Приветствую! Есть cisco2811 c2800nm-advipservicesk9-mz.124-25b.binНастраиваю тунель, до товарища, находясь за NAT
crypto isakmp policy 10
encr 3des
authentication pre-share
group 2
lifetime 28800
crypto isakmp key masterkey"z" address 212.212.212.212
crypto isakmp keepalive 100 3
!
!
crypto ipsec transform-set z_vpn esp-3des esp-sha-hmac
!
crypto map dzetta_vpn 10 ipsec-isakmp
set peer 212.212.212.212
set security-association lifetime seconds 28800
set transform-set z_vpn
set pfs group2
match address vpn_z
!
interface FastEthernet0/0
crypto map dzetta_vpn
Нат, route делаю как мне нужно...
начинаю пинговать, происходит поднятие тунеля
....
Oct 1 00:45:51.828 MSD: ISAKMP:(0:0:N/A:0):Checking ISAKMP transform 1 against priority 10 policy
Oct 1 00:45:51.828 MSD: ISAKMP: encryption 3DES-CBC
Oct 1 00:45:51.828 MSD: ISAKMP: hash SHA
Oct 1 00:45:51.828 MSD: ISAKMP: default group 2
Oct 1 00:45:51.828 MSD: ISAKMP: auth pre-share
Oct 1 00:45:51.828 MSD: ISAKMP: life type in seconds
Oct 1 00:45:51.828 MSD: ISAKMP: life duration (basic) of 28800
Oct 1 00:45:51.828 MSD: ISAKMP:(0:0:N/A:0):atts are acceptable. Next payload is 0
Oct 1 00:45:51.832 MSD: CryptoEngine0: generating alg parameter for connid 1
Oct 1 00:45:51.868 MSD: CRYPTO_ENGINE: Dh phase 1 status: 0
Oct 1 00:45:51.868 MSD: CRYPTO_ENGINE: Dh phase 1 status: OK
Oct 1 00:45:51.868 MSD: ISAKMP:(0:1:SW:1):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
Oct 1 00:45:51.868 MSD: ISAKMP:(0:1:SW:1):Old State = IKE_I_MM2 New State = IKE_I_MM2
Oct 1 00:45:51.868 MSD: ISAKMP:(0:1:SW:1): sending packet to 212.212.212.212 my_port 500 peer_port 500 (I) MM_SA_SETUP
Oct 1 00:45:51.868 MSD: ISAKMP:(0:1:SW:1):Input = IK.E_MESG_INTERNAL, IKE_PROCESS_COMPLETE
Oct 1 00:45:51.868 MSD: ISAKMP:(0:1:SW:1):Old State = IKE_I_MM2 New State = IKE_I_MM3
Oct 1 00:45:52.244 MSD: ISAKMP (0:134217729): received packet from 212.212.212.212 dport 500 sport 500 Global (I) MM_SA_SETUP
Oct 1 00:45:52.244 MSD: ISAKMP:(0:1:SW:1):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
Oct 1 00:45:52.244 MSD: ISAKMP:(0:1:SW:1):Old State = IKE_I_MM3 New State = IKE_I_MM4
Oct 1 00:45:52.244 MSD: ISAKMP:(0:1:SW:1): processing KE payload. message ID = 0
Oct 1 00:45:52.244 MSD: CryptoEngine0: generating alg parameter for connid 0
Oct 1 00:45:52.292 MSD: ISAKMP:(0:1:SW:1): processing NONCE payload. message ID = 0
Oct 1 00:45:52.292 MSD: ISAKMP:(0:1:SW:1):found peer pre-shared key matching 212.212.212.212
Oct 1 00:45:52.292 MSD: CryptoEngine0: create ISAKMP SKEYID for conn id 1
Oct 1 00:45:52.292 MSD: ISAKMP:(0:1:SW:1):SKEYID state generated
Oct 1 00:45:52.292 MSD: ISAKMP:(0:1:SW:1): processing vendor id payload
Oct 1 00:45:52.292 MSD: ISAKMP:(0:1:SW:1): vendor ID is DPD
Oct 1 00:45:52.292 MSD: ISAKMP:(0:1:SW:1):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
Oct 1 00:45:52.292 MSD: ISAKMP:(0:1:SW:1):Old State = IKE_I_MM4 New State = IKE_I_MM4
Oct 1 00:45:52.296 MSD: ISAKMP:(0:1:SW:1):Send initial contact
Oct 1 00:45:52.296 MSD: ISAKMP:(0:1:SW:1):SA is doing pre-shared key authentication using id type ID_IPV4_ADDR
Oct 1 00:45:52.296 MSD: ISAKMP (0:134217729): ID payload
next-payload : 8
type : 1
address : 192.168.1.1
protocol : 17
port : 500
length : 12
Oct 1 00:50:06.464 MSD: ISAKMP:(0:1:SW:1):Total payload length: 12
Oct 1 00:50:06.464 MSD: CryptoEngine0: generate hmac context. for conn id 1
Oct 1 00:50:06.464 MSD: ISAKMP:(0:1:SW:1): sending packet to 212.212.212.212 my_port 500 peer_port 500 (I) MM_KEY_EXCH
Oct 1 00:50:06.464 MSD: ISAKMP:(0:1:SW:1):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
Oct 1 00:50:06.464 MSD: ISAKMP:(0:1:SW:1):Old State = IKE_I_MM4 New State = IKE_I_MM5
Oct 1 00:50:35.972 MSD: ISAKMP: received ke message (1/1)
Oct 1 00:50:35.972 MSD: ISAKMP: set new node 0 to QM_IDLE
Oct 1 00:50:35.972 MSD: ISAKMP:(0:1:SW:1):SA is still budding. Attached new ipsec request to it. (local 192.168.64.252, remote 212.176.25.252)
Oct 1 00:50:36.464 MSD: ISAKMP:(0:1:SW:1): retransmitting phase 1 MM_KEY_EXCH...
Oct 1 00:50:36.464 MSD: ISAKMP (0:134217729): incrementing error counter on sa, attempt 3 of 5: retransmit phase 1
... и опять и снова..
насколько я понял, не проходит авторизация, т.к. SA is doing pre-shared key authentication using id type ID_IPV4_ADDR
авторизируясь, в качестве ID_IPV4_ADDR посылается локальный айпи 192.168.1.1, что видно из ID payload... а надо-бы указать внешний... как это сделать? помогите советом!
заранее спасибо!
