Прошу помощи сообщества. VPN есть, а пингов нет !!!
В данный момент существует 3 филиала связанных между собой IPSEC реализованных на CentOS 5.5. Поставлена задача, в одном из филиалов заменить CentOS на Cisco2811.
Для настройки я сделал лабораторный стенд, следующей схемы
PC1 (192.168.1.1)<--->(192.168.1.2)CentOS(172.45.22.2)<---> (172.46.22.2)Cisco2811(192.168.2.2)<--->192.168.2.1PC
Таким образом, необходимо сделать IPSEC между сетью 192.168.1.0/24 и 192.168.2.0/24
Самая основная проблема заключается в том что конфиг racoon на CentOS желательно не изменять!!!
Вот такая простая с виду задача!!!
IPSEC поднимается с следующими конфигами
CISCO2811

crypto isakmp policy 30
encr 3des
authentication pre-share
group 2
lifetime 3600
crypto isakmp key test123 address 172.45.22.2
crypto isakmp keepalive 3600
!
crypto ipsec transform-set MyTransformSet ah-sha-hmac esp-3des esp-sha-hmac
!
crypto map outside_map_ipsec 30 ipsec-isakmp
description ===Tunnel to Moscow===
set peer 172.45.22.2
set transform-set MyTransformSet
set pfs group2
match address VPN-MOSCOW
!
interface FastEthernet0/0
description ===WAN===
ip address 172.46.22.2 255.255.255.0
no ip redirects
no ip proxy-arp
ip virtual-reassembly
duplex full
speed auto
no cdp enable
no mop enabled
crypto map outside_map_ipsec
!
interface FastEthernet0/1
description ===LAN===
ip address 192.168.2.2 255.255.255.0
ip accounting output-packets
ip virtual-reassembly
duplex auto
speed auto
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 172.46.22.1
!
ip access-list extended VPN-MOSCOW
permit ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255[/quote]

Linux
172.46.22.2.conf

remote 172.46.22.2
{
        exchange_mode aggressive, main;
        my_identifier address;
        proposal {
                encryption_algorithm 3des;
                hash_algorithm sha1;
                authentication_method pre_shared_key;
                dh_group 2;
        }
}

racoon.conf

path include "/etc/racoon";
path pre_shared_key "/etc/racoon/psk.txt";
path certificate "/etc/racoon/certs";
log debug2;

sainfo anonymous
{
        pfs_group 2;
        lifetime time 1 hour;
        encryption_algorithm 3des, blowfish 448, rijndael;
        authentication_algorithm hmac_sha1, hmac_md5 ;
        compression_algorithm deflate ;
}
include "/etc/racoon/172.46.22.2.conf";

psk.key

# file for pre-shared keys used for IKE authentication
172.46.22.2  test123

IPSEC  вроде как поднялся

show crypto

2811-129-uzl:323#show crypto isakmp sa
dst             src             state          conn-id slot status
172.45.22.2     172.46.22.2     QM_IDLE             85    0 ACTIVE

2811-129-uzl:323#show crypto engine connection active

  ID Interface            IP-Address      State  Algorithm           Encrypt  Decrypt
  85 FastEthernet0/0      172.46.22.2     set    HMAC_SHA+3DES_56_C        0        0
3003 FastEthernet0/0      172.46.22.2     set    SHA+3DES+SHA             38        0
3004 FastEthernet0/0      172.46.22.2     set    SHA+3DES+SHA              0        0

2811-129-uzl:323#show crypto isakmp sa detail

interface: FastEthernet0/0
    Crypto map tag: outside_map_ipsec, local addr 172.46.22.2

   protected vrf: (none)
   local  ident (addr/mask/prot/port): (192.168.2.0/255.255.255.0/0/0)
   remote ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0)
   current_peer 172.45.22.2 port 500
     PERMIT, flags={origin_is_acl,}
    #pkts encaps: 81, #pkts encrypt: 81, #pkts digest: 81
    #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0
    #pkts not decompressed: 0, #pkts decompress failed: 0
    #send errors 5, #recv errors 0

     local crypto endpt.: 172.46.22.2, remote crypto endpt.: 172.45.22.2
     path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet0/0
     current outbound spi: 0x2F8DABC(49863356)

     inbound esp sas:
      spi: 0x5C8F04E9(1552876777)
        transform: esp-3des esp-sha-hmac ,
        in use settings ={Tunnel, }
        conn id: 3004, flow_id: NETGX:4, crypto map: outside_map_ipsec
        sa timing: remaining key lifetime (k/sec): (4563217/3449)
        IV size: 8 bytes
        replay detection support: Y
        Status: ACTIVE

     inbound ah sas:
      spi: 0xF77ABF24(4152016676)
        transform: ah-sha-hmac ,
        in use settings ={Tunnel, }
        conn id: 3004, flow_id: NETGX:4, crypto map: outside_map_ipsec
        sa timing: remaining key lifetime (k/sec): (4563217/3447)
        replay detection support: Y
        Status: ACTIVE

     inbound pcp sas:

     outbound esp sas:
      spi: 0x2F8DABC(49863356)
        transform: esp-3des esp-sha-hmac ,
        in use settings ={Tunnel, }
        conn id: 3003, flow_id: NETGX:3, crypto map: outside_map_ipsec
        sa timing: remaining key lifetime (k/sec): (4563212/3445)
        IV size: 8 bytes
        replay detection support: Y
        Status: ACTIVE

     outbound ah sas:
      spi: 0x51034CF(84948175)
        transform: ah-sha-hmac ,
        in use settings ={Tunnel, }
        conn id: 3003, flow_id: NETGX:3, crypto map: outside_map_ipsec
        sa timing: remaining key lifetime (k/sec): (4563212/3443)
        replay detection support: Y
        Status: ACTIVE

     outbound pcp sas:

Но вот пинги не ходят - сделал дебаг и вот что увидел

2811-129-uzl:323#debug crypto ipsec
2811-129-uzl:323#debug crypto ISAKMP
2811-129-uzl:323#debug crypto engine

Dec  7 09:18:08: IPSEC(crypto_ipsec_sa_exists): BAD ESP in AH,
  (ip) dest_addr= 172.45.22.2, src_addr=172.46.22.2, proto= 51,
  (identity) local= 172.45.22.2, remote= 172.46.22.2,
    local_proxy= 10.129.0.0/255.255.0.0/0/0 (type=4),
    remote_proxy= 10.128.0.0/255.255.0.0/0/0 (type=4)

Linux так же рапортуют что все работает
[quote]Dec  2 15:26:54 linux racoon: INFO: IPsec-SA established: AH/Tunnel 172.46.22.2[500]->172.45.22.2[500] spi=87032457(0x5300289)
Dec  2 15:26:54 linux racoon: INFO: IPsec-SA established: ESP/Tunnel 172.46.22.2[500]->172.45.22.2[500] spi=8907732(0x87ebd4)
Dec  2 15:26:54 linux racoon: INFO: IPsec-SA established: AH/Tunnel 172.45.22.2[500]->172.46.22.2[500] spi=3300149218(0xc4b447e2)
Dec  2 15:26:54 linux racoon: INFO: IPsec-SA established: ESP/Tunnel 172.45.22.2[500]->172.46.22.2[500] spi=678060800(0x286a6300)

Есть более подробная информация с дебага но сюда будет многовато писать