URL: https://www.opennet.me/cgi-bin/openforum/vsluhboard.cgi
Форум: vsluhforumID6
Нить номер: 475
[ Назад ]
Исходное сообщение
"Проблема с настройкой L2TP на PIX 515"
Отправлено don_kuklachev , 23-Янв-13 18:05 
Столкнулся с проблемой в настройке remote access vpn на PIX. Нужно чтобы работал через стандартный MS VPN client, в дальнейшем android,IOS. Через cisco клиент все прекрасно работает. Настраивать пробовал и через визард АСДМ и через консоль. Проблема как я понял не новая, но решения что то никак не найду. Есть подобная тема http://www.opennet.me/openforum/vsluhforumID6/11711.html. - вот только товарищ умалчивает как он решил проблему. Делал по анологии с http://www.cisco.com/en/US/products/ps6120/products_configur...
Выкладываю свой конфиг:

access-list NONAT extended permit ip object-group NET(внутренняя сеть) 172.21.15.0 255.255.255.0
nat(innet1) 0 access-list NONAT

ip local pool iphone-pool 172.21.15.10 - 172.21.15.20 mask 255.255.255.0
nat (Asnet) 1 172.21.15.0 255.255.255.224

group-policy DefaultRAGroup internal
group-policy DefaultRAGroup attributes
vpn-tunnel-protocol IPSec l2tp-ipsec

username test pass test

crypto ipsec transform-set TRANS_ESP_3DES_MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set TRANS_ESP_3DES_MD5 mode transport

crypto dynamic-map outside_dyn_map 20 set transform-set TRANS_ESP_3DES_MD5
crypto map office 33 ipsec-isakmp dynamic outside_dyn_map

crypto map office interface ASnet
crypto isakmp enable ASnet
crypto isakmp nat-traversal 20

crypto isakmp policy 40
authentication pre-share
encryption 3des
hash md5
group 2
lifetime 86400

tunnel-group DefaultRAGroup general-attributes
address-pool NET1
default-group-policy DefaultRAGroup

tunnel-group DefaultRAGroup ipsec-attributes
pre-shared-key *

tunnel-group DefaultRAGroup ppp-attributes
no authentication chap
authentication ms-chap-v2


Настройки MS Vpn клиента как в примере.Выдает ошибку 789.

Вот что debug crypto isakmp 7 выдает:

Jan 23 13:59:56 [IKEv1]: IP = 95.24.254.251, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 384
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing SA payload
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, Oakley proposal is acceptable
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing VID payload
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing VID payload
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, Received NAT-Traversal RFC VID
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing VID payload
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, Received NAT-Traversal ver 02 VID
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing VID payload
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, Received Fragmentation VID
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing VID payload
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing VID payload
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing VID payload
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing IKE SA payload
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, IKE SA Proposal # 1, Transform # 5 acceptable  Matches global IKE entry # 7
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, constructing ISAKMP SA payload
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, constructing NAT-Traversal VID ver 02 payload
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, constructing Fragmentation VID + extended capabilities payload
Jan 23 13:59:56 [IKEv1]: IP = 95.24.254.251, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 124
Jan 23 13:59:56 [IKEv1]: IP = 95.24.254.251, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + KE (4) + NONCE (10) + NAT-D (130) + NAT-D (130) + NONE (0) total length : 260
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing ke payload
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing ISA_KE payload
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing nonce payload
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing NAT-Discovery payload
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, computing NAT Discovery hash
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing NAT-Discovery payload
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, computing NAT Discovery hash
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, constructing ke payload
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, constructing nonce payload
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, constructing Cisco Unity VID payload
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, constructing xauth V6 VID payload
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, Send IOS VID
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, Constructing ASA spoofing IOS Vendor ID payload (version: 1.0.0, capabilities: 20000001)
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, constructing VID payload
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, Send Altiga/Cisco VPN3000/Cisco ASA GW VID
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, constructing NAT-Discovery payload
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, computing NAT Discovery hash
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, constructing NAT-Discovery payload
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, computing NAT Discovery hash
Jan 23 13:59:56 [IKEv1]: IP = 95.24.254.251, Connection landed on tunnel_group DefaultRAGroup
Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, Generating keys for Responder...
Jan 23 13:59:56 [IKEv1]: IP = 95.24.254.251, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + KE (4) + NONCE (10) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NAT-D (130) + NAT-D (130) + NONE (0) total length : 304
%PIX-3-713119: Group = DefaultRAGroup, IP = 95.24.254.251, PHASE 1 COMPLETED
%PIX-3-713122: IP = 95.24.254.251, Keep-alives configured on but peer does not support keep-alives (type = None)
: IP = 95.24.254.251, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + ID (5) + HASH (8) + NONE (0) total length : 64
Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, processing ID payload
Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, processing hash payload
Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, Computing hash for ISAKMP
Jan 23 13:59:56 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, Automatic NAT Detection Status:     Remote end   IS   behind a NAT device     This   end is NOT behind a NAT device
Jan 23 13:59:56 [IKEv1]: IP = 95.24.254.251, Connection landed on tunnel_group DefaultRAGroup
Jan 23 13:59:56 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, Freeing previously allocated memory for authorization-dn-attributes
Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, constructing ID payload
Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, constructing hash payload
Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, Computing hash for ISAKMP
Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, constructing dpd vid payload
Jan 23 13:59:56 [IKEv1]: IP = 95.24.254.251, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + ID (5) + HASH (8) + VENDOR (13) + NONE (0) total length : 84
Jan 23 13:59:56 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, PHASE 1 COMPLETED
Jan 23 13:59:56 [IKEv1]: IP = 95.24.254.251, Keep-alive type for this connection: None
Jan 23 13:59:56 [IKEv1]: IP = 95.24.254.251, Keep-alives configured on but peer does not support keep-alives (type = None)
Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, Starting P1 rekey timer: 21600 seconds.
%PIX-3-713902: Group = DefaultRAGroup, IP = 95.24.254.251, QM FSM error (P2 struct &0x2c44938, mess id 0x1)!
%PIX-3-713902: Group = DefaultRAGroup, IP = 95.24.254.251, Removing peer from correlator table failed, no match!
Jan 23 13:59:56 [IKEv1]: IP = 95.24.254.251, IKE_DECODE RECEIVED Message (msgid=1) with payloads : HDR + HASH (8) + SA (1) + NONCE (10) + ID (5) + ID (5) + NAT-OA (131) + NONE (0) total length : 312
Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, processing hash payload
Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, processing SA payload
Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, processing nonce payload
Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, processing ID payload
Jan 23 13:59:56 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, Received remote Proxy Host data in ID Payload:  Address 192.168.1.134, Protocol 17, Port 1701
Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, processing ID payload
Jan 23 13:59:56 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, Received local Proxy Host data in ID Payload:  Address 193.106.72.5, Protocol 17, Port 1701
Jan 23 13:59:56 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, L2TP/IPSec session detected.
Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, processing NAT-Original-Address payload
Jan 23 13:59:56 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, QM IsRekeyed old sa not found by addr
Jan 23 13:59:56 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, Static Crypto Map check, checking map = office, seq = 30...
Jan 23 13:59:56 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, Static Crypto Map check, map = office, seq = 30, no ACL configured
Jan 23 13:59:56 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, Static Crypto Map check, checking map = office, seq = 31...
Jan 23 13:59:56 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, Static Crypto Map check, map = office, seq = 31, ACL does not match proxy IDs src:95.24.254.251 dst:193.106.72.5
Jan 23 13:59:56 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, Static Crypto Map check, checking map = office, seq = 32...
Jan 23 13:59:56 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, Static Crypto Map check, map = office, seq = 32, no ACL configured
Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, Selecting only UDP-Encapsulated-Tunnel and  UDP-Encapsulated-Transport modes defined by NAT-Traversal
Jan 23 13:59:56 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, IKE Remote Peer configured for crypto map: DYNMAP
Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, processing IPSec SA payload
Jan 23 13:59:56 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, All IPSec SA proposals found unacceptable!
Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, sending notify message
Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, constructing blank hash payload
Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, constructing ipsec notify payload for msg id 1
Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, constructing qm hash payload
Jan 23 13:59:56 [IKEv1]: IP = 95.24.254.251, IKE_DECODE SENDING Message (msgid=fdf24661) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 84
Jan 23 13:59:56 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, QM FSM error (P2 struct &0x2c44938, mess id 0x1)!
Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, IKE QM Responder FSM error history (struct &0x2c44938)  <state>, <event>:  QM_DONE, EV_ERROR-->QM_BLD_MSG2, EV_NEGO_SA-->QM_BLD_MSG2, EV_IS_REKEY-->QM_BLD_MSG2, EV_CONFIRM_SA-->QM_BLD_MSG2, EV_PROC_MSG-->QM_BLD_MSG2, EV_HASH_OK-->QM_BLD_MSG2, NullEvent-->QM_BLD_MSG2, EV_COMP_HASH
Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, sending delete/delete with reason message
Jan 23 13:59:56 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, Removing peer from correlator table failed, no match!
Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, IKE SA MM:a6345da0 rcv'd Terminate: state MM_ACTIVE  flags 0x00000042, refcnt 1, tuncnt 0
Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, IKE SA MM:a6345da0 terminating:  flags 0x01000002, refcnt 0, tuncnt 0
Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, sending delete/delete with reason message
Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, constructing blank hash payload
Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, constructing IKE delete payload
Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, constructing qm hash payload
Jan 23 13:59:56 [IKEv1]: IP = 95.24.254.251, IKE_DECODE SENDING Message (msgid=4eee6bc6) with payloads : HDR + HASH (8) + DELETE (12) + NONE (0) total length : 80
Jan 23 13:59:56 [IKEv1]: IP = 95.24.254.251, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 384
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing SA payload
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, Oakley proposal is acceptable
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing VID payload
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing VID payload
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, Received NAT-Traversal RFC VID
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing VID payload
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, Received NAT-Traversal ver 02 VID
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing VID payload
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, Received Fragmentation VID
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing VID payload
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing VID payload
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing VID payload
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing IKE SA payload
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, IKE SA Proposal # 1, Transform # 5 acceptable  Matches global IKE entry # 7
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, constructing ISAKMP SA payload
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, constructing NAT-Traversal VID ver 02 payload
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, constructing Fragmentation VID + extended capabilities payload
Jan 23 13:59:56 [IKEv1]: IP = 95.24.254.251, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 124
Jan 23 14:00:04 [IKEv1]: IP = 95.24.254.251, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 124
Jan 23 14:00:12 [IKEv1]: IP = 95.24.254.251, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 124


Debug crypto ipsec 7:
                                                                  
%PIX-3-713119: Group = DefaultRAGroup, IP = 95.24.254.251, PHASE 1 COMPLETED
%PIX-3-713122: IP = 95.24.254.251, Keep-alives configured on but peer does not support keep-alives (type = None)
%PIX-3-713902: Group = DefaultRAGroup, IP = 95.24.254.251, QM FSM error (P2 struct &0x32bc3b0, mess id 0x1)!
%PIX-3-713902: Group = DefaultRAGroup, IP = 95.24.254.251, Removing peer from correlator table failed, no match!

Проблема как я понимаю во второй фазе.

Также не понятно почему PIX ругается на команду:
PIX525(config)# crypto map office 33 ipsec-isakmp dynamic outside_dyn_map
WARNING: dynamic map has incomplete entries

Заранее спасибо, кто не поленился прочитать))

Содержание
Сообщения в этом обсуждении
"Проблема с настройкой L2TP на PIX 515"
Отправлено spiegel , 23-Янв-13 21:57 
Тут навскидку сразу 2 ошибки:
1.access-list:

Jan 23 13:59:56 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, Static Crypto Map check, map = office, seq = 31, ACL does not match proxy IDs src:95.24.254.251 dst:193.106.72.5
Jan 23 13:59:56 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, Static Crypto Map check, checking map = office, seq = 32...
Jan 23 13:59:56 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, Static Crypto Map check, map = office, seq = 32, no ACL configured

2.ipsec sa не совпадает:
Jan 23 13:59:56 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, All IPSec
SA proposals found unacceptable!

посмотрите, что выдаст deb crypto ipsec

"Проблема с настройкой L2TP на PIX 515"
Отправлено don_kuklachev , 24-Янв-13 11:38 
1. В crypto map office действительно висел еще один dynamic map под номером 40 и 2 static под номерами 30 и 31. Поставил crypto map office 10 ipsec-isakmp dynamic outside_dyn_map.

debug crypto isakmp:
Jan 24 11:01:35 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, IKE Remote Peer configured for crypto map: outside_dyn_map
Jan 24 11:01:35 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, processing IPSec SA payload
Jan 24 11:01:35 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, All IPSec SA proposals found unacceptable!
Jan 24 11:01:35 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, sending notify message
Jan 24 11:01:35 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, constructing blank hash payload
Jan 24 11:01:35 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, constructing ipsec notify payload for msg id 1
Jan 24 11:01:35 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, constructing qm hash payload
Jan 24 11:01:35 [IKEv1]: IP = 95.24.254.251, IKE_DECODE SENDING Message (msgid=2f12737a) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 84
Jan 24 11:01:35 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, QM FSM error (P2 struct &0x2c9d860, mess id 0x1)!
Jan 24 11:01:35 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, IKE QM Responder FSM error history (struct &0x2c9d860)  <state>, <event>:  QM_DONE, EV_ERROR-->QM_BLD_MSG2, EV_NEGO_SA-->QM_BLD_MSG2, EV_IS_REKEY-->QM_BLD_MSG2, EV_CONFIRM_SA-->QM_BLD_MSG2, EV_PROC_MSG-->QM_BLD_MSG2, EV_HASH_OK-->QM_BLD_MSG2, NullEvent-->QM_BLD_MSG2, EV_COMP_HASH
Jan 24 11:01:35 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, sending delete/delete with reason message
Jan 24 11:01:35 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, Removing peer from correlator table failed, no match!
Jan 24 11:01:35 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, IKE SA MM:e260abc8 rcv'd Terminate: state MM_ACTIVE  flags 0x00000042, refcnt 1, tuncnt 0
Jan 24 11:01:35 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, IKE SA MM:e260abc8 terminating:  flags 0x01000002, refcnt 0, tuncnt 0
Jan 24 11:01:35 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, sending delete/delete with reason message
Jan 24 11:01:35 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, constructing blank hash payload
Jan 24 11:01:35 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, constructing IKE delete payload
Jan 24 11:01:35 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, constructing qm hash payload
Jan 24 11:01:35 [IKEv1]: IP = 95.24.254.251, IKE_DECODE SENDING Message (msgid=80e69a1) with payloads : HDR + HASH (8) + DELETE (12) + NONE (0) total length : 80
Jan 24 11:01:36 [IKEv1]: IP = 95.24.254.251, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 384
Jan 24 11:01:36 [IKEv1 DEBUG]: IP = 95.24.254.251, processing SA payload
Jan 24 11:01:36 [IKEv1 DEBUG]: IP = 95.24.254.251, Oakley proposal is acceptable
Jan 24 11:01:36 [IKEv1 DEBUG]: IP = 95.24.254.251, processing VID payload
Jan 24 11:01:36 [IKEv1 DEBUG]: IP = 95.24.254.251, processing VID payload
Jan 24 11:01:36 [IKEv1 DEBUG]: IP = 95.24.254.251, Received NAT-Traversal RFC VID
Jan 24 11:01:36 [IKEv1 DEBUG]: IP = 95.24.254.251, processing VID payload
Jan 24 11:01:36 [IKEv1 DEBUG]: IP = 95.24.254.251, Received NAT-Traversal ver 02 VID
Jan 24 11:01:36 [IKEv1 DEBUG]: IP = 95.24.254.251, processing VID payload
Jan 24 11:01:36 [IKEv1 DEBUG]: IP = 95.24.254.251, Received Fragmentation VID
Jan 24 11:01:36 [IKEv1 DEBUG]: IP = 95.24.254.251, processing VID payload
Jan 24 11:01:36 [IKEv1 DEBUG]: IP = 95.24.254.251, processing VID payload
Jan 24 11:01:36 [IKEv1 DEBUG]: IP = 95.24.254.251, processing VID payload
Jan 24 11:01:36 [IKEv1 DEBUG]: IP = 95.24.254.251, processing IKE SA payload
Jan 24 11:01:36 [IKEv1 DEBUG]: IP = 95.24.254.251, IKE SA Proposal # 1, Transform # 5 acceptable  Matches global IKE entry # 7
Jan 24 11:01:36 [IKEv1 DEBUG]: IP = 95.24.254.251, constructing ISAKMP SA payload
Jan 24 11:01:36 [IKEv1 DEBUG]: IP = 95.24.254.251, constructing NAT-Traversal VID ver 02 payload
Jan 24 11:01:36 [IKEv1 DEBUG]: IP = 95.24.254.251, constructing Fragmentation VID + extended capabilities payload
Jan 24 11:01:36 [IKEv1]: IP = 95.24.254.251, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 124
Jan 24 11:01:44 [IKEv1]: IP = 95.24.254.251, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 124
Jan 24 11:01:52 [IKEv1]: IP = 95.24.254.251, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 124
Jan 24 11:02:00 [IKEv1]: IP = 95.24.254.251, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 124
%PIX-3-713902: IP = 95.24.254.251, Removing peer from peer table failed, no match!
Jan 24 11:02:08 [IKEv1 DEBUG]: IP = 95.24.254.251, IKE MM Responder FSM error history (struct &0x35f96c0)  <state>, <event>:  MM_DONE, EV_ERROR-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent-->MM_SND_MSG2, EV_SND_MSG-->MM_SND_MSG2, EV_START_TMR-->MM_SND_MSG2, EV_RESEND_MSG-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent
Jan 24 11:02:08 [IKEv1 DEBUG]: IP = 95.24.254.251, IKE SA MM:32643119 terminating:  flags 0x01000002, refcnt 0, tuncnt 0
Jan 24 11:02:08 [IKEv1 DEBUG]: IP = 95.24.254.251, sending delete/delete with reason message
Jan 24 11:02:08 [IKEv1]: IP = 95.24.254.251, Removing peer from peer table failed, no match!
Jan 24 11:02:08 [IKEv1]: IP = 95.24.254.251, Error: Unable to remove PeerTblEntry

debug crypto ipsec при этом выдает тоже самое:

%PIX-3-713119: Group = DefaultRAGroup, IP = 95.24.254.251, PHASE 1 COMPLETED
%PIX-3-713122: IP = 95.24.254.251, Keep-alives configured on but peer does not support keep-alives (type = None)
%PIX-3-713902: Group = DefaultRAGroup, IP = 95.24.254.251, QM FSM error (P2 struct &0x2d445c0, mess id 0x1)!
%PIX-3-713902: Group = DefaultRAGroup, IP = 95.24.254.251, Removing peer from correlator table failed, no match!

Через android пробовал подключаться, вроде лучше, но все равно не подключает
debug crypto ipsec

%PIX-3-713119: Group = DefaultRAGroup, IP = 83.149.9.16, PHASE 1 COMPLETED
IPSEC: New embryonic SA created @ 0x03479028,
    SCB: 0x027A7AF0,
    Direction: inbound
    SPI      : 0x678D8C87
    Session ID: 0x00000234
    VPIF num  : 0x00000001
    Tunnel type: ra
    Protocol   : esp
    Lifetime   : 240 seconds
IPSEC: New embryonic SA created @ 0x034B2EF8,
    SCB: 0x02D030F0,
    Direction: outbound
    SPI      : 0x00674805
    Session ID: 0x00000234
    VPIF num  : 0x00000001
    Tunnel type: ra
    Protocol   : esp
    Lifetime   : 240 seconds
IPSEC: Completed host OBSA update, SPI 0x00674805
IPSEC: Creating outbound VPN context, SPI 0x00674805
    Flags: 0x00000225
    SA   : 0x034B2EF8
    SPI  : 0x00674805
    MTU  : 1500 bytes
    VCID : 0x00000000
    Peer : 0x00000000
    SCB  : 0x02D030F0
    Channel: 0x01765858
IPSEC: Completed outbound VPN context, SPI 0x00674805
    VPN handle: 0x01964BF4
IPSEC: New outbound encrypt rule, SPI 0x00674805
    Src addr: 193.106.72.5
    Src mask: 255.255.255.255
    Dst addr: 83.149.9.16
    Dst mask: 255.255.255.255
    Src ports
      Upper: 1701
      Lower: 1701
      Op   : equal
    Dst ports
      Upper: 3427
      Lower: 3427
      Op   : equal
    Protocol: 17
    Use protocol: true
    SPI: 0x00000000
    Use SPI: false
IPSEC: Completed outbound encrypt rule, SPI 0x00674805
    Rule ID: 0x0352DA90
IPSEC: New outbound permit rule, SPI 0x00674805
    Src addr: 193.106.72.5
    Src mask: 255.255.255.255
    Dst addr: 83.149.9.16
    Dst mask: 255.255.255.255
    Src ports
      Upper: 4500
      Lower: 4500
      Op   : equal
    Dst ports
      Upper: 3427
      Lower: 3427
      Op   : equal
    Protocol: 17
    Use protocol: true
    SPI: 0x00000000
    Use SPI: false
IPSEC: Completed outbound permit rule, SPI 0x00674805
    Rule ID: 0x036FC3E8
IPSEC: Completed host IBSA update, SPI 0x678D8C87
IPSEC: Creating inbound VPN context, SPI 0x678D8C87
    Flags: 0x00000226
    SA   : 0x03479028
    SPI  : 0x678D8C87
    MTU  : 0 bytes
    VCID : 0x00000000
    Peer : 0x01964BF4
    SCB  : 0x027A7AF0
    Channel: 0x01765858
IPSEC: Completed inbound VPN context, SPI 0x678D8C87
    VPN handle: 0x0196B614
IPSEC: Updating outbound VPN context 0x01964BF4, SPI 0x00674805
    Flags: 0x00000225
    SA   : 0x034B2EF8
    SPI  : 0x00674805
    MTU  : 1500 bytes
    VCID : 0x00000000
    Peer : 0x0196B614
    SCB  : 0x02D030F0
    Channel: 0x01765858
IPSEC: Completed outbound VPN context, SPI 0x00674805
    VPN handle: 0x01964BF4
IPSEC: Completed outbound inner rule, SPI 0x00674805
    Rule ID: 0x0352DA90
IPSEC: Completed outbound outer SPD rule, SPI 0x00674805
    Rule ID: 0x036FC3E8
IPSEC: New inbound tunnel flow rule, SPI 0x678D8C87
    Src addr: 83.149.9.16
    Src mask: 255.255.255.255
    Dst addr: 193.106.72.5
    Dst mask: 255.255.255.255
    Src ports
      Upper: 0
      Lower: 0
      Op   : ignore
    Dst ports
      Upper: 1701
      Lower: 1701
      Op   : equal
    Protocol: 17
    Use protocol: true
    SPI: 0x00000000
    Use SPI: false
IPSEC: Completed inbound tunnel flow rule, SPI 0x678D8C87
    Rule ID: 0x02BDCD08
IPSEC: New inbound decrypt rule, SPI 0x678D8C87
    Src addr: 83.149.9.16
    Src mask: 255.255.255.255
    Dst addr: 193.106.72.5
    Dst mask: 255.255.255.255
    Src ports
      Upper: 3427
      Lower: 3427
      Op   : equal
    Dst ports
      Upper: 4500
      Lower: 4500
      Op   : equal
    Protocol: 17
    Use protocol: true
    SPI: 0x00000000
    Use SPI: false
IPSEC: Completed inbound decrypt rule, SPI 0x678D8C87
    Rule ID: 0x032090F8
IPSEC: New inbound permit rule, SPI 0x678D8C87
    Src addr: 83.149.9.16
    Src mask: 255.255.255.255
    Dst addr: 193.106.72.5
    Dst mask: 255.255.255.255
    Src ports
      Upper: 3427
      Lower: 3427
      Op   : equal
    Dst ports
      Upper: 4500
      Lower: 4500
      Op   : equal
    Protocol: 17
    Use protocol: true
    SPI: 0x00000000
    Use SPI: false
IPSEC: Completed inbound permit rule, SPI 0x678D8C87
    Rule ID: 0x0356CF48

IPSEC: Deleted inbound decrypt rule, SPI 0x678D8C87
    Rule ID: 0x032090F8
IPSEC: Deleted inbound permit rule, SPI 0x678D8C87
    Rule ID: 0x0356CF48
IPSEC: Deleted inbound tunnel flow rule, SPI 0x678D8C87
    Rule ID: 0x02BDCD08
IPSEC: Deleted inbound VPN context, SPI 0x678D8C87
    VPN handle: 0x0196B614
IPSEC: Deleted outbound encrypt rule, SPI 0x00674805
    Rule ID: 0x0352DA90
IPSEC: Deleted outbound permit rule, SPI 0x00674805
    Rule ID: 0x036FC3E8
IPSEC: Deleted outbound VPN context, SPI 0x00674805
    VPN handle: 0x01964BF4

А по пункту 2 я не очень понял почему так происходит, что посоветуете? При подключении через смартфон такой дебаг такое не выдает

"Проблема с настройкой L2TP на PIX 515"
Отправлено don_kuklachev , 24-Янв-13 12:00 
>>2.ipsec sa не совпадает:

Jan 23 13:59:56 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, All IPSec
SA proposals found unacceptable!

с этим разобрался -добавил еще один transform-set esp-3des esp-sha-hmac

Винда стала выдавать 691 ошибку - пароль конечно верный.

Debug crypto ipsec
%PIX-3-713119: Group = DefaultRAGroup, IP = 95.24.254.251, PHASE 1 COMPLETED
%PIX-3-713122: IP = 95.24.254.251, Keep-alives configured on but peer does not support keep-alives (type = None)
IPSEC: New embryonic SA created @ 0x0396CCA8,
    SCB: 0x02D0ADE8,
    Direction: inbound
    SPI      : 0xD661ABA1
    Session ID: 0x00000246
    VPIF num  : 0x00000001
    Tunnel type: ra
    Protocol   : esp
    Lifetime   : 240 seconds
IPSEC: New embryonic SA created @ 0x03479028,
    SCB: 0x030E8618,
    Direction: outbound
    SPI      : 0xB620C9AD
    Session ID: 0x00000246
    VPIF num  : 0x00000001
    Tunnel type: ra
    Protocol   : esp
    Lifetime   : 240 seconds
IPSEC: Completed host OBSA update, SPI 0xB620C9AD
IPSEC: Creating outbound VPN context, SPI 0xB620C9AD
    Flags: 0x00000225
    SA   : 0x03479028
    SPI  : 0xB620C9AD
    MTU  : 1500 bytes
    VCID : 0x00000000
    Peer : 0x00000000
    SCB  : 0x030E8618
    Channel: 0x01765858
IPSEC: Completed outbound VPN context, SPI 0xB620C9AD
    VPN handle: 0x019C6F14
IPSEC: New outbound encrypt rule, SPI 0xB620C9AD
    Src addr: 193.106.72.5
    Src mask: 255.255.255.255
    Dst addr: 95.24.254.251
    Dst mask: 255.255.255.255
    Src ports
      Upper: 1701
      Lower: 1701
      Op   : equal
    Dst ports
      Upper: 4500
      Lower: 4500
      Op   : equal
    Protocol: 17
    Use protocol: true
    SPI: 0x00000000
    Use SPI: false
IPSEC: Completed outbound encrypt rule, SPI 0xB620C9AD
    Rule ID: 0x02AA2638
IPSEC: New outbound permit rule, SPI 0xB620C9AD
    Src addr: 193.106.72.5
    Src mask: 255.255.255.255
    Dst addr: 95.24.254.251
    Dst mask: 255.255.255.255
    Src ports
      Upper: 4500
      Lower: 4500
      Op   : equal
    Dst ports
      Upper: 4500
      Lower: 4500
      Op   : equal
    Protocol: 17
    Use protocol: true
    SPI: 0x00000000
    Use SPI: false
IPSEC: Completed outbound permit rule, SPI 0xB620C9AD
    Rule ID: 0x033DB2C8
IPSEC: Completed host IBSA update, SPI 0xD661ABA1
IPSEC: Creating inbound VPN context, SPI 0xD661ABA1
    Flags: 0x00000226
    SA   : 0x0396CCA8
    SPI  : 0xD661ABA1
    MTU  : 0 bytes
    VCID : 0x00000000
    Peer : 0x019C6F14
    SCB  : 0x02D0ADE8
    Channel: 0x01765858
IPSEC: Completed inbound VPN context, SPI 0xD661ABA1
    VPN handle: 0x019CAAB4
IPSEC: Updating outbound VPN context 0x019C6F14, SPI 0xB620C9AD
    Flags: 0x00000225
    SA   : 0x03479028
    SPI  : 0xB620C9AD
    MTU  : 1500 bytes
    VCID : 0x00000000
    Peer : 0x019CAAB4
    SCB  : 0x030E8618
    Channel: 0x01765858
IPSEC: Completed outbound VPN context, SPI 0xB620C9AD
    VPN handle: 0x019C6F14
IPSEC: Completed outbound inner rule, SPI 0xB620C9AD
    Rule ID: 0x02AA2638
IPSEC: Completed outbound outer SPD rule, SPI 0xB620C9AD
    Rule ID: 0x033DB2C8
IPSEC: New inbound tunnel flow rule, SPI 0xD661ABA1
    Src addr: 95.24.254.251
    Src mask: 255.255.255.255
    Dst addr: 193.106.72.5
    Dst mask: 255.255.255.255
    Src ports
      Upper: 0
      Lower: 0
      Op   : ignore
    Dst ports
      Upper: 1701
      Lower: 1701
      Op   : equal
    Protocol: 17
    Use protocol: true
    SPI: 0x00000000
    Use SPI: false
IPSEC: Completed inbound tunnel flow rule, SPI 0xD661ABA1
    Rule ID: 0x035910D0
IPSEC: New inbound decrypt rule, SPI 0xD661ABA1
    Src addr: 95.24.254.251
    Src mask: 255.255.255.255
    Dst addr: 193.106.72.5
    Dst mask: 255.255.255.255
    Src ports
      Upper: 4500
      Lower: 4500
      Op   : equal
    Dst ports
      Upper: 4500
      Lower: 4500
      Op   : equal
    Protocol: 17
    Use protocol: true
    SPI: 0x00000000
    Use SPI: false
IPSEC: Completed inbound decrypt rule, SPI 0xD661ABA1
    Rule ID: 0x03537120
IPSEC: New inbound permit rule, SPI 0xD661ABA1
    Src addr: 95.24.254.251
    Src mask: 255.255.255.255
    Dst addr: 193.106.72.5
    Dst mask: 255.255.255.255
    Src ports
      Upper: 4500
      Lower: 4500
      Op   : equal
    Dst ports
      Upper: 4500
      Lower: 4500
      Op   : equal
    Protocol: 17
    Use protocol: true
    SPI: 0x00000000
    Use SPI: false
IPSEC: Completed inbound permit rule, SPI 0xD661ABA1
    Rule ID: 0x029F87E8
IPSEC: Deleted inbound decrypt rule, SPI 0xD661ABA1
    Rule ID: 0x03537120
IPSEC: Deleted inbound permit rule, SPI 0xD661ABA1
    Rule ID: 0x029F87E8
IPSEC: Deleted inbound tunnel flow rule, SPI 0xD661ABA1
    Rule ID: 0x035910D0
IPSEC: Deleted inbound VPN context, SPI 0xD661ABA1
    VPN handle: 0x019CAAB4
IPSEC: Deleted outbound encrypt rule, SPI 0xB620C9AD
    Rule ID: 0x02AA2638
IPSEC: Deleted outbound permit rule, SPI 0xB620C9AD
    Rule ID: 0x033DB2C8
IPSEC: Deleted outbound VPN context, SPI 0xB620C9AD
    VPN handle: 0x019C6F14

"Проблема с настройкой L2TP на PIX 515"
Отправлено spiegel , 24-Янв-13 17:48 
>[оверквотинг удален]
> IPSEC: Deleted inbound tunnel flow rule, SPI 0xD661ABA1
>     Rule ID: 0x035910D0
> IPSEC: Deleted inbound VPN context, SPI 0xD661ABA1
>     VPN handle: 0x019CAAB4
> IPSEC: Deleted outbound encrypt rule, SPI 0xB620C9AD
>     Rule ID: 0x02AA2638
> IPSEC: Deleted outbound permit rule, SPI 0xB620C9AD
>     Rule ID: 0x033DB2C8
> IPSEC: Deleted outbound VPN context, SPI 0xB620C9AD
>     VPN handle: 0x019C6F14

проверил ваш конфиг на GNS3. Вначале не пошло, но после:

username igor password cisco  mschap

все заработало!

Проверял на XP, на 7 не работает. Также надо отключить службу cisco vpn client, если он конечно установлен.

"Проблема с настройкой L2TP на PIX 515"
Отправлено don_kuklachev , 24-Янв-13 17:57 
>[оверквотинг удален]
>>     Rule ID: 0x02AA2638
>> IPSEC: Deleted outbound permit rule, SPI 0xB620C9AD
>>     Rule ID: 0x033DB2C8
>> IPSEC: Deleted outbound VPN context, SPI 0xB620C9AD
>>     VPN handle: 0x019C6F14
> проверил ваш конфиг на GNS3. Вначале не пошло, но после:
> username igor password cisco  mschap
> все заработало!
> Проверял на XP, на 7 не работает. Также надо отключить службу cisco
> vpn client, если он конечно установлен.

Благодарю, час назад тоже разобрался- достаточно было добавить mschap к логину)


"Проблема с настройкой L2TP на PIX 515"
Отправлено don_kuklachev , 24-Янв-13 17:58 
>[оверквотинг удален]
>>> IPSEC: Deleted outbound permit rule, SPI 0xB620C9AD
>>>     Rule ID: 0x033DB2C8
>>> IPSEC: Deleted outbound VPN context, SPI 0xB620C9AD
>>>     VPN handle: 0x019C6F14
>> проверил ваш конфиг на GNS3. Вначале не пошло, но после:
>> username igor password cisco  mschap
>> все заработало!
>> Проверял на XP, на 7 не работает. Также надо отключить службу cisco
>> vpn client, если он конечно установлен.
> Благодарю, час назад тоже разобрался- достаточно было добавить mschap к логину)

на андроиде тоже полет нормальный

"Проблема с настройкой L2TP на PIX 515"
Отправлено don_kuklachev , 24-Янв-13 18:10 
>[оверквотинг удален]
>>     Rule ID: 0x035910D0
>> IPSEC: Deleted inbound VPN context, SPI 0xD661ABA1
>>     VPN handle: 0x019CAAB4
>> IPSEC: Deleted outbound encrypt rule, SPI 0xB620C9AD
>>     Rule ID: 0x02AA2638
>> IPSEC: Deleted outbound permit rule, SPI 0xB620C9AD
>>     Rule ID: 0x033DB2C8
>> IPSEC: Deleted outbound VPN context, SPI 0xB620C9AD
>>     VPN handle: 0x019C6F14
> проверил ваш конфиг на GNS3. Вначале не пошло, но после:

А как вы собрали такую схему в gns, поделитесь? PIX-router-cloud?


"Проблема с настройкой L2TP на PIX 515"
Отправлено spiegel , 24-Янв-13 18:35 
>[оверквотинг удален]
>>> IPSEC: Deleted inbound VPN context, SPI 0xD661ABA1
>>>     VPN handle: 0x019CAAB4
>>> IPSEC: Deleted outbound encrypt rule, SPI 0xB620C9AD
>>>     Rule ID: 0x02AA2638
>>> IPSEC: Deleted outbound permit rule, SPI 0xB620C9AD
>>>     Rule ID: 0x033DB2C8
>>> IPSEC: Deleted outbound VPN context, SPI 0xB620C9AD
>>>     VPN handle: 0x019C6F14
>> проверил ваш конфиг на GNS3. Вначале не пошло, но после:
> А как вы собрали такую схему в gns, поделитесь? PIX-router-cloud?

pix-host(vmnet1). vmnet1 - адаптер от VMWare, к нему подключен WinXP на виртуалке.

"Проблема с настройкой L2TP на PIX 515"
Отправлено spiegel , 24-Янв-13 18:39 
>[оверквотинг удален]
>>>>     VPN handle: 0x019CAAB4
>>>> IPSEC: Deleted outbound encrypt rule, SPI 0xB620C9AD
>>>>     Rule ID: 0x02AA2638
>>>> IPSEC: Deleted outbound permit rule, SPI 0xB620C9AD
>>>>     Rule ID: 0x033DB2C8
>>>> IPSEC: Deleted outbound VPN context, SPI 0xB620C9AD
>>>>     VPN handle: 0x019C6F14
>>> проверил ваш конфиг на GNS3. Вначале не пошло, но после:
>> А как вы собрали такую схему в gns, поделитесь? PIX-router-cloud?
> pix-host(vmnet1). vmnet1 - адаптер от VMWare, к нему подключен WinXP на виртуалке.

точнее pix-switch-host. Напрямую не разрешает.