Исходное сообщение
"Не поднимается VPN на ASA (IPsec (IKEv1) Remoute Access VPN)" Отправлено V51, 30-Авг-13 13:42
Всем доброго времени суток! Имеется проблема: На ASA настроил с помощью wizardа  IPsec (IKEv1) Remoute Access VPN (для win), но не работает (ошибка 800), если отключить PFS, то vpn поднимается. В чем может быть проблема? Вот конфиг : ASA Version 8.4(6) ! interface Ethernet0/0 nameif outside security-level 0 ip address x.x.x.x 255.255.255.240 ospf cost 10 ! interface Ethernet0/1 no nameif no security-level no ip address ! interface Ethernet0/1.10 vlan 10 nameif dmz10 security-level 10 ip address 172.16.1.1 255.255.255.0 ospf cost 10 ! interface Ethernet0/2 nameif inside security-level 100 ip address 172.16.3.18 255.255.255.240 ospf cost 10 ! interface Ethernet0/3 description LAN Failover Interface no nameif no security-level no ip address ! interface Management0/0 nameif management security-level 100 no ip address ospf cost 10 management-only ftp mode passive clock timezone MSK 4 dns domain-lookup outside dns domain-lookup dmz10 dns domain-lookup inside dns domain-lookup management dns server-group DefaultDNS name-server 195.14.50.1 domain-name rosavto.ru same-security-traffic permit inter-interface same-security-traffic permit intra-interface object network l subnet 172.16.3.0 255.255.255.240 object network h host 172.16.3.4 object network 172.16.3.18 host 172.16.3.19 description 255.255.255.240 object network 172.16.3.19 host 172.16.3.19 description 255.255.255.240 object network NETWORK_OBJ_172.16.3.16_28 subnet 172.16.3.16 255.255.255.240 object network vpn subnet 172.16.3.16 255.255.255.240 access-list inside_access_in extended permit ip any any access-list outside_access_in extended permit ip any any access-list global_access extended permit ip any any access-list DefaultRAGroup_splitTunnelAcl standard permit any pager lines 24 logging enable logging asdm informational mtu outside 1500 mtu dmz10 1500 mtu inside 1500 mtu management 1500 ip local pool p 172.16.3.20-172.16.3.30 mask 255.255.255.240 no failover icmp unreachable rate-limit 1 burst-size 1 asdm image disk0:/asdm-713.bin no asdm history enable arp timeout 14400 no arp permit-nonconnected nat (inside,outside) source static any any destination static NETWORK_OBJ_172.16.3.16_28 NETWORK_OBJ_172.16.3.16_28 no-proxy-arp route-lookup nat (inside,any) source static any any destination static vpn vpn ! object network 172.16.3.19 nat (inside,outside) dynamic interface object network vpn nat (any,outside) dynamic interface access-group outside_access_in in interface outside access-group inside_access_in in interface inside access-group global_access global ! router ospf 1 network 172.16.0.2 255.255.255.255 area 0 log-adj-changes redistribute static subnets ! route outside 0.0.0.0 0.0.0.0 x1.x1.x1.x1 1 dynamic-access-policy-record DfltAccessPolicy user-identity default-domain LOCAL http server enable http 172.16.0.0 255.255.0.0 inside http 172.16.3.0 255.255.255.240 inside http 10.0.4.118 255.255.255.255 inside http 172.16.0.128 255.255.255.128 inside no snmp-server location no snmp-server contact snmp-server enable traps snmp authentication linkup linkdown coldstart crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS esp-aes esp-sha-hmac crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transport crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS esp-des esp-sha-hmac crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transport crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transport crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transport crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transport crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1 crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-192-SHA ESP-AES-256-SHA ESP-3DES-SHA ESP-DES-SHA ESP-AES-128-SHA-TRANS ESP-AES-192-SHA-TRANS ESP-AES-256-SHA-TRANS ESP-3DES-SHA-TRANS ESP-DES-SHA-TRANS crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP crypto map outside_map interface outside crypto map inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP crypto map inside_map interface inside crypto ca trustpoint _SmartCallHome_ServerCA crl configure crypto ca certificate chain _SmartCallHome_ServerCA certificate ca 6ecc7aa5a7032009b8cebcf4e952d491 308205ec 308204d4 a0030201 0202106e cc7aa5a7 032009b8 cebcf4e9 52d49130 0d06092a 864886f7 0d010105 05003081 ca310b30 09060355 04061302 55533117 30150603 55040a13 0e566572 69536967 6e2c2049 6e632e31 1f301d06 0355040b quit crypto ikev1 enable outside crypto ikev1 enable inside crypto ikev1 policy 10 authentication crack encryption aes-256 hash sha group 2 lifetime 86400 crypto ikev1 policy 20 authentication rsa-sig encryption aes-256 hash sha group 2 lifetime 86400 crypto ikev1 policy 30 authentication pre-share encryption aes-256 hash sha group 2 lifetime 86400 crypto ikev1 policy 40 authentication crack encryption aes-192 hash sha group 2 lifetime 86400 crypto ikev1 policy 50 authentication rsa-sig encryption aes-192 hash sha group 2 lifetime 86400 crypto ikev1 policy 60 authentication pre-share encryption aes-192 hash sha group 2 lifetime 86400 crypto ikev1 policy 70 authentication crack encryption aes hash sha group 2 lifetime 86400 crypto ikev1 policy 80 authentication rsa-sig encryption aes hash sha group 2 lifetime 86400 crypto ikev1 policy 90 authentication pre-share encryption aes hash sha group 2 lifetime 86400 crypto ikev1 policy 100 authentication crack encryption 3des hash sha group 2 lifetime 86400 crypto ikev1 policy 110 authentication rsa-sig encryption 3des hash sha group 2 lifetime 86400 crypto ikev1 policy 120 authentication pre-share encryption 3des hash sha group 2 lifetime 86400 crypto ikev1 policy 130 authentication crack encryption des hash sha group 2 lifetime 86400 crypto ikev1 policy 140 authentication rsa-sig encryption des hash sha group 2 lifetime 86400 crypto ikev1 policy 150 authentication pre-share encryption des hash sha group 2 lifetime 86400 telnet timeout 5 ssh 172.16.0.128 255.255.255.128 inside ssh 10.0.4.118 255.255.255.255 inside ssh 172.16.3.0 255.255.255.240 inside ssh 172.16.0.10 255.255.255.255 inside ssh timeout 20 ssh key-exchange group dh-group1-sha1 console timeout 0 threat-detection basic-threat threat-detection statistics access-list no threat-detection statistics tcp-intercept ntp server 194.190.168.1 source outside webvpn group-policy DefaultRAGroup internal group-policy DefaultRAGroup attributes dns-server value 195.14.50.1 172.16.2.2 vpn-tunnel-protocol l2tp-ipsec split-tunnel-policy tunnelspecified split-tunnel-network-list value DefaultRAGroup_splitTunnelAcl default-domain value rosavto.ru group-policy DfltGrpPolicy attributes dns-server value 195.14.50.1 username 12345 password eiGZD809dZlB5FxJDxQ9Xw== nt-encrypted privilege 0 username 12345 attributes vpn-group-policy DefaultRAGroup tunnel-group DefaultRAGroup general-attributes address-pool p default-group-policy DefaultRAGroup tunnel-group DefaultRAGroup ipsec-attributes ikev1 pre-shared-key ***** ! class-map inspection_default match default-inspection-traffic ! ! policy-map type inspect dns preset_dns_map parameters message-length maximum 512 policy-map global_policy class inspection_default inspect dns preset_dns_map inspect ftp inspect h323 h225 inspect h323 ras inspect netbios inspect rsh inspect rtsp inspect skinny inspect esmtp inspect sqlnet inspect sunrpc inspect tftp inspect sip inspect xdmcp inspect ip-options ! service-policy global_policy global prompt hostname context call-home reporting anonymous call-home profile CiscoTAC-1 no active destination address http https://tools.cisco.com/its/service/odd ... DCEService destination address email callhome@cisco.com destination transport-method http subscribe-to-alert-group diagnostic subscribe-to-alert-group environment subscribe-to-alert-group inventory periodic monthly subscribe-to-alert-group configuration periodic monthly subscribe-to-alert-group telemetry periodic daily Вот что в логах на момент подключения : [url=http://s2.ipicture.ru/][img]http://s2.ipictur... |Aug 29 2013|15:29:01|713257|||||Phase 1 failure: Mismatched attribute types for class Group Description: Rcv'd: Unknown Cfg'd: Group 2 5|Aug 29 2013|15:29:01|713257|||||Phase 1 failure: Mismatched attribute types for class Group Description: Rcv'd: Unknown Cfg'd: Group 2 5|Aug 29 2013|15:29:01|713257|||||Phase 1 failure: Mismatched attribute types for class Group Description: Rcv'd: Unknown Cfg'd: Group 2 5|Aug 29 2013|15:29:01|713257|||||Phase 1 failure: Mismatched attribute types for class Group Description: Rcv'd: Unknown Cfg'd: Group 2 5|Aug 29 2013|15:29:01|713257|||||Phase 1 failure: Mismatched attribute types for class Group Description: Rcv'd: Unknown Cfg'd: Group 2 5|Aug 29 2013|15:29:01|713257|||||Phase 1 failure: Mismatched attribute types for class Group Description: Rcv'd: Unknown Cfg'd: Group 2 4|Aug 29 2013|15:29:01|113019|||||Group = DefaultRAGroup, Username = , IP = y.y.y.y, Session disconnected. Session Type: IKEv1, Duration: 0h:00m:00s, Bytes xmt: 0, Bytes rcv: 0, Reason: Phase 2 Mismatch 5|Aug 29 2013|15:29:01|713259|||||Group = DefaultRAGroup, IP = y.y.y.y, Session is being torn down. Reason: Phase 2 Mismatch 3|Aug 29 2013|15:29:01|713902|||||Group = DefaultRAGroup, IP = y.y.y.y, Removing peer from correlator table failed, no match! 3|Aug 29 2013|15:29:01|713902|||||Group = DefaultRAGroup, IP = y.y.y.y, QM FSM error (P2 struct &0xac6ef730, mess id 0x70ce6747)! 5|Aug 29 2013|15:29:01|713904|||||Group = DefaultRAGroup, IP = y.y.y.y, All IPSec SA proposals found unacceptable! 6|Aug 29 2013|15:29:01|713177|||||Group = DefaultRAGroup, IP = y.y.y.y, Received remote Proxy Host FQDN in ID Payload: Host Name: ws-35.domen.ru Address y.y.y.y, Protocol 17, Port 1701 3|Aug 29 2013|15:29:01|713122|||||IP = y.y.y.y, Keep-alives configured on but peer does not support keep-alives (type = None) 5|Aug 29 2013|15:29:01|713119|||||Group = DefaultRAGroup, IP = y.y.y.y, PHASE 1 COMPLETED 6|Aug 29 2013|15:29:01|113009|||||AAA retrieved default group policy (DefaultRAGroup) for user = DefaultRAGroup 6|Aug 29 2013|15:29:01|713172|||||Group = DefaultRAGroup, IP = y.y.y.y, Automatic NAT Detection Status: Remote end IS behind a NAT device This end is NOT behind a NAT device 6|Aug 29 2013|15:29:01|302015|y.y.y.y|47490|x.x.x.x|4500|Built inbound UDP connection 295 for outside:y.y.y.y/47490 (y.y.y.y/47490) to identity:x.x.x.x/4500 (x.x.x.x/4500) 5|Aug 29 2013|15:29:01|713257|||||Phase 1 failure: Mismatched attribute types for class Group Description: Rcv'd: Group 1 Cfg'd: Group 2 5|Aug 29 2013|15:29:01|713257|||||Phase 1 failure: Mismatched attribute types for class Group Description: Rcv'd: Group 1 Cfg'd: Group 2 5|Aug 29 2013|15:29:01|713257|||||Phase 1 failure: Mismatched attribute types for class Group Description: Rcv'd: Group 1 Cfg'd: Group 2 5|Aug 29 2013|15:29:01|713257|||||Phase 1 failure: Mismatched attribute types for class Group Description: Rcv'd: Group 1 Cfg'd: Group 2 5|Aug 29 2013|15:29:01|713257|||||Phase 1 failure: Mismatched attribute types for class Group Description: Rcv'd: Group 1 Cfg'd: Group 2

Ваше сообщение
Имя*:
EMail:	Для отправки новых сообщений в текущей нити на email укажите знак ! перед адресом, например, !user@host.ru (!! - не показывать email). Более тонкая настройка отправки ответов производится в профиле зарегистрированного участника форума.
Заголовок*:
Сообщение*:	> Всем доброго времени суток! Имеется проблема: На ASA настроил с помощью wizardа > IPsec (IKEv1) Remoute Access VPN (для win), но не работает > (ошибка 800), если отключить PFS, то vpn поднимается. В чем может > быть проблема? > Вот конфиг : > ASA Version 8.4(6) > ! > interface Ethernet0/0 > nameif outside > security-level 0 > ip address x.x.x.x 255.255.255.240 > ospf cost 10 > ! > interface Ethernet0/1 > no nameif > no security-level > no ip address > ! > interface Ethernet0/1.10 > vlan 10 > nameif dmz10 > security-level 10 > ip address 172.16.1.1 255.255.255.0 > ospf cost 10 > ! > interface Ethernet0/2 > nameif inside > security-level 100 > ip address 172.16.3.18 255.255.255.240 > ospf cost 10 > ! > interface Ethernet0/3 > description LAN Failover Interface > no nameif > no security-level > no ip address > ! > interface Management0/0 > nameif management > security-level 100 > no ip address > ospf cost 10 > management-only > ftp mode passive > clock timezone MSK 4 > dns domain-lookup outside > dns domain-lookup dmz10 > dns domain-lookup inside > dns domain-lookup management > dns server-group DefaultDNS > name-server 195.14.50.1 > domain-name rosavto.ru > same-security-traffic permit inter-interface > same-security-traffic permit intra-interface > object network l > subnet 172.16.3.0 255.255.255.240 > object network h > host 172.16.3.4 > object network 172.16.3.18 > host 172.16.3.19 > description 255.255.255.240 > object network 172.16.3.19 > host 172.16.3.19 > description 255.255.255.240 > object network NETWORK_OBJ_172.16.3.16_28 > subnet 172.16.3.16 255.255.255.240 > object network vpn > subnet 172.16.3.16 255.255.255.240 > access-list inside_access_in extended permit ip any any > access-list outside_access_in extended permit ip any any > access-list global_access extended permit ip any any > access-list DefaultRAGroup_splitTunnelAcl standard permit any > pager lines 24 > logging enable > logging asdm informational > mtu outside 1500 > mtu dmz10 1500 > mtu inside 1500 > mtu management 1500 > ip local pool p 172.16.3.20-172.16.3.30 mask 255.255.255.240 > no failover > icmp unreachable rate-limit 1 burst-size 1 > asdm image disk0:/asdm-713.bin > no asdm history enable > arp timeout 14400 > no arp permit-nonconnected > nat (inside,outside) source static any any destination static NETWORK_OBJ_172.16.3.16_28 > NETWORK_OBJ_172.16.3.16_28 no-proxy-arp route-lookup > nat (inside,any) source static any any destination static vpn vpn > ! > object network 172.16.3.19 > nat (inside,outside) dynamic interface > object network vpn > nat (any,outside) dynamic interface > access-group outside_access_in in interface outside > access-group inside_access_in in interface inside > access-group global_access global > ! > router ospf 1 > network 172.16.0.2 255.255.255.255 area 0 > log-adj-changes > redistribute static subnets > ! > route outside 0.0.0.0 0.0.0.0 x1.x1.x1.x1 1 > dynamic-access-policy-record DfltAccessPolicy > user-identity default-domain LOCAL > http server enable > http 172.16.0.0 255.255.0.0 inside > http 172.16.3.0 255.255.255.240 inside > http 10.0.4.118 255.255.255.255 inside > http 172.16.0.128 255.255.255.128 inside > no snmp-server location > no snmp-server contact > snmp-server enable traps snmp authentication linkup linkdown coldstart > crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac > crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac > crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac > crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac > crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac > crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac > crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac > crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac > crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac > crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac > crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS esp-aes esp-sha-hmac > crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transport > crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS esp-des esp-sha-hmac > crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transport > crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac > crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transport > crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac > crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transport > crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac > crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transport > crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1 > crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA > ESP-AES-192-SHA ESP-AES-256-SHA ESP-3DES-SHA ESP-DES-SHA ESP-AES-128-SHA-TRANS ESP-AES-192-SHA-TRANS > ESP-AES-256-SHA-TRANS ESP-3DES-SHA-TRANS ESP-DES-SHA-TRANS > crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP > crypto map outside_map interface outside > crypto map inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP > crypto map inside_map interface inside > crypto ca trustpoint _SmartCallHome_ServerCA > crl configure > crypto ca certificate chain _SmartCallHome_ServerCA > certificate ca 6ecc7aa5a7032009b8cebcf4e952d491 > 308205ec 308204d4 a0030201 0202106e cc7aa5a7 032009b8 cebcf4e9 52d49130 > 0d06092a 864886f7 0d010105 05003081 ca310b30 09060355 04061302 55533117 > 30150603 55040a13 0e566572 69536967 6e2c2049 6e632e31 1f301d06 0355040b > quit > crypto ikev1 enable outside > crypto ikev1 enable inside > crypto ikev1 policy 10 > authentication crack > encryption aes-256 > hash sha > group 2 > lifetime 86400 > crypto ikev1 policy 20 > authentication rsa-sig > encryption aes-256 > hash sha > group 2 > lifetime 86400 > crypto ikev1 policy 30 > authentication pre-share > encryption aes-256 > hash sha > group 2 > lifetime 86400 > crypto ikev1 policy 40 > authentication crack > encryption aes-192 > hash sha > group 2 > lifetime 86400 > crypto ikev1 policy 50 > authentication rsa-sig > encryption aes-192 > hash sha > group 2 > lifetime 86400 > crypto ikev1 policy 60 > authentication pre-share > encryption aes-192 > hash sha > group 2 > lifetime 86400 > crypto ikev1 policy 70 > authentication crack > encryption aes > hash sha > group 2 > lifetime 86400 > crypto ikev1 policy 80 > authentication rsa-sig > encryption aes > hash sha > group 2 > lifetime 86400 > crypto ikev1 policy 90 > authentication pre-share > encryption aes > hash sha > group 2 > lifetime 86400 > crypto ikev1 policy 100 > authentication crack > encryption 3des > hash sha > group 2 > lifetime 86400 > crypto ikev1 policy 110 > authentication rsa-sig > encryption 3des > hash sha > group 2 > lifetime 86400 > crypto ikev1 policy 120 > authentication pre-share > encryption 3des > hash sha > group 2 > lifetime 86400 > crypto ikev1 policy 130 > authentication crack > encryption des > hash sha > group 2 > lifetime 86400 > crypto ikev1 policy 140 > authentication rsa-sig > encryption des > hash sha > group 2 > lifetime 86400 > crypto ikev1 policy 150 > authentication pre-share > encryption des > hash sha > group 2 > lifetime 86400 > telnet timeout 5 > ssh 172.16.0.128 255.255.255.128 inside > ssh 10.0.4.118 255.255.255.255 inside > ssh 172.16.3.0 255.255.255.240 inside > ssh 172.16.0.10 255.255.255.255 inside > ssh timeout 20 > ssh key-exchange group dh-group1-sha1 > console timeout 0 > threat-detection basic-threat > threat-detection statistics access-list > no threat-detection statistics tcp-intercept > ntp server 194.190.168.1 source outside > webvpn > group-policy DefaultRAGroup internal > group-policy DefaultRAGroup attributes > dns-server value 195.14.50.1 172.16.2.2 > vpn-tunnel-protocol l2tp-ipsec > split-tunnel-policy tunnelspecified > split-tunnel-network-list value DefaultRAGroup_splitTunnelAcl > default-domain value rosavto.ru > group-policy DfltGrpPolicy attributes > dns-server value 195.14.50.1 > username 12345 password eiGZD809dZlB5FxJDxQ9Xw== nt-encrypted privilege 0 > username 12345 attributes > vpn-group-policy DefaultRAGroup > tunnel-group DefaultRAGroup general-attributes > address-pool p > default-group-policy DefaultRAGroup > tunnel-group DefaultRAGroup ipsec-attributes > ikev1 pre-shared-key ***** > ! > class-map inspection_default > match default-inspection-traffic > ! > ! > policy-map type inspect dns preset_dns_map > parameters > message-length maximum 512 > policy-map global_policy > class inspection_default > inspect dns preset_dns_map > inspect ftp > inspect h323 h225 > inspect h323 ras > inspect netbios > inspect rsh > inspect rtsp > inspect skinny > inspect esmtp > inspect sqlnet > inspect sunrpc > inspect tftp > inspect sip > inspect xdmcp > inspect ip-options > ! > service-policy global_policy global > prompt hostname context > call-home reporting anonymous > call-home > profile CiscoTAC-1 > no active > destination address http https://tools.cisco.com/its/service/odd ... DCEService > destination address email callhome@cisco.com > destination transport-method http > subscribe-to-alert-group diagnostic > subscribe-to-alert-group environment > subscribe-to-alert-group inventory periodic monthly > subscribe-to-alert-group configuration periodic monthly > subscribe-to-alert-group telemetry periodic daily > Вот что в логах на момент подключения : > [url=http://s2.ipicture.ru/][img]http://s2.ipicture.ru/uploads/20130829/UUoxIYUZ.bmp[/img][/url] > |Aug 29 2013|15:29:01|713257|||||Phase > 1 failure: Mismatched attribute types for class Group Description: Rcv'd: Unknown > Cfg'd: Group 2 > 5|Aug 29 2013|15:29:01|713257|||||Phase > 1 failure: Mismatched attribute types for class Group Description: Rcv'd: Unknown > Cfg'd: Group 2 > 5|Aug 29 2013|15:29:01|713257|||||Phase > 1 failure: Mismatched attribute types for class Group Description: Rcv'd: Unknown > Cfg'd: Group 2 > 5|Aug 29 2013|15:29:01|713257|||||Phase > 1 failure: Mismatched attribute types for class Group Description: Rcv'd: Unknown > Cfg'd: Group 2 > 5|Aug 29 2013|15:29:01|713257|||||Phase > 1 failure: Mismatched attribute types for class Group Description: Rcv'd: Unknown > Cfg'd: Group 2 > 5|Aug 29 2013|15:29:01|713257|||||Phase > 1 failure: Mismatched attribute types for class Group Description: Rcv'd: Unknown > Cfg'd: Group 2 > 4|Aug 29 2013|15:29:01|113019|||||Group > = DefaultRAGroup, Username = , IP = y.y.y.y, Session disconnected. Session > Type: IKEv1, Duration: 0h:00m:00s, Bytes xmt: 0, Bytes rcv: 0, Reason: > Phase 2 Mismatch > 5|Aug 29 2013|15:29:01|713259|||||Group > = DefaultRAGroup, IP = y.y.y.y, Session is being torn down. Reason: > Phase 2 Mismatch > 3|Aug 29 2013|15:29:01|713902|||||Group > = DefaultRAGroup, IP = y.y.y.y, Removing peer from correlator table failed, > no match! > 3|Aug 29 2013|15:29:01|713902|||||Group > = DefaultRAGroup, IP = y.y.y.y, QM FSM error (P2 struct &0xac6ef730, > mess id 0x70ce6747)! > 5|Aug 29 2013|15:29:01|713904|||||Group > = DefaultRAGroup, IP = y.y.y.y, All IPSec SA proposals found unacceptable! > 6|Aug 29 2013|15:29:01|713177|||||Group > = DefaultRAGroup, IP = y.y.y.y, Received remote Proxy Host FQDN in > ID Payload: Host Name: ws-35.domen.ru Address y.y.y.y, Protocol 17, Port 1701 > 3|Aug 29 2013|15:29:01|713122|||||IP = y.y.y.y, > Keep-alives configured on but peer does not support keep-alives (type = > None) > 5|Aug 29 2013|15:29:01|713119|||||Group > = DefaultRAGroup, IP = y.y.y.y, PHASE 1 COMPLETED > 6|Aug 29 2013|15:29:01|113009|||||AAA retrieved > default group policy (DefaultRAGroup) for user = DefaultRAGroup > 6|Aug 29 2013|15:29:01|713172|||||Group > = DefaultRAGroup, IP = y.y.y.y, Automatic NAT Detection Status: Remote end > IS behind a NAT device This end is NOT behind a > NAT device > 6|Aug 29 2013|15:29:01|302015|y.y.y.y|47490|x.x.x.x|4500|Built > inbound UDP connection 295 for outside:y.y.y.y/47490 (y.y.y.y/47490) to identity:x.x.x.x/4500 > (x.x.x.x/4500) > 5|Aug 29 2013|15:29:01|713257|||||Phase > 1 failure: Mismatched attribute types for class Group Description: Rcv'd: Group > 1 Cfg'd: Group 2 > 5|Aug 29 2013|15:29:01|713257|||||Phase > 1 failure: Mismatched attribute types for class Group Description: Rcv'd: Group > 1 Cfg'd: Group 2 > 5|Aug 29 2013|15:29:01|713257|||||Phase > 1 failure: Mismatched attribute types for class Group Description: Rcv'd: Group > 1 Cfg'd: Group 2 > 5|Aug 29 2013|15:29:01|713257|||||Phase > 1 failure: Mismatched attribute types for class Group Description: Rcv'd: Group > 1 Cfg'd: Group 2 > 5|Aug 29 2013|15:29:01|713257|||||Phase > 1 failure: Mismatched attribute types for class Group Description: Rcv'd: Group > 1 Cfg'd: Group 2
	Введите код, изображенный на картинке: