форумы  помощь  поиск  регистрация  майллист  ВХОД  слежка

Вариант для распечатки		Архивированная нить - только для чтения!  Пред. тема | След. тема
Форумы Маршрутизаторы CISCO и др. оборудование. (Public)
Изначальное сообщение		[Проследить за развитием треда]

"Не встает ipsec!"
Сообщение от Дима on 15-Сен-03, 10:43  (MSK)
Не встает ipsec! Вроде и вся конфигурация по уму сделана - не пойму почему не работает! В консоли никаких логов нет - канала нет. [сетка 192.168.88.0]--Cisco2611---------Cisco1600-----[сетка 193.124.67.0]                       [ip=1.2.3.37]     [ip=1.2.3.37] Киски друг друга видят - пинги ходят по крайней мере. Конфигурация Cisco2611: **** crypto isakmp policy 10 hash md5 authentication pre-share crypto isakmp key testkey address 1.2.3.36 ! ! crypto ipsec transform-set myset esp-des esp-sha-hmac ! crypto map VPN 30 ipsec-isakmp set peer 1.2.3.36 set transform-set myset match address 102 interface FastEthernet0/1 ip address 1.2.3.37 255.255.255.240 no ip route-cache no ip mroute-cache duplex auto speed auto no cdp enable crypto map VPN ! access-list 102 permit ip 192.168.88.0 0.0.0.255 193.124.67.0 0.0.0.255 Конфигурация Cisco1600 ******** ! crypto isakmp policy 10 hash md5 authentication pre-share crypto isakmp key testkey address 1.2.3.37 ! ! crypto ipsec transform-set myset esp-des esp-sha-hmac ! crypto map VPN 30 ipsec-isakmp set peer 1.2.3.37 set transform-set myset match address 102 ! ! interface Ethernet1 ip address 1.2.3.36 255.255.255.224 ip nat outside no cdp enable crypto map VPN ! access-list 102 permit ip 193.124.67.0 0.0.0.255 192.168.88.0 0.0.0.255
	Рекомендовать в FAQ | Cообщить модератору | Наверх

Индекс форумов | Темы | Пред. тема | След. тема

Сообщения по теме

1. "Не встает ipsec!"
Сообщение от Дима on 15-Сен-03, 11:44  (MSK)
Извиняюсь, забыл добавить  - Cisco2611[(C2600-IS56I-M), Version 12.1(19)] Cisco1600[(C1600-K8OSY-M), Version 12.2(19)] Может проблема в разных версиях IOS?
	Рекомендовать в FAQ | Cообщить модератору | Наверх

	2. "Не встает ipsec!"
	Сообщение от Volume on 15-Сен-03, 14:39  (MSK)
	>Извиняюсь, забыл добавить  - >Cisco2611[(C2600-IS56I-M), Version 12.1(19)] >Cisco1600[(C1600-K8OSY-M), Version 12.2(19)] > >Может проблема в разных версиях IOS? 1. ВЕСЬ конфиг покажите 2. debug cry isak 3. s cry isa sa
		Рекомендовать в FAQ | Cообщить модератору | Наверх

	3. "Не встает ipsec!"
	Сообщение от Дима on 15-Сен-03, 15:53  (MSK)
	Поменял строчку crypto ipsec transform-set myset esp-des esp-sha-hmac на crypto ipsec transform-set myset esp-des esp-md5-hmac - пошли сообщения на консольку Cisco2611 [1.2.3.37]!- 02:46:29: IPSEC(key_engine): got a queue event... 02:46:29: IPSEC(key_engine_delete_sas): rec'd delete notify from ISAKMP 02:46:29: IPSEC(key_engine_delete_sas): delete all SAs shared with 1.2.3.36 02:47:23: %CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd packet not an IPSEC packet.         (ip) dest_addr= 1.2.3.63, src_addr= 1.2.3.40, prot= 17 02:47:29: IPSEC(key_engine): got a queue event... 02:47:29: IPSEC(key_engine_delete_sas): rec'd delete notify from ISAKMP 02:47:29: IPSEC(key_engine_delete_sas): delete all SAs shared with 1.2.3.36 02:47:39: IPSEC(key_engine): got a queue event... 02:47:39: IPSEC(key_engine_delete_sas): rec'd delete notify from ISAKMP 02:47:39: IPSEC(key_engine_delete_sas): delete all SAs shared with 1.2.3.36 02:48:28: IPSEC(key_engine): got a queue event... 02:48:28: IPSEC(key_engine_delete_sas): rec'd delete notify from ISAKMP 02:48:28: IPSEC(key_engine_delete_sas): delete all SAs shared with 1.2.3.36 02:49:40: %CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd packet not an IPSEC packet.         (ip) dest_addr= 1.2.3.255, src_addr= 1.2.3.225, prot= 17 02:50:43: %CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd packet not an IPSEC packet.         (ip) dest_addr= 192.168.0.255, src_addr= 192.168.0.128, prot= 17 02:51:53: %CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd packet not an IPSEC packet.         (ip) dest_addr= 1.2.3.255, src_addr= 1.2.3.255, prot= 17 ********* Конфиг 2611: version 12.1 no service single-slot-reload-enable service timestamps debug uptime service timestamps log uptime service password-encryption ! hostname dnepr ! aaa new-model aaa authentication login default local group radius aaa authentication ppp default group radius aaa authorization network default group radius if-authenticated aaa accounting delay-start aaa accounting network default start-stop group radius enable secret 5 xxxxxxxxxxx ! username xxx privilege 0 password 7 xxxx memory-size iomem 15 ip subnet-zero no ip source-route no ip routing no ip domain-lookup ! ! ! crypto isakmp policy 10 hash md5 authentication pre-share crypto isakmp key testkey address 1.2.3.36 ! ! crypto ipsec transform-set myset esp-des esp-md5-hmac ! crypto map VPN 30 ipsec-isakmp set peer 1.2.3.36 set transform-set myset match address 102 interface FastEthernet0/0 ip address 192.168.88.1 255.255.255.0 no ip route-cache no ip mroute-cache duplex auto speed auto no cdp enable ! ! interface FastEthernet0/1 ip address 1.2.3.37 255.255.255.240 no ip route-cache no ip mroute-cache duplex auto speed auto no cdp enable crypto map VPN ! ip classless ip route 0.0.0.0 0.0.0.0 FastEthernet0/1 no ip http server ! access-list 102 permit ip any any radius-server host 192.168.88.5 auth-port 1812 acct-port 1813 key key1 radius-server retransmit 3 radius-server vsa send authentication ! ! line con 0 exec-timeout 0 0 line 33 exec-timeout 0 0 modem Dialin autocommand  ppp transport preferred none transport input all escape-character BREAK stopbits 1 speed 38400 flowcontrol hardware line aux 0 line vty 0 4 ! end **** Конфиг Cisco1600: version 12.2 service timestamps debug uptime service timestamps log uptime service password-encryption service udp-small-servers service tcp-small-servers ! hostname tomas ! boot system flash flash:1:c1600-oy-mz_121-3.bin logging buffered 4096 debugging no logging console aaa new-model enable secret 5 xxxxxx ! username dima privilege 15 password xxxxxxxxx clock timezone EET 2 clock summer-time EED recurring last Sun Mar 2:00 last Sun Oct 2:00 ip subnet-zero ip ftp password 7 xxxxxxx no ip domain-lookup ! ! crypto isakmp policy 10 hash md5 authentication pre-share crypto isakmp key testkey address 1.2.3.37 ! ! crypto ipsec transform-set myset esp-des esp-md5-hmac ! crypto map VPN 30 ipsec-isakmp set peer 1.2.3.37 set transform-set myset match address 102 ! partition flash 2 8 8 interface Ethernet0 ip address 192.168.68.1 255.255.255.0 ip access-group 100 in ip nat inside no cdp enable ! interface Ethernet1 ip address 1.2.3.36 255.255.255.224 ip nat outside no cdp enable crypto map VPN ! router rip version 2 passive-interface Ethernet1 network 192.168.68.0 no auto-summary ! ip nat inside source list 1 interface Ethernet1 overload ip nat inside source static tcp 193.124.67.148 51 1.2.3.36 51 extendable ip nat inside source static tcp 193.124.67.148 500 1.2.3.36 500 extendable ip nat inside source static tcp 193.124.67.141 443 1.2.3.36 443 extendable ip nat inside source static tcp 193.124.67.141 80 1.2.3.36 80 extendable ip nat inside source static tcp 192.168.68.251 25 1.2.3.36 25 extendable ip nat inside source static tcp 193.124.67.148 50 1.2.3.36 50 extendable ip classless ip route 0.0.0.0 0.0.0.0 1.2.3.62 ip route 192.168.69.0 255.255.255.0 192.168.68.251 ip route 193.124.67.0 255.255.255.0 192.168.68.251 no ip http server ! logging trap warnings logging facility local6 logging 193.124.67.141 access-list 1 permit 192.168.0.0 0.0.255.255 access-list 1 permit 193.124.67.0 0.0.0.255 access-list 100 permit ip 192.168.0.0 0.0.255.255 any --пропущено--- access-list 102 permit ip any any access-list 110 deny   53 any any access-list 110 deny   55 any any access-list 110 deny   77 any any access-list 110 deny   pim any any access-list 110 deny   tcp any host 1.2.3.36 eq telnet access-list 110 deny   tcp any host 1.2.3.36 eq 161 access-list 110 permit ip any any ! line con 0 exec-timeout 0 0 password 7 xxxxx line vty 0 4 exec-timeout 0 0 password 7 xxxxx ! end
		Рекомендовать в FAQ | Cообщить модератору | Наверх

	4. "Не встает ipsec!"
	Сообщение от Дима on 15-Сен-03, 16:46  (MSK)
	Повалили логи - 00:02:41: ISAKMP: received ke message (1/1) 00:02:41: ISAKMP: local port 500, remote port 500 00:02:41: ISAKMP (0:1): beginning Main Mode exchange 00:02:41: ISAKMP (1): sending packet to 1.2.3.36 (I) MM_NO_STATE..... Success rate is 0 percent (0/5) dnepr# 00:02:51: %CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd packet not an IPSEC packet.         (ip) dest_addr= 1.2.3.63, src_addr= 1.2.3.40, prot= 17 00:02:51: ISAKMP (0:1): retransmitting phase 1 MM_NO_STATE... 00:02:51: ISAKMP (0:1): incrementing error counter on sa: retransmit phase 1 00:02:51: ISAKMP (1): sending packet to 1.2.3.36 (I) MM_NO_STATE 00:03:01: ISAKMP (0:1): retransmitting phase 1 MM_NO_STATE... 00:03:01: ISAKMP (0:1): incrementing error counter on sa: retransmit phase 1 00:03:01: ISAKMP (1): sending packet to 1.2.3.36 (I) MM_NO_STATE 00:03:11: IPSEC(key_engine): request timer fired: count = 1,   (identity) local= 192.168.88.1, remote= 1.2.3.36,     local_proxy= 0.0.0.0/0.0.0.0/0/0 (type=4),     remote_proxy= 0.0.0.0/0.0.0.0/0/0 (type=4) 00:03:11: IPSEC(sa_request): ,   (key eng. msg.) src= 192.168.88.1, dest= 1.2.3.36,     src_proxy= 0.0.0.0/0.0.0.0/0/0 (type=4),     dest_proxy= 0.0.0.0/0.0.0.0/0/0 (type=4),     protocol= ESP, transform= esp-des esp-md5-hmac ,     lifedur= 3600s and 4608000kb,     spi= 0x830E90(8588944), conn_id= 0, keysize= 0, flags= 0x4004 00:03:11: ISAKMP: received ke message (1/1) 00:03:11: ISAKMP (0:1): SA is still budding. Attached new ipsec request to it. 00:03:11: ISAKMP (0:1): retransmitting phase 1 MM_NO_STATE... 00:03:11: ISAKMP (0:1): incrementing error counter on sa: retransmit phase 1 00:03:11: ISAKMP (1): sending packet to 1.2.3.36 (I) MM_NO_STATE 00:03:21: ISAKMP (0:1): retransmitting phase 1 MM_NO_STATE... 00:03:21: ISAKMP (0:1): incrementing error counter on sa: retransmit phase 1 00:03:21: ISAKMP (1): sending packet to 1.2.3.36 (I) MM_NO_STATE 00:03:31: ISAKMP (0:1): retransmitting phase 1 MM_NO_STATE... 00:03:31: ISAKMP (0:1): incrementing error counter on sa: retransmit phase 1 00:03:31: ISAKMP (1): sending packet to 1.2.3.36 (I) MM_NO_STATE 00:03:41: IPSEC(key_engine): request timer fired: count = 2,   (identity) local= 192.168.88.1, remote= 1.2.3.36,     local_proxy= 0.0.0.0/0.0.0.0/0/0 (type=4),     remote_proxy= 0.0.0.0/0.0.0.0/0/0 (type=4) 00:03:41: ISAKMP: received ke message (3/1) 00:03:41: ISAKMP (0:1): ignoring request to send delete notify (sa not authenticated) src 192.168.88.1 dst 1.2.3.36 00:03:41: ISAKMP (0:1): retransmitting phase 1 MM_NO_STATE... 00:03:41: ISAKMP (0:1): phase 1 going away; let's be paranoid. 00:03:41: ISAKMP (0:1): Bring down phase 2's 00:03:41: ISAKMP (0:1): That phase 1 was the last one of its kind. Taking phase 2's with us. 00:03:41: ISAKMP (0:1): peer does not do paranoid keepalives.                                                                                                                              00:03:41: ISAKMP (0:1): deleting SA reason "death by retransmission P1" state (I) MM_NO_STATE (peer 1.2.3.36) input queu000:03:41: ISAKMP (0:1): deleting node -1218323057 error TRUE reason "death by retransmission P1" 00:03:41: ISAKMP (0:1): deleting node 1546138859 error TRUE reason "death by retransmission P1" 00:03:41: IPSEC(key_engine): got a queue event... 00:03:41: IPSEC(key_engine_delete_sas): rec'd delete notify from ISAKMP 00:03:41: IPSEC(key_engine_delete_sas): delete all SAs shared with 1.2.3.36 Что это может быть? Чего-то еще не хватает?
		Рекомендовать в FAQ | Cообщить модератору | Наверх

	5. "Не встает ipsec!"
	Сообщение от rpm on 15-Сен-03, 17:10  (MSK)
	1. Сделайте на 1600 -- clear crypto isakmp sa и clear crypto ipsec sa. 2. Попробуйте обновить IOS на 2611.
		Рекомендовать в FAQ | Cообщить модератору | Наверх

	6. "Не встает ipsec!"
	Сообщение от Volume on 15-Сен-03, 17:22  (MSK)
	смотрю я вот смотрю на ваши конфиги и думаю, ну неужели нельзя срисовать пример с циско.ком один-в-один, а? на 2600 вы какой траффик собираетесь в впн запихивать? а где это определено? ацл 102 перепишите с указанием конкретных сетей http://www.cisco.com/pcgi-bin/Support/browse/psp_view.pl?p=Technologies:IPSec&viewall=true
		Рекомендовать в FAQ | Cообщить модератору | Наверх

Удалить

Индекс форумов | Темы | Пред. тема | След. тема

Пожалуйста, прежде чем написать сообщение, ознакомьтесь с данными рекомендациями.