Всем привет! Помогите пож-та если кто может, потому как своего опыта тут мало.
Пытаемся построит VPN через интернет между 2 фирмами, с нашей стороны Cisco 2621 c их Checkpoint. Нашел вот такую доку на Cisco. Сделали в полном (практически - нам не нужен NAT, адреса другие) соответсвии с описанием.
http://www.cisco.com/en/US/tech/tk583/tk372/technologies_configuration_example09186a0080094ac4.shtml
Адреса:
Cisco 62.181.40.138, за ней 172.20.20.0/24
Chekpoint 213.33.252.2, за ним 192.168.200.0/21
Запускаю у себя debug, получаю
Jun 3 11:51:06.447 MSK: ISAKMP (0:6): received packet from 213.33.252.2 dport 500 sport 500 Global (R) QM_IDLE
Jun 3 11:51:06.447 MSK: ISAKMP: set new node -2098933148 to QM_IDLE
Jun 3 11:51:06.451 MSK: CryptoEngine0: CRYPTO_ISA_IKE_DECRYPT(hw)(ipsec)
Jun 3 11:51:06.455 MSK: CryptoEngine0: generate hmac context for conn id 6
Jun 3 11:51:06.455 MSK: CryptoEngine0: CRYPTO_ISA_IKE_HMAC(hw)(ipsec)
Jun 3 11:51:06.467 MSK: ISAKMP (0:6): processing HASH payload. message ID = -2098933148
Jun 3 11:51:06.467 MSK: ISAKMP (0:6): processing SA payload. message ID = -2098933148
Jun 3 11:51:06.467 MSK: ISAKMP (0:6): Checking IPSec proposal 1
Jun 3 11:51:06.467 MSK: ISAKMP: transform 1, ESP_DES
Jun 3 11:51:06.471 MSK: ISAKMP: attributes in transform:
Jun 3 11:51:06.471 MSK: ISAKMP: SA life type in seconds
Jun 3 11:51:06.471 MSK: ISAKMP: SA life duration (VPI) of 0x0 0x0 0xE 0x10
Jun 3 11:51:06.471 MSK: ISAKMP: authenticator is HMAC-MD5
Jun 3 11:51:06.471 MSK: ISAKMP: encaps is 1
Jun 3 11:51:06.471 MSK: CryptoEngine0: validate proposal
Jun 3 11:51:06.471 MSK: ISAKMP (0:6): atts are acceptable.
Jun 3 11:51:06.475 MSK: IPSEC(validate_proposal_request): proposal part #1,
(key eng. msg.) INBOUND local= 62.181.40.138, remote= 213.33.252.2,
local_proxy= 172.20.20.0/255.255.255.0/0/0 (type=4),
remote_proxy= 192.168.200.0/255.255.248.0/0/0 (type=4),
protocol= ESP, transform= esp-des esp-md5-hmac ,
lifedur= 0s and 0kb,
spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x2
Jun 3 11:51:06.475 MSK: CryptoEngine0: validate proposal request
Jun 3 11:51:06.475 MSK: IPSEC(kei_proxy): head = bcc, map->ivrf = , kei->ivrf =
Jun 3 11:51:06.475 MSK: IPSEC(validate_transform_proposal): proxy identities not supported
Jun 3 11:51:06.479 MSK: ISAKMP (0:6): IPSec policy invalidated proposal
Jun 3 11:51:06.479 MSK: ISAKMP (0:6): phase 2 SA policy not acceptable! (local 62.181.40.138 remote 213.33.252.2)
Jun 3 11:51:06.479 MSK: ISAKMP: set new node -1577582434 to QM_IDLE
Jun 3 11:51:06.479 MSK: CryptoEngine0: generate hmac context for conn id 6
Jun 3 11:51:06.479 MSK: CryptoEngine0: CRYPTO_ISA_IKE_HMAC(hw)(ipsec)
Jun 3 11:51:06.491 MSK: CryptoEngine0: CRYPTO_ISA_IKE_ENCRYPT(hw)(ipsec)
Jun 3 11:51:06.499 MSK: ISAKMP (0:6): sending packet to 213.33.252.2 my_port 500 peer_port 500 (R) QM_IDLE
Jun 3 11:51:06.503 MSK: ISAKMP (0:6): purging node -1577582434
Jun 3 11:51:06.503 MSK: ISAKMP (0:6): Node -2098933148, Input = IKE_MESG_FROM_PEER, IKE_QM_EXCH
Jun 3 11:51:06.503 MSK: ISAKMP (0:6): Old State = IKE_QM_READY New State = IKE_QM_READY
Jun 3 11:52:39.889 MSK: ISAKMP (0:6): received packet from 213.33.252.2 dport 500 sport 500 Global (R) QM_IDLE
Jun 3 11:52:39.889 MSK: ISAKMP: set new node 1295321287 to QM_IDLE
Jun 3 11:52:39.893 MSK: CryptoEngine0: CRYPTO_ISA_IKE_DECRYPT(hw)(ipsec)
Jun 3 11:52:39.897 MSK: CryptoEngine0: generate hmac context for conn id 6
Jun 3 11:52:39.901 MSK: CryptoEngine0: CRYPTO_ISA_IKE_HMAC(hw)(ipsec)
Jun 3 11:52:39.905 MSK: ISAKMP (0:6): processing HASH payload. message ID = 1295321287
Jun 3 11:52:39.909 MSK: ISAKMP (0:6): processing SA payload. message ID = 1295321287
Jun 3 11:52:39.909 MSK: ISAKMP (0:6): Checking IPSec proposal 1
Jun 3 11:52:39.909 MSK: ISAKMP: transform 1, ESP_DES
Jun 3 11:52:39.909 MSK: ISAKMP: attributes in transform:
Jun 3 11:52:39.909 MSK: ISAKMP: SA life type in seconds
Jun 3 11:52:39.909 MSK: ISAKMP: SA life duration (VPI) of 0x0 0x0 0xE 0x10
Jun 3 11:52:39.909 MSK: ISAKMP: authenticator is HMAC-MD5
Jun 3 11:52:39.909 MSK: ISAKMP: encaps is 1
Jun 3 11:52:39.913 MSK: CryptoEngine0: validate proposal
Jun 3 11:52:39.913 MSK: ISAKMP (0:6): atts are acceptable.
Jun 3 11:52:39.913 MSK: IPSEC(validate_proposal_request): proposal part #1,
(key eng. msg.) INBOUND local= 62.181.40.138, remote= 213.33.252.2,
local_proxy= 172.20.20.0/255.255.255.0/0/0 (type=4),
remote_proxy= 192.168.200.0/255.255.248.0/0/0 (type=4),
protocol= ESP, transform= esp-des esp-md5-hmac ,
lifedur= 0s and 0kb,
spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x2
Jun 3 11:52:39.913 MSK: CryptoEngine0: validate proposal request
Jun 3 11:52:39.917 MSK: IPSEC(kei_proxy): head = bcc, map->ivrf = , kei->ivrf =
Jun 3 11:52:39.917 MSK: IPSEC(validate_transform_proposal): proxy identities not supported
Jun 3 11:52:39.917 MSK: ISAKMP (0:6): IPSec policy invalidated proposal
Jun 3 11:52:39.917 MSK: ISAKMP (0:6): phase 2 SA policy not acceptable! (local 62.181.40.138 remote 213.33.252.2)
Jun 3 11:52:39.917 MSK: ISAKMP: set new node -1559292873 to QM_IDLE
Jun 3 11:52:39.921 MSK: CryptoEngine0: generate hmac context for conn id 6
Jun 3 11:52:39.921 MSK: CryptoEngine0: CRYPTO_ISA_IKE_HMAC(hw)(ipsec)
Jun 3 11:52:39.929 MSK: CryptoEngine0: CRYPTO_ISA_IKE_ENCRYPT(hw)(ipsec)
Jun 3 11:52:39.933 MSK: ISAKMP (0:6): sending packet to 213.33.252.2 my_port 500 peer_port 500 (R) QM_IDLE
Jun 3 11:52:39.933 MSK: ISAKMP (0:6): purging node -1559292873
Jun 3 11:52:39.937 MSK: ISAKMP (0:6): Node 1295321287, Input = IKE_MESG_FROM_PEER, IKE_QM_EXCH
Jun 3 11:52:39.937 MSK: ISAKMP (0:6): Old State = IKE_QM_READY New State = IKE_QM_READY
sh crypto isakmp sa
dst src state conn-id slot
62.181.40.138 213.33.252.2 QM_IDLE 6 0
sh crypto ipsec sa
interface: FastEthernet0/1
Crypto map tag: bcc, local addr. 62.181.40.138
protected vrf:
local ident (addr/mask/prot/port): (172.20.20.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (192.168.201.0/255.255.255.0/0/0)
current_peer: 213.33.252.2:500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest 0
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0
local crypto endpt.: 62.181.40.138, remote crypto endpt.: 213.33.252.2
path mtu 1500, media mtu 1500
current outbound spi: 0
inbound esp sas:
inbound ah sas:
inbound pcp sas:
outbound esp sas:
outbound ah sas:
outbound pcp sas:
Как понимаю не проходит 2-ая фаза, собственно не устанавливается IPsec.
В чем может быть трабл? Если надо приведу конфигю Спасибо.
Вариант для распечатки
Маршрутизаторы CISCO и др. оборудование. (Public)
(??) on
03-Июн-05, 12:26 (MSK)
