Пытаюсь связать Cisco Router 3845 и линукс машину по ipsec!
interface Tunnel0
ip address 192.168.3.1 255.255.255.252
ip mtu 1460
tunnel source 10.10.0.92
tunnel destination 10.10.0.91
tunnel mode ipip
tunnel checksum
crypto map tunnel0
end
!
crypto map tunnel0 1 ipsec-isakmp
set peer 10.10.0.91
set security-association lifetime seconds 86400
set transform-set VPN
set pfs group2
match address 101
!
!
crypto ipsec transform-set VPN esp-3des esp-md5-hmac
!
crypto isakmp policy 1
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key cisco address 10.10.0.91
!
access-list 101 permit ip any any
вот что связано с конфигом ipsec в циске.
А вот конфиг на линукс стороне:
racoon.conf
path include "/etc/racoon";
path pre_shared_key "/etc/racoon/psk.txt";
path certificate "/etc/cert";
log notify;
padding
{
maximum_length 20;
randomize off;
strict_check off;
exclusive_tail off;
}
listen
{
isakmp 10.10.0.91 [500];
}
timer
{
# These value can be changed per remote node.
counter 5; # maximum trying count to send.
interval 20 sec; # maximum interval to resend.
persend 1; # the number of packets per a send.
# timer for waiting to complete each phase.
phase1 30 sec;
phase2 15 sec;
}
## IKE phase 1
remote 10.10.0.92
{
exchange_mode main,aggressive;
doi ipsec_doi;
situation identity_only;
my_identifier address 10.10.0.91;
nonce_size 16;
lifetime time 24 hour;
initial_contact on;
proposal_check obey; # obey, strict or claim
proposal {
encryption_algorithm 3des;
hash_algorithm md5;
authentication_method pre_shared_key ;
dh_group 2 ;
}
}
## IKE phase 2
sainfo address 172.16.1.0/24 any address 192.168.1.0/24 any {
pfs_group 2; # pfs_group modp768;
encryption_algorithm 3des;
authentication_algorithm hmac_md5;
compression_algorithm deflate;
}
setkey.conf:
flush;
spdflush;
spdadd 172.16.1.0/24 192.168.1.0/24 any -P out ipsec esp/tunnel/10.10.0.91-10.10.0.92/require;
# для входящего трафика
spdadd 192.168.1.0/24 172.16.1.0/24 any -P in ipsec esp/tunnel/10.10.0.92-10.10.0.91/require;
В логе видим следующее:
Jul 19 21:51:07 vmlinux racoon: INFO: Reading configuration from "/etc/racoon/racoon.conf"
Jul 19 21:51:28 vmlinux racoon: ERROR: failed to get sainfo.
Jul 19 21:51:28 vmlinux racoon: ERROR: failed to get sainfo.
Jul 19 21:51:28 vmlinux racoon: ERROR: failed to pre-process packet.
Не знаю уже куда копать. Помогайте
Вариант для распечатки
