Добрый день.
Настроил тунель PIX <=> D-Link DI-804HV.D-Link DI-804HV
IKE: Group2 3DES MD5 86400
IPSec: Group2 ESP 3DES None 28800
PIX 515
ip address outside Y.Y.Y.214 255.255.255.252
crypto ipsec transform-set vpn_novo esp-des esp-md5-hmac
crypto ipsec security-association lifetime seconds 3600 kilobytes 400000
crypto map map_vpn 10 ipsec-isakmp
crypto map map_vpn 10 match address novo
crypto map map_vpn 10 set pfs group2
crypto map map_vpn 10 set peer Х.Х.Х.103
crypto map map_vpn 10 set transform-set vpn_novo
crypto map map_vpn interface outside
isakmp enable outside
isakmp key ******** address Х.Х.Х.103 netmask 255.255.255.255
isakmp identity address
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption 3des
isakmp policy 10 hash md5
isakmp policy 10 group 2
isakmp policy 10 lifetime 7200
А дальше начинаетса всё самое интересное, в зависимости от инициатора соединения
тунель ведёт себя по разному. В случае когда инициатором выступает PIX
PIX log:
ISAKMP (0): beginning Main Mode exchange
crypto_isakmp_process_block:src:Х.Х.Х.103, dest:Y.Y.Y.214 spt:500 dpt:500
OAK_MM exchange
ISAKMP (0): processing SA payload. message ID = 0
ISAKMP (0): Checking ISAKMP transform 1 against priority 10 policy
ISAKMP: encryption 3DES-CBC
ISAKMP: hash MD5
ISAKMP: auth pre-share
ISAKMP: default group 2
ISAKMP: life type in seconds
ISAKMP: life duration (VPI) of 0x0 0x0 0x1c 0x20
ISAKMP (0): atts are acceptable. Next payload is 0
ISAKMP (0): SA is doing pre-shared key authentication using id type ID_IPV4_ADDR
return status is IKMP_NO_ERROR
crypto_isakmp_process_block:src:Х.Х.Х.103, dest:Y.Y.Y.214 spt:500 dpt:500
OAK_MM exchange
ISAKMP (0): processing KE payload. message ID = 0
ISAKMP (0): processing NONCE payload. message ID = 0
ISAKMP (0): ID payload
next-payload : 8
type : 1
protocol : 17
port : 500
length : 8
ISAKMP (0): Total payload length: 12
return status is IKMP_NO_ERROR
crypto_isakmp_process_block:src:Х.Х.Х.103, dest:Y.Y.Y.214 spt:500 dpt:500
OAK_MM exchange
ISAKMP (0): processing ID payload. message ID = 0
ISAKMP (0): processing HASH payload. message ID = 0
ISAKMP (0): SA has been authenticated
ISAKMP (0): beginning Quick Mode exchange, M-ID of
2052341857:7a544061IPSEC(key_engine): got a queue event...
IPSEC(spi_response): getting spi 0xd8f8fa52(3640195666) for SA
from Х.Х.Х.103 to Y.Y.Y.214 for prot 3
return status is IKMP_NO_ERROR
ISAKMP (0): sending INITIAL_CONTACT notify
ISAKMP (0): sending NOTIFY message 24578 protocol 1
VPN Peer: ISAKMP: Added new peer: ip:Х.Х.Х.103/500 Total VPN Peers:1
VPN Peer: ISAKMP: Peer ip:Х.Х.Х.103/500 Ref cnt incremented to:1 Total VPN Peers:1
ISAKMP (0): retransmitting phase 2 (0/0)... mess_id 0x7a544061
ISAKMP (0): retransmitting phase 2 (1/0)... mess_id 0x7a544061
ISAKMP (0): retransmitting phase 2 (2/0)... mess_id 0x7a544061
ISAKMP (0): retransmitting phase 2 (3/0)... mess_id 0x7a544061
ISAKMP (0): retransmitting phase 2 (4/0)... mess_id 0x7a544061IPSEC(key_engine): request
timer fired: count = 1,
(identity) local= Y.Y.Y.214, remote= Х.Х.Х.103,
local_proxy= 10.10.20.0/255.255.255.0/0/0 (type=4),
remote_proxy= 10.10.27.0/255.255.255.0/0/0 (type=4)
ISAKMP (0): beginning Quick Mode exchange, M-ID of
-1676206450:9c171e8eIPSEC(key_engine): got a queue event...
IPSEC(spi_response): getting spi 0xab499acf(2873727695) for SA
from Х.Х.Х.103 to Y.Y.Y.214 for prot 3
ISAKMP (0): retransmitting phase 2 (5/0)... mess_id 0x7a544061
.....
ISAKMP (0): retransmitting phase 2 (4/0)... mess_id 0x9c171e8e
ISAKMP (0): retransmitting phase 2 (10/0)... mess_id 0x7a544061IPSEC(key_engine): request
timer fired: count = 2,
(identity) local= Y.Y.Y.214, remote= Х.Х.Х.103,
local_proxy= 10.10.20.0/255.255.255.0/0/0 (type=4),
remote_proxy= 10.10.27.0/255.255.255.0/0/0 (type=4)
ISAKMP (0): retransmitting phase 2 (5/1)... mess_id 0x9c171e8e
ISAKMP (0): retransmitting phase 2 (6/1)... mess_id 0x9c171e8e
DI-804HV log:
15:53:50 Send IKE (INFO) : delete X.X.X.103 -> Y.Y.Y.214 phase 1
15:53:50 IKE phase1 (ISAKMP SA) remove : X.X.X.103 <-> Y.Y.Y.214
15:53:21 Requested routing is [10.10.20.0|Y.Y.Y.214]<->[X.X.X.103|10.10.27.0]
15:53:21 Try to match ESP with MODE:Tunnel PROTOCAL:ESP-DES AUTH:MD5 HASH:Others
PFS(Group):Group2
15:53:25 Receive IKE Q1(QINIT) : [Y.Y.Y.214]-->[X.X.X.103]
15:53:25 Requested routing is [10.10.20.0|Y.Y.Y.214]<->[X.X.X.103|10.10.27.0]
15:53:25 Try to match ESP with MODE:Tunnel PROTOCAL:ESP-DES AUTH:MD5 HASH:Others
PFS(Group):Group2
15:53:30 Receive IKE Q1(QINIT) : [Y.Y.Y.214]-->[X.X.X.103]
15:53:30 Requested routing is [10.10.20.0|Y.Y.Y.214]<->[X.X.X.103|10.10.27.0]
15:53:30 Try to match ESP with MODE:Tunnel PROTOCAL:ESP-DES AUTH:MD5 HASH:Others
PFS(Group):Group2
15:53:36 Receive IKE Q1(QINIT) : [Y.Y.Y.214]-->[X.X.X.103]
15:53:36 Requested routing is [10.10.20.0|Y.Y.Y.214]<->X.X.X.103|10.10.27.0]
Подскажите где я мог допустить ошибку.
Благодарен.
О инициации тунеля оборудованием Д-Линк, напишу вторым сообщением.
Вариант для распечатки
Маршрутизаторы CISCO и др. оборудование. (Public)
(??) on 25-Июл-06, 10:13 
