OpenForum RSS: �� VPN IPSec tunnel �� CISCO 2821 � Linux

�� VPN IPSec tunnel �� CISCO 2821 � Linux (lesha4ever)

Thu, 23 Jul 2009 14:44:52 GMT

>[�� ]
>64 bytes from X.X.X.X: icmp_seq=5 ttl=255 time=0.859 ms
>64 bytes from X.X.X.X: icmp_seq=6 ttl=255 time=0.965 ms
>64 bytes from X.X.X.X: icmp_seq=7 ttl=255 time=0.868 ms
>64 bytes from X.X.X.X: icmp_seq=8 ttl=255 time=0.821 ms
>64 bytes from X.X.X.X: icmp_seq=9 ttl=255 time=0.926 ms
>
>��
>
>� �� , �� -
>� �� ...

�� - �� ))). �� ... �� ...

��
amkbailey:
AT&T finally got the DSL up and running. Turns out the problem was caused by another tunnel's ACL that I added before this one. That tunnel wasn't needed anymore so I deleted the tunnel and applicable ACL's for it and the new tunnel started working.

�� VPN IPSec tunnel �� CISCO 2821 � Linux (lesha4ever)

Thu, 23 Jul 2009 13:59:36 GMT

>[�� ]
>>Jul 23 15:41:30 10.1.1.1 174242: 122296: Jul 23 14:41:29.881 PCTime: ISAKMP:(0:7:SW:1): phase
>>2 SA policy not acceptable! (local Y.Y.Y.Y rem
>>ote X.X.X.X)
>
>��!!
>
>� �� 0 � ��1 . ��
>�� , �� . � ��
>��0 �� destinaton X.X.X.X , �� .
>�� - � �� )))

�� . �� . ��
[root@mon]~# ping 10.1.1.1
PING 10.1.1.1 (10.1.1.1) 56(84) bytes of data.
64 bytes from X.X.X.X: icmp_seq=1 ttl=255 time=1.21 ms
64 bytes from X.X.X.X: icmp_seq=2 ttl=255 time=0.897 ms
64 bytes from X.X.X.X: icmp_seq=3 ttl=255 time=0.899 ms
64 bytes from X.X.X.X: icmp_seq=4 ttl=255 time=0.853 ms
64 bytes from X.X.X.X: icmp_seq=5 ttl=255 time=0.859 ms
64 bytes from X.X.X.X: icmp_seq=6 ttl=255 time=0.965 ms
64 bytes from X.X.X.X: icmp_seq=7 ttl=255 t

�� VPN IPSec tunnel �� CISCO 2821 � Linux (lesha4ever)

Thu, 23 Jul 2009 13:46:53 GMT

>[�� ]
>Jul 23 15:41:30 10.1.1.1 174239: 122293: Jul 23 14:41:29.881 PCTime: CryptoEngine0: validate
>proposal request
>Jul 23 15:41:30 10.1.1.1 174240: 122294: Jul 23 14:41:29.881 PCTime: IPSEC(validate_transform_proposal): no
>IPSEC cryptomap exists for local addres
>s Y.Y.Y.Y
>Jul 23 15:41:30 10.1.1.1 174241: 122295: Jul 23 14:41:29.881 PCTime: ISAKMP:(0:7:SW:1): IPSec
>policy invalidated proposal
>Jul 23 15:41:30 10.1.1.1 174242: 122296: Jul 23 14:41:29.881 PCTime: ISAKMP:(0:7:SW:1): phase
>2 SA policy not acceptable! (local Y.Y.Y.Y rem
>ote X.X.X.X)

��!!

� �� 0 � ��1 . �� , �� . � �� 0 �� destinaton X.X.X.X , �� . �� - � �� )))

�� VPN IPSec tunnel �� CISCO 2821 � Linux (lesha4ever)

Thu, 23 Jul 2009 12:44:44 GMT

>[�� ]
>
>�� setkey
>��
>spdadd 172.16.2.0/24 172.16.1.0/24 any -P out ipsec
> ipcomp/transport//use
> esp/tunnel/1.2.3.5-1.2.3.4/require;
>
>� �� .
>
>�� ((((

� �� (� �� ). � ��

Jul 23 15:41:30 10.1.1.1 174239: 122293: Jul 23 14:41:29.881 PCTime: CryptoEngine0: validate proposal request
Jul 23 15:41:30 10.1.1.1 174240: 122294: Jul 23 14:41:29.881 PCTime: IPSEC(validate_transform_proposal): no IPSEC cryptomap exists for local addres
s Y.Y.Y.Y
Jul 23 15:41:30 10.1.1.1 174241: 122295: Jul 23 14:41:29.881 PCTime: ISAKMP:(0:7:SW:1): IPSec policy invalidated proposal
Jul 23 15:41:30 10.1.1.1 174242: 122296: Jul 23 14:41:29.881 PCTime: ISAKMP:(0:7:SW:1): phase 2 SA policy not acceptable! (local Y.Y.Y.Y rem
ote X.X.X.X)

�� VPN IPSec tunnel �� CISCO 2821 � Linux (lesha4ever)

Thu, 23 Jul 2009 08:53:38 GMT

>[�� ]
>>�� . � ��
>>�� . � ��
>>�� + �� + ��
>>�� , �� .
>
>�� , �� CISCO router 2800 ��
>�� compression_algorithm deflate;
>
>� �� . ��
>��. � �� , �� IP_COMPRESSION (COMP-LZS)

�� .�� .
�� setkey
��
spdadd 172.16.2.0/24 172.16.1.0/24 any -P out ipsec
ipcomp/transport//use
esp/tunnel/1.2.3.5-1.2.3.4/require;

� �� .

�� ((((

�� VPN IPSec tunnel �� CISCO 2821 � Linux (lesha4ever)

Thu, 23 Jul 2009 08:39:44 GMT

>[�� ]
>>>found.
>>>Jul 23 10:25:58 mon racoon: ERROR: Y.Y.Y.Y give up to get IPsec-SA
>>>due to time up to wait.
>>
>> �� Linux-�, �� openswan ��?
>
>�� . � ��
>�� . � ��
>�� + �� + ��
>�� , �� .

�� , �� CISCO router 2800 �� compression_algorithm deflate;

� �� . �� . � �� , �� IP_COMPRESSION (COMP-LZS)

�� VPN IPSec tunnel �� CISCO 2821 � Linux (lesha4ever)

Thu, 23 Jul 2009 07:49:03 GMT

>[�� ]
>>Jul 23 10:25:42 mon racoon: INFO: ISAKMP-SA established X.X.X.X[500]-Y.Y.Y.Y[500] spi:e7ccebec074add40:66341efea9e314
>>0a
>>Jul 23 10:25:42 mon racoon: ERROR: unknown Informational exchange received.
>>Jul 23 10:25:43 mon racoon: INFO: initiate new phase 2 negotiation: X.X.X.X[500]<=>Y.Y.Y.Y[500]
>>Jul 23 10:25:43 mon racoon: ERROR: unknown notify message, no phase2 handle
>>found.
>>Jul 23 10:25:58 mon racoon: ERROR: Y.Y.Y.Y give up to get IPsec-SA
>>due to time up to wait.
>
> �� Linux-�, �� openswan ��?

�� . � �� . � �� + �� + �� , �� .

�� VPN IPSec tunnel �� CISCO 2821 � Linux (GolDi)

Thu, 23 Jul 2009 07:44:43 GMT

>[�� ]
>Jul 23 10:25:42 mon racoon: INFO: received Vendor ID: DPD
>Jul 23 10:25:42 mon racoon: INFO: received Vendor ID: draft-ietf-ipsra-isakmp-xauth-06.txt
>Jul 23 10:25:42 mon racoon: INFO: ISAKMP-SA established X.X.X.X[500]-Y.Y.Y.Y[500] spi:e7ccebec074add40:66341efea9e314
>0a
>Jul 23 10:25:42 mon racoon: ERROR: unknown Informational exchange received.
>Jul 23 10:25:43 mon racoon: INFO: initiate new phase 2 negotiation: X.X.X.X[500]<=>Y.Y.Y.Y[500]
>Jul 23 10:25:43 mon racoon: ERROR: unknown notify message, no phase2 handle
>found.
>Jul 23 10:25:58 mon racoon: ERROR: Y.Y.Y.Y give up to get IPsec-SA
>due to time up to wait.

�� Linux-�, �� openswan ��?

�� VPN IPSec tunnel �� CISCO 2821 � Linux (lesha4ever)

Thu, 23 Jul 2009 07:28:47 GMT

>>>� �� dynamic-map?
>>>� � �� .
>>
>>� �� ? �� . �
>>�� .
>
>�� ....
>�� , �� , � �� , ��
>�� dynamic
>�� .

��.
�� . �� .

�� :
crypto isakmp policy 10
encr 3des
hash md5
authentication pre-share
group 2
lifetime 3600
!
crypto isakmp policy 20
encr 3des
authentication pre-share
group 2
!
crypto isakmp policy 30
encr 3des
hash md5
authentication pre-share
group 2
!
crypto isakmp key SECRETKEY1 address X.X.X.X
crypto isakmp key SECRETKEY2 address 0.0.0.0 0.0.0.0
!
!
crypto ipsec transform-set L2TP esp-3des esp-md5-hmac
mode transport
crypto ipsec transform-set L2TP_V ah-sha-hmac esp-3des esp-sha-hmac
mode transport
crypto ipsec transform-set SITE_TO_SITE esp-3des esp-md5-hmac
mode transport
!
crypto dynamic-m

OpenForum RSS: �� ���� ������� VPN IPSec tunnel ����� CISCO 2821 � Linux

�� ���� ������� VPN IPSec tunnel ����� CISCO 2821 � Linux (lesha4ever)

�� ���� ������� VPN IPSec tunnel ����� CISCO 2821 � Linux (lesha4ever)

�� ���� ������� VPN IPSec tunnel ����� CISCO 2821 � Linux (lesha4ever)

�� ���� ������� VPN IPSec tunnel ����� CISCO 2821 � Linux (lesha4ever)

�� ���� ������� VPN IPSec tunnel ����� CISCO 2821 � Linux (lesha4ever)

�� ���� ������� VPN IPSec tunnel ����� CISCO 2821 � Linux (lesha4ever)

�� ���� ������� VPN IPSec tunnel ����� CISCO 2821 � Linux (lesha4ever)

�� ���� ������� VPN IPSec tunnel ����� CISCO 2821 � Linux (GolDi)

�� ���� ������� VPN IPSec tunnel ����� CISCO 2821 � Linux (lesha4ever)

OpenForum RSS: �� VPN IPSec tunnel �� CISCO 2821 � Linux

�� VPN IPSec tunnel �� CISCO 2821 � Linux (lesha4ever)

�� VPN IPSec tunnel �� CISCO 2821 � Linux (lesha4ever)

�� VPN IPSec tunnel �� CISCO 2821 � Linux (lesha4ever)

�� VPN IPSec tunnel �� CISCO 2821 � Linux (lesha4ever)

�� VPN IPSec tunnel �� CISCO 2821 � Linux (lesha4ever)

�� VPN IPSec tunnel �� CISCO 2821 � Linux (lesha4ever)

�� VPN IPSec tunnel �� CISCO 2821 � Linux (lesha4ever)

�� VPN IPSec tunnel �� CISCO 2821 � Linux (GolDi)

�� VPN IPSec tunnel �� CISCO 2821 � Linux (lesha4ever)