Новые ответы

Не поднмается VPN между Cisco ASA 5550 и Allied Telesyn AR77...,

jeka64, 24-Июн-09, 09:02 [смотреть все]

   Здравствуйте!
   У меня такая проблема. Есть Allied Telesyn AR770S и Cisco ASA 5550. Между ними необходимо построить VPN.
   VPN между ASA5550 и Cisco851 с аналогичными настройками работает замечательно, а вот между ASA5550 и AR770S ни в какую. Пожалуйста, помогите разобраться.
   Конфиг ASA 5550:
access-list VLAN604_cryptomap_1 extended permit ip zzz.zzz.0.0 255.255.0.0 yyy.yyy.16.0 255.255.252.0
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto map VLAN604_map 1 match address VLAN604_cryptomap_1
crypto map VLAN604_map 1 set peer xxx.xxx.xxx.9
crypto map VLAN604_map 1 set transform-set ESP-DES-MD5
crypto map VLAN604_map 1 set security-association lifetime seconds 600
crypto map VLAN604_map 1 set nat-t-disable
crypto map VLAN604_map interface VLAN604
crypto isakmp identity key-id 12
crypto isakmp enable VLAN604
crypto isakmp policy 5
authentication pre-share
encryption des
hash md5
group 1
lifetime 600
no crypto isakmp nat-traversal
   Конфиг AR770S:
# IPSEC configuration
create ipsec sas=1 key=isakmp prot=esp enc=des hasha=md5
create ipsec bund=1 key=isakmp string="1"
create ipsec pol="OZC" int=eth0 ac=ipsec key=isakmp bund=1 peer=xxx.xxx.xxx.40
set ipsec pol="OZC" lad=yyy.yyy.16.0 lma=255.255.252.0 rad=zzz.zzz.0.0 rma=255.255.0.0
create ipsec pol="INTERNET" int=eth0 ac=permit
enable ipsec
# ISAKMP configuration
create isakmp pol="OZC" pe=xxx.xxx.xxx.40 key=3
set isakmp pol="OZC" expirys=600
enable isakmp
>sh enco key=3
0x3132
12
IP Address:
-

   debug на ASA 5550:
Jun 24 08:47:28 [IKEv1]: Group = DefaultL2LGroup, IP = xxx.xxx.xxx.9, Removing peer from peer table failed, no match!
Jun 24 08:47:28 [IKEv1]: Group = DefaultL2LGroup, IP = xxx.xxx.xxx.9, Error: Unable to remove PeerTblEntry
   debug на AR770S:
24 08:45:47 3 ISAK IKMP XCHG Exchange 12593: MAIN Phase 1 [init] started with
peer xxx.xxx.xxx.40 local xxx.xxx.xxx.9 Cookie_I
c957d0e70f4e1b89 Cookie_R 0000000000000000
24 08:45:47 3 ISAK IKMP XCHG Exchange 12593: Invalid id information
24 08:45:47 3 ISAK IKMP XCHG Exchange 12593: Failed.

Ответить | Сообщить модератору

Не поднмается VPN между Cisco ASA 5550 и Allied Telesyn AR77..., jeka64, 12:56 , 24-Июн-09 (1)
Сейчас настроил VPN между Cisco 2811 и Allied Telesyn. Все работает. Где же ошибка в конфиге Cisco ASA?
Судя по логам они немогут пройти 1 фазу.
sh isakmp sa detail
SA Id ................................. 2
  Initiator Cookie .................... 54dbfd5ff9e4ae22
  Responder Cookie .................... 0000000000000000
  DOI ................................. IPSEC
  Policy name ......................... OZC
  State ............................... DOING_PHASE1
  Local address ....................... xxx.xxx.xxx.9
  Remote Address ...................... xxx.xxx.xxx.40
  Remote Port ......................... 500
  Time of establishment ............... **-***-****:**:**:**
  Commit bit set ...................... FALSE
  Send notifies ....................... FALSE
  Send deletes ........................ FALSE
  Always send ID ...................... FALSE
  Message Retry Limit ................. 8
  Initial Message Retry Timeout (s) ... 4
  Message Back-off .................... Incremental
  Exchange Delete Delay (s) ........... 30
  Do Xauth ............................ FALSE
    Xauth Finished .................... TRUE
  Expiry Limit (bytes) ................ 0
  Soft Expiry Limit (bytes) ........... 0
  Bytes seen .......................... 0
  Expiry Limit (seconds) .............. 0
  Soft Expiry Limit (seconds) ......... 0
  Seconds since creation .............. 0
  Number of Phase 2 exchanges allowed . 4294967294
  Number of acquires queued ........... 1
Sa Definition Information:
  Authentication Type ................. INVALID
  Encryption Algorithm ................ INVALID
  Hash Algorithm ...................... INVALID
  group Type .......................... INVALID
  group Description ................... MODP512
  DH Private Exponent Bits ............ 160
  expiry seconds ...................... 0
  expiry kilobytes .................... 0
XAuth Information:
  Id .................................. 0
  Next Message ........................ UNKNOWN
  Status .............................. FAIL
  Type ................................ Generic
  Max Failed Attempts.................. 0
  Failed Attempts...................... 0
NAT-Traversal Information:
  NAT-T enabled ....................... NO
  Peer NAT-T capable .................. NO
  NAT discovered ...................... UNKNOWN
Heartbeat Information:
  Send Heartbeats ..................... NO
  Next sequence number tx ............. 1
  Receive Heartbeats .................. NO
  Last sequence number rx ............. 0
Ответить | Сообщить модератору

Не поднмается VPN между Cisco ASA 5550 и Allied Telesyn AR77..., jeka64, 09:25 , 25-Июн-09 (2)
А еще не понятно вот что.
sh crypto isakmp sa detail
   Active SA: 1
   Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
Total IKE SA: 1
1   IKE Peer: 10.13.1.9
    Type    : user            Role    : initiator
    Rekey   : no              State   : MM_WAIT_MSG2
    Encrypt : aes-256         Hash    : SHA
    Auth    : preshared       Lifetime: 0
Почему aes-256? Ведь в конфиге прописано des.
Ответить | Сообщить модератору