ISAKMP:(4713):Old State = IKE_R_MM5  New State = IKE_P1_COMPLETE Jan  9 01:01:22.811: ISAKMP:(4713):Need XAUTH Jan  9 01:01:22.811: ISAKMP: set new node 517376506 to CONF_XAUTH Jan  9 01:01:22.811: ISAKMP/xauth: request attribute XAUTH_USER_PASSWORD_V2 Jan  9 01:01:22.811: ISAKMP/xauth: request attribute XAUTH_REQ_NUMBER Jan  9 01:01:22.815: ISAKMP:(4713): initiating peer config to 53.15.120.134. ID = 517376506 Jan  9 01:01:22.815: ISAKMP:(4713): sending packet to 53.15.120.134 my_port 500 peer_port 500 (R) CONF_XAUTH Jan  9 01:01:22.815: ISAKMP:(4713):Sending an IKE IPv4 Packet. Jan  9 01:01:22.815: ISAKMP:(4713):Input = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE Jan  9 01:01:22.815: ISAKMP:(4713):Old State = IKE_P1_COMPLETE  New State = IKE_XAUTH_REQ_SENT . Jan  9 01:01:22.835: ISAKMP (4713): received packet from 53.15.120.134 dport 500 sport 500 Global (R) CONF_XAUTH   .... Success rate is 0 percent (0/5) Jan  9 01:01:32.831: ISAKMP (4713): received packet from 53.15.120.134 dport 500 sport 500 Global (R) CONF_XAUTH   5 . Jan  9 01:01:37.815: ISAKMP:(4713): retransmitting phase 2 CONF_XAUTH    517376506 ... Jan  9 01:01:37.815: ISAKMP (4713): incrementing error counter on node, attempt 1 of 5: retransmit phase 2 Jan  9 01:01:37.815: ISAKMP (4713): incrementing error counter on sa, attempt 1 of 5: retransmit phase 2 Jan  9 01:01:37.815: ISAKMP:(4713): retransmitting phase 2 517376506 CONF_XAUTH Jan  9 01:01:37.815: ISAKMP:(4713): sending packet to 53.15.120.134 my_port 500 peer_port 500 (R) CONF_XAUTH Jan  9 01:01:37.815: ISAKMP:(4713):Sending an IKE IPv4 Packet. Jan  9 01:01:37.835: ISAKMP (4713): received packet from 53.15.120.134 dport 500 sport 500 Global (R) CONF_XAUTH Jan  9 01:01:37.835: ISAKMP: set new node -144563344 to CONF_XAUTH Jan  9 01:01:37.835: ISAKMP:(4713): processing HASH payload. message ID = -144563344 Jan  9 01:01:37.835: ISAKMP:received payload type 18 Jan  9 01:01:37.835: ISAKMP:(4713):Processing delete with reason payload Jan  9 01:01:37.835: ISAKMP:(4713):delete doi = 1 Jan  9 01:01:37.835: ISAKMP:(4713):delete protocol id = 1 Jan  9 01:01:37.835: ISAKMP:(4713):delete spi_size =  16 Jan  9 01:01:37.835: ISAKMP:(4713):delete num spis = 1 Jan  9 01:01:37.835: ISAKMP:(4713):delete_reason = 28 Jan  9 01:01:37.835: ISAKMP:(4713): processing DELETE_WITH_REASON payload, message ID = -144563344, reason: Unknown delete reason! Jan  9 01:01:37.835: ISAKMP:(4713):peer does not do paranoid keepalives. Jan  9 01:01:37.835: ISAKMP:(4713):peer does not do paranoid keepalives. Jan  9 01:01:37.835: ISAKMP:(4713):deleting SA reason "IKMP_ERR_NO_RETRANS" state (R) CONF_XAUTH    (peer 53.15.120.134) Jan  9 01:01:37.835: ISAKMP:(4713):deleting node -144563344 error FALSE reason "Informational (in) state 1" Jan  9 01:01:37.835: IPSEC(key_engine): got a queue event with 1 KMI message(s) Jan  9 01:01:37.835: IPSEC(key_engine_delete_sas): rec'd delete notify from ISAKMP Jan  9 01:01:37.835: IPSEC(key_engine_delete_sas): delete all SAs shared with peer 53.15.120.134 Jan  9 01:01:37.835: ISAKMP: set new node -615650979 to CONF_XAUTH Jan  9 01:01:37.835: ISAKMP:(4713): sending packet to 53.15.120.134 my_port 500 peer_port 500 (R) CONF_XAUTH Jan  9 01:01:37.839: ISAKMP:(4713):Sending an IKE IPv4 Packet. Jan  9 01:01:37.839: ISAKMP:(4713):purging node -615650979 Jan  9 01:01:37.839: ISAKMP:(4713):Input = IKE_MESG_INTERNAL, IKE_PHASE1_DEL Jan  9 01:01:37.839: ISAKMP:(4713):Old State = IKE_XAUTH_REQ_SENT  New State = IKE_DEST_SA . Jan  9 01:01:37.839: ISAKMP:(4713):deleting SA reason "IKMP_ERR_NO_RETRANS" state (R) CONF_XAUTH    (peer 53.15.120.134) Jan  9 01:01:37.839: ISAKMP: Unlocking peer struct 0x305438BC for isadb_mark_sa_deleted(), count 1 Jan  9 01:01:37.839: ISAKMP:(4713):deleting node 517376506 error FALSE reason "IKE deleted" Jan  9 01:01:37.839: ISAKMP:(4713):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH Jan  9 01:01:37.839: ISAKMP:(4713):Old State = IKE_DEST_SA  New State = IKE_DEST_SA Если ставлю  tunnel mode ipsec ipv4, то туннели в down. Если без, то в up, но правда все равно  ipsec не ставиться.
	Ответить | Правка | ^ к родителю #15 | Наверх | Cообщить модератору

	18. "IPSEC+GRE"	+/–
	Сообщение от spiegel (ok) on 08-Янв-13, 18:53
	Прогнал ваш первый конфиг на GNS3 с IOS c7200-adventerprisek9-mz.151-4.M2.bin (1900 в GNS нет). Все работает. Вот дебаг: *Jan  8 18:34:51.223: ISAKMP (0): received packet from 53.15.120.134 dport 500 s port 500 Global (N) NEW SA *Jan  8 18:34:51.227: ISAKMP: Created a peer struct for 53.15.120.134, peer port 500 *Jan  8 18:34:51.231: ISAKMP: New peer created peer = 0x69E46C6C peer_handle = 0 x80000005 *Jan  8 18:34:51.231: ISAKMP: Locking peer struct 0x69E46C6C, refcount 1 for cry pto_isakmp_process_block *Jan  8 18:34:51.231: ISAKMP: local port 500, remote port 500 *Jan  8 18:34:51.235: ISAKMP:(0):insert sa successfully sa = 69F2FF28 *Jan  8 18:34:51.239: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH *Jan  8 18:34:51.243: ISAKMP:(0):Old State = IKE_READY  New State = IKE_R_MM1 *Jan  8 18:34:51.247: ISAKMP:(0): processing SA payload. message ID = 0 *Jan  8 18:34:51.251: ISAKMP:(0): processing vendor id payload *Jan  8 18:34:51.251: ISAKMP:(0): vendor ID seems Unity/DPD but major 69 mismatc h *Jan  8 18:34:51.255: ISAKMP (0): vendor ID is NAT-T RFC 3947 *Jan  8 18:34:51.255: ISAKMP:(0): R2# processing vendor id payload *Jan  8 18:34:51.259: ISAKMP:(0): vendor ID seems Unity/DPD but major 245 mismat ch *Jan  8 18:34:51.259: ISAKMP (0): vendor ID is NAT-T v7 *Jan  8 18:34:51.259: ISAKMP:(0): processing vendor id payload *Jan  8 18:34:51.263: ISAKMP:(0): vendor ID seems Unity/DPD but major 157 mismat ch *Jan  8 18:34:51.263: ISAKMP:(0): vendor ID is NAT-T v3 *Jan  8 18:34:51.267: ISAKMP:(0): processing vendor id payload *Jan  8 18:34:51.267: ISAKMP:(0): vendor ID seems Unity/DPD but major 123 mismat ch *Jan  8 18:34:51.267: ISAKMP:(0): vendor ID is NAT-T v2 *Jan  8 18:34:51.271: ISAKMP:(0):found peer pre-shared key matching 53.15.120.13 4 *Jan  8 18:34:51.271: ISAKMP:(0): local preshared key found *Jan  8 18:34:51.275: ISAKMP : Scanning profiles for xauth ... *Jan  8 18:34:51.275: ISAKMP:(0):Checking ISAKMP transform 1 against priority 10 policy *Jan  8 18:34:51.275: ISAKMP:      encryption 3DES-CBC *Jan  8 18:34:51.279: ISAKMP:      hash MD5 *Jan  8 18:34:51.27 R2#9: ISAKMP:      default group 2 *Jan  8 18:34:51.279: ISAKMP:      auth pre-share *Jan  8 18:34:51.283: ISAKMP:      life type in seconds *Jan  8 18:34:51.283: ISAKMP:      life duration (VPI) of  0x0 0x1 0x51 0x80 *Jan  8 18:34:51.287: ISAKMP:(0):atts are acceptable. Next payload is 0 *Jan  8 18:34:51.291: ISAKMP:(0):Acceptable atts:actual life: 0 *Jan  8 18:34:51.291: ISAKMP:(0):Acceptable atts:life: 0 *Jan  8 18:34:51.291: ISAKMP:(0):Fill atts in sa vpi_length:4 *Jan  8 18:34:51.291: ISAKMP:(0):Fill atts in sa life_in_seconds:86400 *Jan  8 18:34:51.291: ISAKMP:(0):Returning Actual lifetime: 86400 *Jan  8 18:34:51.291: ISAKMP:(0)::Started lifetime timer: 86400. *Jan  8 18:34:51.291: ISAKMP:(0): processing vendor id payload *Jan  8 18:34:51.291: ISAKMP:(0): vendor ID seems Unity/DPD but major 69 mismatc h *Jan  8 18:34:51.291: ISAKMP (0): vendor ID is NAT-T RFC 3947 *Jan  8 18:34:51.291: ISAKMP:(0): processing vendor id payload *Jan  8 18:34:51.295: ISAKMP:(0): vendo R2#r ID seems Unity/DPD but major 245 mismatch *Jan  8 18:34:51.295: ISAKMP (0): vendor ID is NAT-T v7 *Jan  8 18:34:51.299: ISAKMP:(0): processing vendor id payload *Jan  8 18:34:51.299: ISAKMP:(0): vendor ID seems Unity/DPD but major 157 mismat ch *Jan  8 18:34:51.303: ISAKMP:(0): vendor ID is NAT-T v3 *Jan  8 18:34:51.303: ISAKMP:(0): processing vendor id payload *Jan  8 18:34:51.303: ISAKMP:(0): vendor ID seems Unity/DPD but major 123 mismat ch *Jan  8 18:34:51.307: ISAKMP:(0): vendor ID is NAT-T v2 *Jan  8 18:34:51.307: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MOD E *Jan  8 18:34:51.307: ISAKMP:(0):Old State = IKE_R_MM1  New State = IKE_R_MM1 *Jan  8 18:34:51.307: ISAKMP:(0): constructed NAT-T vendor-rfc3947 ID *Jan  8 18:34:51.307: ISAKMP:(0): sending packet to 53.15.120.134 my_port 500 pe er_port 500 (R) MM_SA_SETUP *Jan  8 18:34:51.307: ISAKMP:(0):Sending an IKE IPv4 Packet. *Jan  8 18:34:51.307: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE R2# *Jan  8 18:34:51.311: ISAKMP:(0):Old State = IKE_R_MM1  New State = IKE_R_MM2 *Jan  8 18:34:51.399: ISAKMP (0): received packet from 53.15.120.134 dport 500 s port 500 Global (R) MM_SA_SETUP *Jan  8 18:34:51.403: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH *Jan  8 18:34:51.403: ISAKMP:(0):Old State = IKE_R_MM2  New State = IKE_R_MM3 *Jan  8 18:34:51.415: ISAKMP:(0): processing KE payload. message ID = 0 *Jan  8 18:34:51.495: ISAKMP:(0): processing NONCE payload. message ID = 0 *Jan  8 18:34:51.495: ISAKMP:(0):found peer pre-shared key matching 53.15.120.13 4 *Jan  8 18:34:51.495: ISAKMP:(1002): processing vendor id payload *Jan  8 18:34:51.495: ISAKMP:(1002): vendor ID is DPD *Jan  8 18:34:51.495: ISAKMP:(1002): processing vendor id payload *Jan  8 18:34:51.495: ISAKMP:(1002): speaking to another IOS box! *Jan  8 18:34:51.495: ISAKMP:(1002): processing vendor id payload *Jan  8 18:34:51.495: ISAKMP:(1002): vendor ID seems Unity/DPD but major 244 mis match *Jan R2#  8 18:34:51.495: ISAKMP:(1002): vendor ID is XAUTH *Jan  8 18:34:51.495: ISAKMP:received payload type 20 *Jan  8 18:34:51.495: ISAKMP (1002): His hash no match - this node outside NAT *Jan  8 18:34:51.495: ISAKMP:received payload type 20 *Jan  8 18:34:51.495: ISAKMP (1002): No NAT Found for self or peer *Jan  8 18:34:51.495: ISAKMP:(1002):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_ MODE *Jan  8 18:34:51.495: ISAKMP:(1002):Old State = IKE_R_MM3  New State = IKE_R_MM3 *Jan  8 18:34:51.507: ISAKMP:(1002): sending packet to 53.15.120.134 my_port 500 peer_port 500 (R) MM_KEY_EXCH *Jan  8 18:34:51.507: ISAKMP:(1002):Sending an IKE IPv4 Packet. *Jan  8 18:34:51.511: ISAKMP:(1002):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPL ETE *Jan  8 18:34:51.511: ISAKMP:(1002):Old State = IKE_R_MM3  New State = IKE_R_MM4 *Jan  8 18:34:51.631: ISAKMP (1002): received packet from 53.15.120.134 dport 50 0 sport 500 Global (R) MM_KEY_EXCH *Jan  8 18:34:51.635: ISAKMP:(1002):Input = IKE_MESG_F R2#ROM_PEER, IKE_MM_EXCH *Jan  8 18:34:51.635: ISAKMP:(1002):Old State = IKE_R_MM4  New State = IKE_R_MM5 *Jan  8 18:34:51.643: ISAKMP:(1002): processing ID payload. message ID = 0 *Jan  8 18:34:51.643: ISAKMP (1002): ID payload         next-payload : 8         type         : 1         address      : 53.15.120.134         protocol     : 17         port         : 500         length       : 12 *Jan  8 18:34:51.647: ISAKMP:(0):: peer matches *none* of the profiles *Jan  8 18:34:51.651: ISAKMP:(1002): processing HASH payload. message ID = 0 *Jan  8 18:34:51.651: ISAKMP:received payload type 17 *Jan  8 18:34:51.655: ISAKMP:(1002): processing NOTIFY INITIAL_CONTACT protocol 1         spi 0, message ID = 0, sa = 0x69F2FF28 *Jan  8 18:34:51.655: ISAKMP:(1002):SA authentication status:         authenticated *Jan  8 18:34:51.659: ISAKMP:(1002):SA has been authenticated with 53.15.120.134 *Jan  8 18:34:51.659: ISAKMP:(1002):SA authentication status:         authenticated R2#n  8 18:34:51.663: ISAKMP:(1002): Process initial contact, bring down existing phase 1 and 2 SA's with local 53.15.120.138 remote 53.15.120 .134 remote port 500 *Jan  8 18:34:51.667: ISAKMP: Trying to insert a peer 53.15.120.138/53.15.120.13 4/500/,  and inserted successfully 69E46C6C. *Jan  8 18:34:51.671: ISAKMP:(1002):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_ MODE *Jan  8 18:34:51.671: ISAKMP:(1002):Old State = IKE_R_MM5  New State = IKE_R_MM5 *Jan  8 18:34:51.679: ISAKMP:(1002):SA is doing pre-shared key authentication us ing id type ID_IPV4_ADDR *Jan  8 18:34:51.683: ISAKMP (1002): ID payload         next-payload : 8         type         : 1         address      : 53.15.120.138         protocol     : 17         port         : 500         length       : 12 *Jan  8 18:34:51.687: ISAKMP:(1002):Total payload length: 12 *Jan  8 18:34:51.691: ISAKMP:(1002): sending packet to 53.15.120.134 my_port 500 peer_port 500 (R) MM_KEY_EXCH *Jan  8 18:34:51.691: ISAKMP:(1002):Sending an IKE IPv4 Packet. *Jan  8 18:34:51.695: ISAKMP:(1002):Input = IKE_MESG_INTERNAL, IKE_PR R2#OCESS_COMPLETE *Jan  8 18:34:51.699: ISAKMP:(1002):Old State = IKE_R_MM5  New State = IKE_P1_CO MPLETE *Jan  8 18:34:51.703: ISAKMP:(1002):IKE_DPD is enabled, initializing timers *Jan  8 18:34:51.707: ISAKMP:(1002):Input = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLE TE *Jan  8 18:34:51.707: ISAKMP:(1002):Old State = IKE_P1_COMPLETE  New State = IKE _P1_COMPLETE *Jan  8 18:34:51.835: ISAKMP (1002): received packet from 53.15.120.134 dport 50 0 sport 500 Global (R) QM_IDLE *Jan  8 18:34:51.835: ISAKMP: set new node 309380730 to QM_IDLE *Jan  8 18:34:51.839: ISAKMP:(1002): processing HASH payload. message ID = 30938 0730 *Jan  8 18:34:51.843: ISAKMP:(1002): processing SA payload. message ID = 3093807 30 *Jan  8 18:34:51.843: ISAKMP:(1002):Checking IPSec proposal 1 *Jan  8 18:34:51.843: ISAKMP: transform 1, ESP_3DES *Jan  8 18:34:51.847: ISAKMP:   attributes in transform: *Jan  8 18:34:51.847: ISAKMP:      encaps is 1 (Tunnel) *Jan  8 18:34:51.847: ISAKMP:      SA life t R2#ype in seconds *Jan  8 18:34:51.851: ISAKMP:      SA life duration (VPI) of  0x0 0x1 0x51 0x80 *Jan  8 18:34:51.855: ISAKMP:      SA life type in kilobytes *Jan  8 18:34:51.855: ISAKMP:      SA life duration (VPI) of  0x0 0x46 0x50 0x0 *Jan  8 18:34:51.863: ISAKMP:      authenticator is HMAC-MD5 *Jan  8 18:34:51.863: ISAKMP:(1002):atts are acceptable. *Jan  8 18:34:51.867: ISAKMP:(1002): processing NONCE payload. message ID = 3093 80730 *Jan  8 18:34:51.871: ISAKMP:(1002): processing ID payload. message ID = 3093807 30 *Jan  8 18:34:51.871: ISAKMP:(1002): processing ID payload. message ID = 3093807 30 *Jan  8 18:34:51.875: ISAKMP:(1002):QM Responder gets spi *Jan  8 18:34:51.875: ISAKMP:(1002):Node 309380730, Input = IKE_MESG_FROM_PEER, IKE_QM_EXCH *Jan  8 18:34:51.879: ISAKMP:(1002):Old State = IKE_QM_READY  New State = IKE_QM _SPI_STARVE *Jan  8 18:34:51.887: ISAKMP:(1002): Creating IPSec SAs *Jan  8 18:34:51.891:         inbound SA from 53.15.120.134 to 53.15.120.138 (f/ R2#i)  0/ 0         (proxy 0.0.0.0 to 0.0.0.0) *Jan  8 18:34:51.891:         has spi 0x2044F4EF and conn_id 0 *Jan  8 18:34:51.895:         lifetime of 86400 seconds *Jan  8 18:34:51.895:         lifetime of 4608000 kilobytes *Jan  8 18:34:51.895:         outbound SA from 53.15.120.138 to 53.15.120.134 (f /i) 0/0         (proxy 0.0.0.0 to 0.0.0.0) *Jan  8 18:34:51.899:         has spi  0x813F8371 and conn_id 0 *Jan  8 18:34:51.899:         lifetime of 86400 seconds *Jan  8 18:34:51.899:         lifetime of 4608000 kilobytes *Jan  8 18:34:51.903: ISAKMP:(1002): sending packet to 53.15.120.134 my_port 500 peer_port 500 (R) QM_IDLE *Jan  8 18:34:51.907: ISAKMP:(1002):Sending an IKE IPv4 Packet. *Jan  8 18:34:51.911: ISAKMP:(1002):Node 309380730, Input = IKE_MESG_INTERNAL, I KE_GOT_SPI *Jan  8 18:34:51.911: ISAKMP:(1002):Old State = IKE_QM_SPI_STARVE  New State = I KE_QM_R_QM2 *Jan  8 18:34:51.931: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel1, c R2#ged state to up *Jan  8 18:34:51.999: ISAKMP (1002): received packet from 53.15.120.134 dport 50 0 sport 500 Global (R) QM_IDLE *Jan  8 18:34:52.003: ISAKMP:(1002):deleting node 309380730 error FALSE reason " QM done (await)" *Jan  8 18:34:52.007: ISAKMP:(1002):Node 309380730, Input = IKE_MESG_FROM_PEER, IKE_QM_EXCH *Jan  8 18:34:52.007: ISAKMP:(1002):Old State = IKE_QM_R_QM2  New State = IKE_QM _PHASE2_COMPLETE R2# *Jan  8 18:35:19.555: ISAKMP:(1001):purging node 1876835001 *Jan  8 18:35:19.651: ISAKMP:(1001):purging node 846152661 R2# *Jan  8 18:35:29.687: ISAKMP:(1001):purging SA., sa=69E2EDA8, delme=69E2EDA8 R2# *Jan  8 18:35:42.007: ISAKMP:(1002):purging node 309380730 В общем и целом, у меня после фазы 1 идет переход на фазу 2, а у вас дальше требует: Jan  5 01:30:22.032: ISAKMP:(1359):Need XAUTH Jan  5 01:30:22.032: ISAKMP: set new node 1476990510 to CONF_XAUTH хотя никакого xauth в вашем конфиге я не вижу.
	Ответить | Правка | ^ к родителю #16 | Наверх | Cообщить модератору

	22. "IPSEC+GRE"	+/–
	Сообщение от McS555 (ok) on 09-Янв-13, 10:34
	> Прогнал ваш первый конфиг на GNS3 с IOS c7200-adventerprisek9-mz.151-4.M2.bin > (1900 в GNS нет). Все работает. Вот дебаг: Спасибо за старания!! Просто я не стал сам собирать стенд на GNS3, потому что между двумя этими маршрутизаторами на других адресах/каналах все нормально работает ( счас все по отключал, что б не мешало). Мне кажется, что где-то/что-то "режет" провайдер. Но мне что б какие то "претензии" предъявлять, надеялся понять, чего именно не хватает :(
	Ответить | Правка | ^ к родителю #18 | Наверх | Cообщить модератору

	17. "IPSEC+GRE"	+/–
	Сообщение от McS555 (ok) on 08-Янв-13, 18:33
	>  но далее зачем-то требует расширенную > аутентификацию. А где это видно?
	Ответить | Правка | ^ к родителю #15 | Наверх | Cообщить модератору

	19. "IPSEC+GRE"	+/–
	Сообщение от spiegel (ok) on 08-Янв-13, 19:02
	>>  но далее зачем-то требует расширенную >> аутентификацию. > А где это видно? Jan  5 01:30:22.032: ISAKMP:(1359):Need XAUTH
	Ответить | Правка | ^ к родителю #17 | Наверх | Cообщить модератору

	20. "IPSEC+GRE"	+/–
	Сообщение от Николай (??) on 08-Янв-13, 19:14
	>>  но далее зачем-то требует расширенную >> аутентификацию. > А где это видно? что показывает sh crypto session detail
	Ответить | Правка | ^ к родителю #17 | Наверх | Cообщить модератору

	21. "IPSEC+GRE"	+/–
	Сообщение от McS555 (ok) on 09-Янв-13, 10:30
	> что показывает > sh crypto session detail Crypto session current status Code: C - IKE Configuration mode, D - Dead Peer Detection K - Keepalives, N - NAT-traversal, T - cTCP encapsulation X - IKE Extended Authentication, F - IKE Fragmentation Interface: Tunnel1 Session status: DOWN-NEGOTIATING Peer: 53.15.120.134 port 500 fvrf: (none) ivrf: (none)       Desc: (none)       Phase1_id: (none)   IKEv1 SA: local 53.15.120.138/500 remote 53.15.120.134/500 Inactive           Capabilities:D connid:4586 lifetime:0   IKEv1 SA: local 53.15.120.138/500 remote 53.15.120.134/500 Inactive           Capabilities:D connid:4585 lifetime:0   IKEv1 SA: local 53.15.120.138/500 remote 53.15.120.134/500 Inactive           Capabilities:D connid:4587 lifetime:0   IPSEC FLOW: permit ip 0.0.0.0/0.0.0.0 0.0.0.0/0.0.0.0         Active SAs: 0, origin: crypto map         Inbound:  #pkts dec'ed 0 drop 0 life (KB/Sec) 0/0         Outbound: #pkts enc'ed 0 drop 0 life (KB/Sec) 0/0
	Ответить | Правка | ^ к родителю #20 | Наверх | Cообщить модератору

	23. "IPSEC+GRE"	+/–
	Сообщение от McS555 (ok) on 09-Янв-13, 11:36
	Тут все дело таки в  CONF_XAUTH Как его отключить? (кроме no-xauth)  :((
	Ответить | Правка | ^ к родителю #21 | Наверх | Cообщить модератору

	24. "IPSEC+GRE"	+/–
	Сообщение от spiegel (ok) on 09-Янв-13, 12:24
	> Тут все дело таки в  CONF_XAUTH > Как его отключить? (кроме no-xauth)  :(( У вас в реальном конфиге есть easy vpn-client?
	Ответить | Правка | ^ к родителю #23 | Наверх | Cообщить модератору

	25. "IPSEC+GRE"	+/–
	Сообщение от McS555 (ok) on 09-Янв-13, 16:35
	>> Тут все дело таки в  CONF_XAUTH >> Как его отключить? (кроме no-xauth)  :(( > У вас в реальном конфиге есть easy vpn-client? нет, но будет(надеюсь). Сегодня поменяю иос
	Ответить | Правка | ^ к родителю #24 | Наверх | Cообщить модератору

Архив | Удалить

Рекомендовать для помещения в FAQ | Индекс форумов | Темы | Пред. тема | След. тема