Есть конфигурация- 1 маршрутизатор 2801 подключен к 2 маршрутизаторам 7204
конфиги 7204 однотипные, но при этом на 2801 тунель с 1 7204 поднимается со 2-м нет
Второй туннель должен подниматься при отключении интерфейса смотрящего на 1-й 7204. В логах выдает ошибку
%CRYPTO-6-IKMP_MODE_FAILURE: Processing of Quick mode failed with peer at 172.28.0.5
Вот конфиги 2801
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
crypto isakmp key cisco123 address 0.0.0.0 0.0.0.0
crypto isakmp keepalive 10
!
crypto ipsec transform-set T1 esp-3des esp-sha-hmac
!
crypto map VPNmap 1 ipsec-isakmp
set peer 172.28.0.1
set transform-set T1
match address 100
crypto map VPNmap 2 ipsec-isakmp
set peer 172.28.0.5
set transform-set T1
match address 100
!
interface Serial0/2/0:1
description ## to Site 1 ##
ip address 172.28.0.2 255.255.255.252
ip virtual-reassembly
encapsulation ppp
crypto map VPNmap
!
interface Serial0/2/1:1
description ## to Site 2 ##
ip address 172.28.0.6 255.255.255.252
ip virtual-reassembly
encapsulation ppp
ip ospf cost 80
crypto map VPNmap
!
access-list 100 remark IPSec_map
access-list 100 permit ip 172.28.1.0 0.0.0.255 any
7204 с которым тунель нормально поднимается
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
crypto isakmp key cisco123 address 0.0.0.0 0.0.0.0
crypto isakmp keepalive 10
crypto ipsec transform-set T1 esp-3des esp-sha-hmac
crypto map VPNmap 13 ipsec-isakmp
set peer 172.28.0.2
set transform-set T1
match address 113
interface Serial2/2:1
description ## to Site 13 ##
ip address 172.28.0.1 255.255.255.252
encapsulation ppp
ip ospf 10 area 0
crypto map VPNmap
ip rtp priority 5000 6000 500
access-list 113 permit ip any 172.28.1.0 0.0.0.255
7204 с проблемами
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
crypto isakmp key cisco123 address 0.0.0.0 0.0.0.0
crypto isakmp keepalive 10
crypto ipsec transform-set T1 esp-3des esp-sha-hmac
crypto map VPNmap 13 ipsec-isakmp
set peer 172.28.0.6
set transform-set T1
match address 113
interface Serial2/2:1
description ## to Site 13 ##
ip address 172.28.0.5 255.255.255.252
encapsulation ppp
ip ospf 10 area 0
crypto map VPNmap
ip rtp priority 5000 6000 500
access-list 113 permit ip any 172.28.1.0 0.0.0.255
Дебаг выдает вот что
279482: Jun 7 15:01:05 UZB: ISAKMP (0:134217747): received packet from 172.28.0.5 dport 500 sport 500 Global (R) QM_IDLE
279483: Jun 7 15:01:05 UZB: ISAKMP: set new node 1197570411 to QM_IDLE
279484: Jun 7 15:01:05 UZB: ISAKMP:(0:19:SW:1): processing HASH payload. message ID = 1197570411
279485: Jun 7 15:01:05 UZB: ISAKMP:(0:19:SW:1): processing SA payload. message ID = 1197570411
279486: Jun 7 15:01:05 UZB: ISAKMP:(0:19:SW:1):Checking IPSec proposal 1
279487: Jun 7 15:01:05 UZB: ISAKMP: transform 1, ESP_3DES
279488: Jun 7 15:01:05 UZB: ISAKMP: attributes in transform:
279489: Jun 7 15:01:05 UZB: ISAKMP: encaps is 1 (Tunnel)
279490: Jun 7 15:01:05 UZB: ISAKMP: SA life type in seconds
279491: Jun 7 15:01:05 UZB: ISAKMP: SA life duration (basic) of 3600
279492: Jun 7 15:01:05 UZB: ISAKMP: SA life type in kilobytes
279493: Jun 7 15:01:05 UZB: ISAKMP: SA life duration (VPI) of 0x0 0x46 0x50 0x0
279494: Jun 7 15:01:05 UZB: ISAKMP: authenticator is HMAC-SHA
279495: Jun 7 15:01:05 UZB: ISAKMP:(0:19:SW:1):atts are acceptable.
279496: Jun 7 15:01:05 UZB: IPSEC(validate_proposal_request): proposal part #1,
(key eng. msg.) INBOUND local= 172.28.0.6, remote= 172.28.0.5,
local_proxy= 172.28.1.0/255.255.255.0/0/0 (type=4),
remote_proxy= 0.0.0.0/0.0.0.0/0/0 (type=4),
protocol= ESP, transform= esp-3des esp-sha-hmac (Tunnel),
lifedur= 0s and 0kb,
spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x2
279497: Jun 7 15:01:05 UZB: Crypto mapdb : proxy_match
src addr : 172.28.1.0
dst addr : 0.0.0.0
protocol : 0
src port : 0
dst port : 0
279498: Jun 7 15:01:05 UZB: IPSEC(validate_transform_proposal): peer address 172.28.0.5 not found
279499: Jun 7 15:01:05 UZB: ISAKMP:(0:19:SW:1): IPSec policy invalidated proposal
279500: Jun 7 15:01:05 UZB: ISAKMP:(0:19:SW:1): phase 2 SA policy not acceptable! (local 172.28.0.6 remote 172.28.0.5)
279501: Jun 7 15:01:05 UZB: ISAKMP: set new node 76220685 to QM_IDLE
279502: Jun 7 15:01:05 UZB: ISAKMP:(0:19:SW:1):Sending NOTIFY PROPOSAL_NOT_CHOSEN protocol 3
spi 1662823704, message ID = 76220685
279503: Jun 7 15:01:05 UZB: ISAKMP:(0:19:SW:1): sending packet to 172.28.0.5 my_port 500 peer_port 500 (R) QM_IDLE
279504: Jun 7 15:01:05 UZB: ISAKMP:(0:19:SW:1):purging node 76220685
279505: Jun 7 15:01:05 UZB: ISAKMP:(0:19:SW:1):deleting node 1197570411 error TRUE reason "QM rejected"
279506: Jun 7 15:01:05 UZB: ISAKMP (0:134217747): Unknown Input IKE_MESG_FROM_PEER, IKE_QM_EXCH: for node 1197570411: state = IKE_QM_READY
279507: Jun 7 15:01:05 UZB: ISAKMP:(0:19:SW:1):Node 1197570411, Input = IKE_MESG_FROM_PEER, IKE_QM_EXCH
279508: Jun 7 15:01:05 UZB: ISAKMP:(0:19:SW:1):Old State = IKE_QM_READY New State = IKE_QM_READY
S13-R1#
279509: Jun 7 15:01:05 UZB: %CRYPTO-6-IKMP_MODE_FAILURE: Processing of Quick mode failed with peer at 172.28.0.5
S13-R1#