forum.opennet.ru

Составление сообщения

Исходное сообщение

"Cisco 2811 Ipsec - Couldn't find node: message_id"
Отправлено Евгений, 23-Окт-15 11:43

>> Обновился до 15.1
>> IKE Dispatcher: IKEv2 version 2 detected, Dropping packet! сообщения пропали, все остальные
>> сообщения в дебаге полностью идентичны.
> #show crypto isakmp sa
> #show crypto isakmp policy
> #show crypto isakmp default policy
> и предоставьте свежие логи
> со второй железяки бы аналогичные данные получить
Router2811#sh crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst             src             state          conn-id status
IPv6 Crypto ISAKMP SA
Router2811#sh crypto isakmp policy
Global IKE policy
Protection suite of priority 10
    encryption algorithm:    AES - Advanced Encryption Standard (256 bit keys).
    hash algorithm:        Secure Hash Standard
    authentication method:    Pre-Shared Key
    Diffie-Hellman group:    #2 (1024 bit)
    lifetime:        28800 seconds, no volume limit

Router2811#sh crypto isakmp default policy
Default IKE policy
Default protection suite of priority 65507
    encryption algorithm:    AES - Advanced Encryption Standard (128 bit keys).
    hash algorithm:        Secure Hash Standard
    authentication method:    Rivest-Shamir-Adleman Signature
    Diffie-Hellman group:    #5 (1536 bit)
    lifetime:        86400 seconds, no volume limit
Default protection suite of priority 65508
    encryption algorithm:    AES - Advanced Encryption Standard (128 bit keys).
    hash algorithm:        Secure Hash Standard
    authentication method:    Pre-Shared Key
    Diffie-Hellman group:    #5 (1536 bit)
    lifetime:        86400 seconds, no volume limit
Default protection suite of priority 65509
    encryption algorithm:    AES - Advanced Encryption Standard (128 bit keys).
    hash algorithm:        Message Digest 5
    authentication method:    Rivest-Shamir-Adleman Signature
    Diffie-Hellman group:    #5 (1536 bit)
    lifetime:        86400 seconds, no volume limit
Default protection suite of priority 65510
    encryption algorithm:    AES - Advanced Encryption Standard (128 bit keys).
    hash algorithm:        Message Digest 5
    authentication method:    Pre-Shared Key
    Diffie-Hellman group:    #5 (1536 bit)
    lifetime:        86400 seconds, no volume limit
Default protection suite of priority 65511
        encryption algorithm:    Three key triple DES
        hash algorithm:        Secure Hash Standard
        authentication method:    Rivest-Shamir-Adleman Signature
        Diffie-Hellman group:    #2 (1024 bit)
        lifetime:        86400 seconds, no volume limit
Default protection suite of priority 65512
        encryption algorithm:    Three key triple DES
        hash algorithm:        Secure Hash Standard
        authentication method:    Pre-Shared Key
        Diffie-Hellman group:    #2 (1024 bit)
        lifetime:        86400 seconds, no volume limit
Default protection suite of priority 65513
        encryption algorithm:    Three key triple DES
        hash algorithm:        Message Digest 5
        authentication method:    Rivest-Shamir-Adleman Signature
        Diffie-Hellman group:    #2 (1024 bit)
        lifetime:        86400 seconds, no volume limit
Default protection suite of priority 65514
        encryption algorithm:    Three key triple DES
        hash algorithm:        Message Digest 5
        authentication method:    Pre-Shared Key
        Diffie-Hellman group:    #2 (1024 bit)
        lifetime:        86400 seconds, no volume limit
После запуска трафика в тоннель
Router2811#sh crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst             src             state          conn-id status
1.1.1.1         2.2.2.2         MM_NO_STATE          0 ACTIVE
И логи
*Oct 23 09:42:07.399: ISAKMP:(0): SA request profile is (NULL)
*Oct 23 09:42:07.403: ISAKMP: Created a peer struct for 1.1.1.1, peer port 500
*Oct 23 09:42:07.403: ISAKMP: New peer created peer = 0x4A1BDE10 peer_handle = 0x80000003
*Oct 23 09:42:07.403: ISAKMP: Locking peer struct 0x4A1BDE10, refcount 1 for isakmp_initiator
*Oct 23 09:42:07.403: ISAKMP: local port 500, remote port 500
*Oct 23 09:42:07.403: ISAKMP: set new node 0 to QM_IDLE
*Oct 23 09:42:07.403: ISAKMP: Find a dup sa in the avl tree during calling isadb_insert sa = 4A2C8EC4
*Oct 23 09:42:07.403: ISAKMP:(0):Can not start Aggressive mode, trying Main mode.
*Oct 23 09:42:07.403: ISAKMP:(0):found peer pre-shared key matching 1.1.1.1
*Oct 23 09:42:07.403: ISAKMP:(0): constructed NAT-T vendor-rfc3947 ID
*Oct 23 09:42:07.403: ISAKMP:(0): constructed NAT-T vendor-07 ID
*Oct 23 09:42:07.403: ISAKMP:(0): constructed NAT-T vendor-03 ID
*Oct 23 09:42:07.403: ISAKMP:(0): constructed NAT-T vendor-02 ID
*Oct 23 09:42:07.403: ISAKMP:(0):Input = IKE_MESG_FROM_IPSEC, IKE_SA_REQ_MM
*Oct 23 09:42:07.403: ISAKMP:(0):Old State = IKE_READY  New State = IKE_I_MM1
*Oct 23 09:42:07.403: ISAKMP:(0): beginning Main Mode exchange
*Oct 23 09:42:07.403: ISAKMP:(0): sending packet to 1.1.1.1 my_port 500 peer_port 500 (I) MM_NO_STATE
*Oct 23 09:42:07.403: ISAKMP:(0):Sending an IKE IPv4 Packet.
*Oct 23 09:42:07.463: ISAKMP (0): received packet from 1.1.1.1 dport 500 sport 500 Global (I) MM_NO_STATE
*Oct 23 09:42:07.463: ISAKMP:(0):Couldn't find node: message_id 1317700968
*Oct 23 09:42:07.463: ISAKMP (0): Unknown Input IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY:  state = IKE_I_MM1
*Oct 23 09:42:07.463: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY
*Oct 23 09:42:07.463: ISAKMP:(0):Old State = IKE_I_MM1  New State = IKE_I_MM1
*Oct 23 09:42:07.463: %CRYPTO-6-IKMP_MODE_FAILURE: Processing of Informational mode failed with peer at 1.1.1.1.....
Success rate is 0 percent (0/5)
Router2811#
*Oct 23 09:42:17.407: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE...
*Oct 23 09:42:17.407: ISAKMP (0): incrementing error counter on sa, attempt 1 of 5: retransmit phase 1
*Oct 23 09:42:17.407: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE
*Oct 23 09:42:17.407: ISAKMP:(0): sending packet to 1.1.1.1 my_port 500 peer_port 500 (I) MM_NO_STATE
*Oct 23 09:42:17.407: ISAKMP:(0):Sending an IKE IPv4 Packet.
*Oct 23 09:42:17.463: ISAKMP (0): received packet from 1.1.1.1 dport 500 sport 500 Global (I) MM_NO_STATE
*Oct 23 09:42:17.463: ISAKMP:(0):Couldn't find node: message_id -726632295
*Oct 23 09:42:17.463: ISAKMP (0): Unknown Input IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY:  state = IKE_I_MM1
*Oct 23 09:42:17.463: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY
*Oct 23 09:42:17.463: ISAKMP:(0):Old State = IKE_I_MM1  New State = IKE_I_MM1
*Oct 23 09:42:27.407: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE...
*Oct 23 09:42:27.407: ISAKMP (0): incrementing error counter on sa, attempt 2 of 5: retransmit phase 1
*Oct 23 09:42:27.407: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE
*Oct 23 09:42:27.407: ISAKMP:(0): sending packet to 1.1.1.1 my_port 500 peer_port 500 (I) MM_NO_STATE
*Oct 23 09:42:27.407: ISAKMP:(0):Sending an IKE IPv4 Packet.
*Oct 23 09:42:27.463: ISAKMP (0): received packet from 1.1.1.1 dport 500 sport 500 Global (I) MM_NO_STATE
*Oct 23 09:42:27.463: ISAKMP:(0):Couldn't find node: message_id -1737446913
*Oct 23 09:42:27.463: ISAKMP (0): Unknown Input IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY:  state = IKE_I_MM1
*Oct 23 09:42:27.463: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY
*Oct 23 09:42:27.463: ISAKMP:(0):Old State = IKE_I_MM1  New State = IKE_I_MM1
*Oct 23 09:42:37.399: ISAKMP: set new node 0 to QM_IDLE
*Oct 23 09:42:37.399: ISAKMP:(0):SA is still budding. Attached new ipsec request to it. (local 2.2.2.2, remote 1.1.1.1)
*Oct 23 09:42:37.399: ISAKMP: Error while processing SA request: Failed to initialize SA
*Oct 23 09:42:37.399: ISAKMP: Error while processing KMI message 0, error 2.
*Oct 23 09:42:37.407: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE...
*Oct 23 09:42:37.407: ISAKMP (0): incrementing error counter on sa, attempt 3 of 5: retransmit phase 1
*Oct 23 09:42:37.407: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE
*Oct 23 09:42:37.407: ISAKMP:(0): sending packet to 1.1.1.1 my_port 500 peer_port 500 (I) MM_NO_STATE
*Oct 23 09:42:37.407: ISAKMP:(0):Sending an IKE IPv4 Packet.
*Oct 23 09:42:37.463: ISAKMP (0): received packet from 1.1.1.1 dport 500 sport 500 Global (I) MM_NO_STATE
*Oct 23 09:42:37.463: ISAKMP:(0):Couldn't find node: message_id -1728359607
*Oct 23 09:42:37.463: ISAKMP (0): Unknown Input IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY:  state = IKE_I_MM1
*Oct 23 09:42:37.463: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY
*Oct 23 09:42:37.463: ISAKMP:(0):Old State = IKE_I_MM1  New State = IKE_I_MM1
*Oct 23 09:42:42.895: ISAKMP:(0):purging node -1546922538
*Oct 23 09:42:42.895: ISAKMP:(0):purging node -1695489255
*Oct 23 09:42:47.407: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE...
*Oct 23 09:42:47.407: ISAKMP (0): incrementing error counter on sa, attempt 4 of 5: retransmit phase 1
*Oct 23 09:42:47.407: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE
*Oct 23 09:42:47.407: ISAKMP:(0): sending packet to 1.1.1.1 my_port 500 peer_port 500 (I) MM_NO_STATE
*Oct 23 09:42:47.407: ISAKMP:(0):Sending an IKE IPv4 Packet.
*Oct 23 09:42:47.463: ISAKMP (0): received packet from 1.1.1.1 dport 500 sport 500 Global (I) MM_NO_STATE
*Oct 23 09:42:47.463: ISAKMP:(0):Couldn't find node: message_id -1571055350
*Oct 23 09:42:47.463: ISAKMP (0): Unknown Input IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY:  state = IKE_I_MM1
*Oct 23 09:42:47.463: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY
*Oct 23 09:42:47.463: ISAKMP:(0):Old State = IKE_I_MM1  New State = IKE_I_MM1
*Oct 23 09:42:52.895: ISAKMP:(0):purging SA., sa=4A2C0C28, delme=4A2C0C28
*Oct 23 09:42:57.407: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE...
*Oct 23 09:42:57.407: ISAKMP (0): incrementing error counter on sa, attempt 5 of 5: retransmit phase 1
*Oct 23 09:42:57.407: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE
*Oct 23 09:42:57.407: ISAKMP:(0): sending packet to 1.1.1.1 my_port 500 peer_port 500 (I) MM_NO_STATE
*Oct 23 09:42:57.407: ISAKMP:(0):Sending an IKE IPv4 Packet.
*Oct 23 09:42:57.463: ISAKMP (0): received packet from 1.1.1.1 dport 500 sport 500 Global (I) MM_NO_STATE
*Oct 23 09:42:57.463: ISAKMP:(0):Couldn't find node: message_id -1921433792
*Oct 23 09:42:57.463: ISAKMP (0): Unknown Input IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY:  state = IKE_I_MM1
*Oct 23 09:42:57.463: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY
*Oct 23 09:42:57.463: ISAKMP:(0):Old State = IKE_I_MM1  New State = IKE_I_MM1
*Oct 23 09:43:07.407: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE...
*Oct 23 09:43:07.407: ISAKMP:(0):peer does not do paranoid keepalives.
*Oct 23 09:43:07.407: ISAKMP:(0):deleting SA reason "Death by retransmission P1" state (I) MM_NO_STATE (peer 1.1.1.1)
*Oct 23 09:43:07.407: ISAKMP:(0):deleting SA reason "Death by retransmission P1" state (I) MM_NO_STATE (peer 1.1.1.1)
*Oct 23 09:43:07.407: ISAKMP: Unlocking peer struct 0x4A1BDE10 for isadb_mark_sa_deleted(), count 0
*Oct 23 09:43:07.407: ISAKMP: Deleting peer node by peer_reap for 1.1.1.1: 4A1BDE10
*Oct 23 09:43:07.407: ISAKMP:(0):deleting node 2134233700 error FALSE reason "IKE deleted"
*Oct 23 09:43:07.407: ISAKMP:(0):deleting node 1700880190 error FALSE reason "IKE deleted"
*Oct 23 09:43:07.407: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PHASE1_DEL
*Oct 23 09:43:07.407: ISAKMP:(0):Old State = IKE_I_MM1  New State = IKE_DEST_SA

Получить данные с второй стороны крайне проблематично. Очень хотелось бы найти источник проблемы, чтобы приводить аргументы.

Исходное сообщение
"Cisco 2811 Ipsec - Couldn't find node: message_id" Отправлено Евгений, 23-Окт-15 11:43
>> Обновился до 15.1 >> IKE Dispatcher: IKEv2 version 2 detected, Dropping packet! сообщения пропали, все остальные >> сообщения в дебаге полностью идентичны. > #show crypto isakmp sa > #show crypto isakmp policy > #show crypto isakmp default policy > и предоставьте свежие логи > со второй железяки бы аналогичные данные получить Router2811#sh crypto isakmp sa IPv4 Crypto ISAKMP SA dst src state conn-id status IPv6 Crypto ISAKMP SA Router2811#sh crypto isakmp policy Global IKE policy Protection suite of priority 10 encryption algorithm: AES - Advanced Encryption Standard (256 bit keys). hash algorithm: Secure Hash Standard authentication method: Pre-Shared Key Diffie-Hellman group: #2 (1024 bit) lifetime: 28800 seconds, no volume limit Router2811#sh crypto isakmp default policy Default IKE policy Default protection suite of priority 65507 encryption algorithm: AES - Advanced Encryption Standard (128 bit keys). hash algorithm: Secure Hash Standard authentication method: Rivest-Shamir-Adleman Signature Diffie-Hellman group: #5 (1536 bit) lifetime: 86400 seconds, no volume limit Default protection suite of priority 65508 encryption algorithm: AES - Advanced Encryption Standard (128 bit keys). hash algorithm: Secure Hash Standard authentication method: Pre-Shared Key Diffie-Hellman group: #5 (1536 bit) lifetime: 86400 seconds, no volume limit Default protection suite of priority 65509 encryption algorithm: AES - Advanced Encryption Standard (128 bit keys). hash algorithm: Message Digest 5 authentication method: Rivest-Shamir-Adleman Signature Diffie-Hellman group: #5 (1536 bit) lifetime: 86400 seconds, no volume limit Default protection suite of priority 65510 encryption algorithm: AES - Advanced Encryption Standard (128 bit keys). hash algorithm: Message Digest 5 authentication method: Pre-Shared Key Diffie-Hellman group: #5 (1536 bit) lifetime: 86400 seconds, no volume limit Default protection suite of priority 65511 encryption algorithm: Three key triple DES hash algorithm: Secure Hash Standard authentication method: Rivest-Shamir-Adleman Signature Diffie-Hellman group: #2 (1024 bit) lifetime: 86400 seconds, no volume limit Default protection suite of priority 65512 encryption algorithm: Three key triple DES hash algorithm: Secure Hash Standard authentication method: Pre-Shared Key Diffie-Hellman group: #2 (1024 bit) lifetime: 86400 seconds, no volume limit Default protection suite of priority 65513 encryption algorithm: Three key triple DES hash algorithm: Message Digest 5 authentication method: Rivest-Shamir-Adleman Signature Diffie-Hellman group: #2 (1024 bit) lifetime: 86400 seconds, no volume limit Default protection suite of priority 65514 encryption algorithm: Three key triple DES hash algorithm: Message Digest 5 authentication method: Pre-Shared Key Diffie-Hellman group: #2 (1024 bit) lifetime: 86400 seconds, no volume limit После запуска трафика в тоннель Router2811#sh crypto isakmp sa IPv4 Crypto ISAKMP SA dst src state conn-id status 1.1.1.1 2.2.2.2 MM_NO_STATE 0 ACTIVE И логи Oct 23 09:42:07.399: ISAKMP:(0): SA request profile is (NULL) Oct 23 09:42:07.403: ISAKMP: Created a peer struct for 1.1.1.1, peer port 500 Oct 23 09:42:07.403: ISAKMP: New peer created peer = 0x4A1BDE10 peer_handle = 0x80000003 Oct 23 09:42:07.403: ISAKMP: Locking peer struct 0x4A1BDE10, refcount 1 for isakmp_initiator Oct 23 09:42:07.403: ISAKMP: local port 500, remote port 500 Oct 23 09:42:07.403: ISAKMP: set new node 0 to QM_IDLE Oct 23 09:42:07.403: ISAKMP: Find a dup sa in the avl tree during calling isadb_insert sa = 4A2C8EC4 Oct 23 09:42:07.403: ISAKMP:(0):Can not start Aggressive mode, trying Main mode. Oct 23 09:42:07.403: ISAKMP:(0):found peer pre-shared key matching 1.1.1.1 Oct 23 09:42:07.403: ISAKMP:(0): constructed NAT-T vendor-rfc3947 ID Oct 23 09:42:07.403: ISAKMP:(0): constructed NAT-T vendor-07 ID Oct 23 09:42:07.403: ISAKMP:(0): constructed NAT-T vendor-03 ID Oct 23 09:42:07.403: ISAKMP:(0): constructed NAT-T vendor-02 ID Oct 23 09:42:07.403: ISAKMP:(0):Input = IKE_MESG_FROM_IPSEC, IKE_SA_REQ_MM Oct 23 09:42:07.403: ISAKMP:(0):Old State = IKE_READY New State = IKE_I_MM1 Oct 23 09:42:07.403: ISAKMP:(0): beginning Main Mode exchange Oct 23 09:42:07.403: ISAKMP:(0): sending packet to 1.1.1.1 my_port 500 peer_port 500 (I) MM_NO_STATE Oct 23 09:42:07.403: ISAKMP:(0):Sending an IKE IPv4 Packet. Oct 23 09:42:07.463: ISAKMP (0): received packet from 1.1.1.1 dport 500 sport 500 Global (I) MM_NO_STATE Oct 23 09:42:07.463: ISAKMP:(0):Couldn't find node: message_id 1317700968 Oct 23 09:42:07.463: ISAKMP (0): Unknown Input IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY: state = IKE_I_MM1 Oct 23 09:42:07.463: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY Oct 23 09:42:07.463: ISAKMP:(0):Old State = IKE_I_MM1 New State = IKE_I_MM1 Oct 23 09:42:07.463: %CRYPTO-6-IKMP_MODE_FAILURE: Processing of Informational mode failed with peer at 1.1.1.1..... Success rate is 0 percent (0/5) Router2811# Oct 23 09:42:17.407: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE... Oct 23 09:42:17.407: ISAKMP (0): incrementing error counter on sa, attempt 1 of 5: retransmit phase 1 Oct 23 09:42:17.407: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE Oct 23 09:42:17.407: ISAKMP:(0): sending packet to 1.1.1.1 my_port 500 peer_port 500 (I) MM_NO_STATE Oct 23 09:42:17.407: ISAKMP:(0):Sending an IKE IPv4 Packet. Oct 23 09:42:17.463: ISAKMP (0): received packet from 1.1.1.1 dport 500 sport 500 Global (I) MM_NO_STATE Oct 23 09:42:17.463: ISAKMP:(0):Couldn't find node: message_id -726632295 Oct 23 09:42:17.463: ISAKMP (0): Unknown Input IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY: state = IKE_I_MM1 Oct 23 09:42:17.463: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY Oct 23 09:42:17.463: ISAKMP:(0):Old State = IKE_I_MM1 New State = IKE_I_MM1 Oct 23 09:42:27.407: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE... Oct 23 09:42:27.407: ISAKMP (0): incrementing error counter on sa, attempt 2 of 5: retransmit phase 1 Oct 23 09:42:27.407: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE Oct 23 09:42:27.407: ISAKMP:(0): sending packet to 1.1.1.1 my_port 500 peer_port 500 (I) MM_NO_STATE Oct 23 09:42:27.407: ISAKMP:(0):Sending an IKE IPv4 Packet. Oct 23 09:42:27.463: ISAKMP (0): received packet from 1.1.1.1 dport 500 sport 500 Global (I) MM_NO_STATE Oct 23 09:42:27.463: ISAKMP:(0):Couldn't find node: message_id -1737446913 Oct 23 09:42:27.463: ISAKMP (0): Unknown Input IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY: state = IKE_I_MM1 Oct 23 09:42:27.463: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY Oct 23 09:42:27.463: ISAKMP:(0):Old State = IKE_I_MM1 New State = IKE_I_MM1 Oct 23 09:42:37.399: ISAKMP: set new node 0 to QM_IDLE Oct 23 09:42:37.399: ISAKMP:(0):SA is still budding. Attached new ipsec request to it. (local 2.2.2.2, remote 1.1.1.1) Oct 23 09:42:37.399: ISAKMP: Error while processing SA request: Failed to initialize SA Oct 23 09:42:37.399: ISAKMP: Error while processing KMI message 0, error 2. Oct 23 09:42:37.407: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE... Oct 23 09:42:37.407: ISAKMP (0): incrementing error counter on sa, attempt 3 of 5: retransmit phase 1 Oct 23 09:42:37.407: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE Oct 23 09:42:37.407: ISAKMP:(0): sending packet to 1.1.1.1 my_port 500 peer_port 500 (I) MM_NO_STATE Oct 23 09:42:37.407: ISAKMP:(0):Sending an IKE IPv4 Packet. Oct 23 09:42:37.463: ISAKMP (0): received packet from 1.1.1.1 dport 500 sport 500 Global (I) MM_NO_STATE Oct 23 09:42:37.463: ISAKMP:(0):Couldn't find node: message_id -1728359607 Oct 23 09:42:37.463: ISAKMP (0): Unknown Input IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY: state = IKE_I_MM1 Oct 23 09:42:37.463: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY Oct 23 09:42:37.463: ISAKMP:(0):Old State = IKE_I_MM1 New State = IKE_I_MM1 Oct 23 09:42:42.895: ISAKMP:(0):purging node -1546922538 Oct 23 09:42:42.895: ISAKMP:(0):purging node -1695489255 Oct 23 09:42:47.407: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE... Oct 23 09:42:47.407: ISAKMP (0): incrementing error counter on sa, attempt 4 of 5: retransmit phase 1 Oct 23 09:42:47.407: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE Oct 23 09:42:47.407: ISAKMP:(0): sending packet to 1.1.1.1 my_port 500 peer_port 500 (I) MM_NO_STATE Oct 23 09:42:47.407: ISAKMP:(0):Sending an IKE IPv4 Packet. Oct 23 09:42:47.463: ISAKMP (0): received packet from 1.1.1.1 dport 500 sport 500 Global (I) MM_NO_STATE Oct 23 09:42:47.463: ISAKMP:(0):Couldn't find node: message_id -1571055350 Oct 23 09:42:47.463: ISAKMP (0): Unknown Input IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY: state = IKE_I_MM1 Oct 23 09:42:47.463: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY Oct 23 09:42:47.463: ISAKMP:(0):Old State = IKE_I_MM1 New State = IKE_I_MM1 Oct 23 09:42:52.895: ISAKMP:(0):purging SA., sa=4A2C0C28, delme=4A2C0C28 Oct 23 09:42:57.407: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE... Oct 23 09:42:57.407: ISAKMP (0): incrementing error counter on sa, attempt 5 of 5: retransmit phase 1 Oct 23 09:42:57.407: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE Oct 23 09:42:57.407: ISAKMP:(0): sending packet to 1.1.1.1 my_port 500 peer_port 500 (I) MM_NO_STATE Oct 23 09:42:57.407: ISAKMP:(0):Sending an IKE IPv4 Packet. Oct 23 09:42:57.463: ISAKMP (0): received packet from 1.1.1.1 dport 500 sport 500 Global (I) MM_NO_STATE Oct 23 09:42:57.463: ISAKMP:(0):Couldn't find node: message_id -1921433792 Oct 23 09:42:57.463: ISAKMP (0): Unknown Input IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY: state = IKE_I_MM1 Oct 23 09:42:57.463: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY Oct 23 09:42:57.463: ISAKMP:(0):Old State = IKE_I_MM1 New State = IKE_I_MM1 Oct 23 09:43:07.407: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE... Oct 23 09:43:07.407: ISAKMP:(0):peer does not do paranoid keepalives. Oct 23 09:43:07.407: ISAKMP:(0):deleting SA reason "Death by retransmission P1" state (I) MM_NO_STATE (peer 1.1.1.1) Oct 23 09:43:07.407: ISAKMP:(0):deleting SA reason "Death by retransmission P1" state (I) MM_NO_STATE (peer 1.1.1.1) Oct 23 09:43:07.407: ISAKMP: Unlocking peer struct 0x4A1BDE10 for isadb_mark_sa_deleted(), count 0 Oct 23 09:43:07.407: ISAKMP: Deleting peer node by peer_reap for 1.1.1.1: 4A1BDE10 Oct 23 09:43:07.407: ISAKMP:(0):deleting node 2134233700 error FALSE reason "IKE deleted" Oct 23 09:43:07.407: ISAKMP:(0):deleting node 1700880190 error FALSE reason "IKE deleted" Oct 23 09:43:07.407: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PHASE1_DEL *Oct 23 09:43:07.407: ISAKMP:(0):Old State = IKE_I_MM1 New State = IKE_DEST_SA Получить данные с второй стороны крайне проблематично. Очень хотелось бы найти источник проблемы, чтобы приводить аргументы.

Ваше сообщение

Имя*:

EMail:

Для отправки новых сообщений в текущей нити на email укажите знак ! перед адресом, например, !user@host.ru (!! - не показывать email).
Более тонкая настройка отправки ответов производится в профиле зарегистрированного участника форума.

Заголовок*:

Сообщение*:

>>> Обновился до 15.1 
>>> IKE Dispatcher: IKEv2 version 2 detected, Dropping packet! сообщения пропали, все остальные 
>>> сообщения в дебаге полностью идентичны.
>> #show crypto isakmp sa 
>> #show crypto isakmp policy 
>> #show crypto isakmp default policy 
>> и предоставьте свежие логи 
>> со второй железяки бы аналогичные данные получить

> Router2811#sh crypto isakmp sa 
> IPv4 Crypto ISAKMP SA 
> dst            
>  src          
>    state        
>   conn-id status

> IPv6 Crypto ISAKMP SA

> Router2811#sh crypto isakmp policy

> Global IKE policy 
> Protection suite of priority 10 
>  encryption algorithm: AES - Advanced Encryption Standard (256 bit keys).
>  hash algorithm:  Secure Hash Standard 
>  authentication method: Pre-Shared Key 
>  Diffie-Hellman group: #2 (1024 bit) 
>  lifetime:  28800 seconds, no volume limit

> Router2811#sh crypto isakmp default policy

> Default IKE policy 
> Default protection suite of priority 65507 
>  encryption algorithm: AES - Advanced Encryption Standard (128 bit keys).
>  hash algorithm:  Secure Hash Standard 
>  authentication method: Rivest-Shamir-Adleman Signature 
>  Diffie-Hellman group: #5 (1536 bit) 
>  lifetime:  86400 seconds, no volume limit 
> Default protection suite of priority 65508 
>  encryption algorithm: AES - Advanced Encryption Standard (128 bit keys).
>  hash algorithm:  Secure Hash Standard 
>  authentication method: Pre-Shared Key 
>  Diffie-Hellman group: #5 (1536 bit) 
>  lifetime:  86400 seconds, no volume limit 
> Default protection suite of priority 65509 
>  encryption algorithm: AES - Advanced Encryption Standard (128 bit keys).
>  hash algorithm:  Message Digest 5 
>  authentication method: Rivest-Shamir-Adleman Signature 
>  Diffie-Hellman group: #5 (1536 bit) 
>  lifetime:  86400 seconds, no volume limit 
> Default protection suite of priority 65510 
>  encryption algorithm: AES - Advanced Encryption Standard (128 bit keys).
>  hash algorithm:  Message Digest 5 
>  authentication method: Pre-Shared Key 
>  Diffie-Hellman group: #5 (1536 bit) 
>  lifetime:  86400 seconds, no volume limit 
> Default protection suite of priority 65511 
>         encryption algorithm: Three key 
> triple DES 
>         hash algorithm:  Secure 
> Hash Standard 
>         authentication method: Rivest-Shamir-Adleman Signature 
 
>         Diffie-Hellman group: #2 (1024 
> bit) 
>         lifetime:  86400 seconds, 
> no volume limit 
> Default protection suite of priority 65512 
>         encryption algorithm: Three key 
> triple DES 
>         hash algorithm:  Secure 
> Hash Standard 
>         authentication method: Pre-Shared Key 
 
>         Diffie-Hellman group: #2 (1024 
> bit) 
>         lifetime:  86400 seconds, 
> no volume limit 
> Default protection suite of priority 65513 
>         encryption algorithm: Three key 
> triple DES 
>         hash algorithm:  Message 
> Digest 5 
>         authentication method: Rivest-Shamir-Adleman Signature 
 
>         Diffie-Hellman group: #2 (1024 
> bit) 
>         lifetime:  86400 seconds, 
> no volume limit 
> Default protection suite of priority 65514 
>         encryption algorithm: Three key 
> triple DES 
>         hash algorithm:  Message 
> Digest 5 
>         authentication method: Pre-Shared Key 
 
>         Diffie-Hellman group: #2 (1024 
> bit) 
>         lifetime:  86400 seconds, 
> no volume limit

> После запуска трафика в тоннель

> Router2811#sh crypto isakmp sa 
> IPv4 Crypto ISAKMP SA 
> dst            
>  src          
>    state        
>   conn-id status 
> 1.1.1.1         2.2.2.2   
>       MM_NO_STATE     
>      0 ACTIVE

> И логи

> *Oct 23 09:42:07.399: ISAKMP:(0): SA request profile is (NULL) 
> *Oct 23 09:42:07.403: ISAKMP: Created a peer struct for 1.1.1.1, peer port 
> 500 
> *Oct 23 09:42:07.403: ISAKMP: New peer created peer = 0x4A1BDE10 peer_handle = 
> 0x80000003 
> *Oct 23 09:42:07.403: ISAKMP: Locking peer struct 0x4A1BDE10, refcount 1 for isakmp_initiator 
 
> *Oct 23 09:42:07.403: ISAKMP: local port 500, remote port 500 
> *Oct 23 09:42:07.403: ISAKMP: set new node 0 to QM_IDLE 
> *Oct 23 09:42:07.403: ISAKMP: Find a dup sa in the avl tree 
> during calling isadb_insert sa = 4A2C8EC4 
> *Oct 23 09:42:07.403: ISAKMP:(0):Can not start Aggressive mode, trying Main mode.
> *Oct 23 09:42:07.403: ISAKMP:(0):found peer pre-shared key matching 1.1.1.1 
> *Oct 23 09:42:07.403: ISAKMP:(0): constructed NAT-T vendor-rfc3947 ID 
> *Oct 23 09:42:07.403: ISAKMP:(0): constructed NAT-T vendor-07 ID 
> *Oct 23 09:42:07.403: ISAKMP:(0): constructed NAT-T vendor-03 ID 
> *Oct 23 09:42:07.403: ISAKMP:(0): constructed NAT-T vendor-02 ID 
> *Oct 23 09:42:07.403: ISAKMP:(0):Input = IKE_MESG_FROM_IPSEC, IKE_SA_REQ_MM 
> *Oct 23 09:42:07.403: ISAKMP:(0):Old State = IKE_READY  New State = IKE_I_MM1

> *Oct 23 09:42:07.403: ISAKMP:(0): beginning Main Mode exchange 
> *Oct 23 09:42:07.403: ISAKMP:(0): sending packet to 1.1.1.1 my_port 500 peer_port 500 
> (I) MM_NO_STATE 
> *Oct 23 09:42:07.403: ISAKMP:(0):Sending an IKE IPv4 Packet.
> *Oct 23 09:42:07.463: ISAKMP (0): received packet from 1.1.1.1 dport 500 sport 
> 500 Global (I) MM_NO_STATE 
> *Oct 23 09:42:07.463: ISAKMP:(0):Couldn't find node: message_id 1317700968 
> *Oct 23 09:42:07.463: ISAKMP (0): Unknown Input IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY: 
>  state = IKE_I_MM1 
> *Oct 23 09:42:07.463: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY 
> *Oct 23 09:42:07.463: ISAKMP:(0):Old State = IKE_I_MM1  New State = IKE_I_MM1

> *Oct 23 09:42:07.463: %CRYPTO-6-IKMP_MODE_FAILURE: Processing of Informational mode 
> failed with peer at 1.1.1.1.....
> Success rate is 0 percent (0/5) 
> Router2811# 
> *Oct 23 09:42:17.407: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE...
> *Oct 23 09:42:17.407: ISAKMP (0): incrementing error counter on sa, attempt 1 
> of 5: retransmit phase 1 
> *Oct 23 09:42:17.407: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE 
> *Oct 23 09:42:17.407: ISAKMP:(0): sending packet to 1.1.1.1 my_port 500 peer_port 500 
> (I) MM_NO_STATE 
> *Oct 23 09:42:17.407: ISAKMP:(0):Sending an IKE IPv4 Packet.
> *Oct 23 09:42:17.463: ISAKMP (0): received packet from 1.1.1.1 dport 500 sport 
> 500 Global (I) MM_NO_STATE 
> *Oct 23 09:42:17.463: ISAKMP:(0):Couldn't find node: message_id -726632295 
> *Oct 23 09:42:17.463: ISAKMP (0): Unknown Input IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY: 
>  state = IKE_I_MM1 
> *Oct 23 09:42:17.463: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY 
> *Oct 23 09:42:17.463: ISAKMP:(0):Old State = IKE_I_MM1  New State = IKE_I_MM1

> *Oct 23 09:42:27.407: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE...
> *Oct 23 09:42:27.407: ISAKMP (0): incrementing error counter on sa, attempt 2 
> of 5: retransmit phase 1 
> *Oct 23 09:42:27.407: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE 
> *Oct 23 09:42:27.407: ISAKMP:(0): sending packet to 1.1.1.1 my_port 500 peer_port 500 
> (I) MM_NO_STATE 
> *Oct 23 09:42:27.407: ISAKMP:(0):Sending an IKE IPv4 Packet.
> *Oct 23 09:42:27.463: ISAKMP (0): received packet from 1.1.1.1 dport 500 sport 
> 500 Global (I) MM_NO_STATE 
> *Oct 23 09:42:27.463: ISAKMP:(0):Couldn't find node: message_id -1737446913 
> *Oct 23 09:42:27.463: ISAKMP (0): Unknown Input IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY: 
>  state = IKE_I_MM1 
> *Oct 23 09:42:27.463: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY 
> *Oct 23 09:42:27.463: ISAKMP:(0):Old State = IKE_I_MM1  New State = IKE_I_MM1

> *Oct 23 09:42:37.399: ISAKMP: set new node 0 to QM_IDLE 
> *Oct 23 09:42:37.399: ISAKMP:(0):SA is still budding. Attached new ipsec request to 
> it. (local 2.2.2.2, remote 1.1.1.1) 
> *Oct 23 09:42:37.399: ISAKMP: Error while processing SA request: Failed to initialize 
> SA 
> *Oct 23 09:42:37.399: ISAKMP: Error while processing KMI message 0, error 2. 
 
> *Oct 23 09:42:37.407: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE...
> *Oct 23 09:42:37.407: ISAKMP (0): incrementing error counter on sa, attempt 3 
> of 5: retransmit phase 1 
> *Oct 23 09:42:37.407: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE 
> *Oct 23 09:42:37.407: ISAKMP:(0): sending packet to 1.1.1.1 my_port 500 peer_port 500 
> (I) MM_NO_STATE 
> *Oct 23 09:42:37.407: ISAKMP:(0):Sending an IKE IPv4 Packet.
> *Oct 23 09:42:37.463: ISAKMP (0): received packet from 1.1.1.1 dport 500 sport 
> 500 Global (I) MM_NO_STATE 
> *Oct 23 09:42:37.463: ISAKMP:(0):Couldn't find node: message_id -1728359607 
> *Oct 23 09:42:37.463: ISAKMP (0): Unknown Input IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY: 
>  state = IKE_I_MM1 
> *Oct 23 09:42:37.463: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY 
> *Oct 23 09:42:37.463: ISAKMP:(0):Old State = IKE_I_MM1  New State = IKE_I_MM1

> *Oct 23 09:42:42.895: ISAKMP:(0):purging node -1546922538 
> *Oct 23 09:42:42.895: ISAKMP:(0):purging node -1695489255 
> *Oct 23 09:42:47.407: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE...
> *Oct 23 09:42:47.407: ISAKMP (0): incrementing error counter on sa, attempt 4 
> of 5: retransmit phase 1 
> *Oct 23 09:42:47.407: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE 
> *Oct 23 09:42:47.407: ISAKMP:(0): sending packet to 1.1.1.1 my_port 500 peer_port 500 
> (I) MM_NO_STATE 
> *Oct 23 09:42:47.407: ISAKMP:(0):Sending an IKE IPv4 Packet.
> *Oct 23 09:42:47.463: ISAKMP (0): received packet from 1.1.1.1 dport 500 sport 
> 500 Global (I) MM_NO_STATE 
> *Oct 23 09:42:47.463: ISAKMP:(0):Couldn't find node: message_id -1571055350 
> *Oct 23 09:42:47.463: ISAKMP (0): Unknown Input IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY: 
>  state = IKE_I_MM1 
> *Oct 23 09:42:47.463: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY 
> *Oct 23 09:42:47.463: ISAKMP:(0):Old State = IKE_I_MM1  New State = IKE_I_MM1

> *Oct 23 09:42:52.895: ISAKMP:(0):purging SA., sa=4A2C0C28, delme=4A2C0C28 
> *Oct 23 09:42:57.407: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE...
> *Oct 23 09:42:57.407: ISAKMP (0): incrementing error counter on sa, attempt 5 
> of 5: retransmit phase 1 
> *Oct 23 09:42:57.407: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE 
> *Oct 23 09:42:57.407: ISAKMP:(0): sending packet to 1.1.1.1 my_port 500 peer_port 500 
> (I) MM_NO_STATE 
> *Oct 23 09:42:57.407: ISAKMP:(0):Sending an IKE IPv4 Packet.
> *Oct 23 09:42:57.463: ISAKMP (0): received packet from 1.1.1.1 dport 500 sport 
> 500 Global (I) MM_NO_STATE 
> *Oct 23 09:42:57.463: ISAKMP:(0):Couldn't find node: message_id -1921433792 
> *Oct 23 09:42:57.463: ISAKMP (0): Unknown Input IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY: 
>  state = IKE_I_MM1 
> *Oct 23 09:42:57.463: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY 
> *Oct 23 09:42:57.463: ISAKMP:(0):Old State = IKE_I_MM1  New State = IKE_I_MM1

> *Oct 23 09:43:07.407: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE...
> *Oct 23 09:43:07.407: ISAKMP:(0):peer does not do paranoid keepalives.

> *Oct 23 09:43:07.407: ISAKMP:(0):deleting SA reason "Death by retransmission P1" state 
> (I) MM_NO_STATE (peer 1.1.1.1) 
> *Oct 23 09:43:07.407: ISAKMP:(0):deleting SA reason "Death by retransmission P1" state 
> (I) MM_NO_STATE (peer 1.1.1.1) 
> *Oct 23 09:43:07.407: ISAKMP: Unlocking peer struct 0x4A1BDE10 for isadb_mark_sa_deleted(), 
> count 0 
> *Oct 23 09:43:07.407: ISAKMP: Deleting peer node by peer_reap for 1.1.1.1: 4A1BDE10 
 
> *Oct 23 09:43:07.407: ISAKMP:(0):deleting node 2134233700 error FALSE reason "IKE deleted" 
 
> *Oct 23 09:43:07.407: ISAKMP:(0):deleting node 1700880190 error FALSE reason "IKE deleted" 
 
> *Oct 23 09:43:07.407: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PHASE1_DEL 
> *Oct 23 09:43:07.407: ISAKMP:(0):Old State = IKE_I_MM1  New State = IKE_DEST_SA

> Получить данные с второй стороны крайне проблематично. Очень хотелось бы найти источник 
> проблемы, чтобы приводить аргументы.

При общении не допускается: неуважительное отношение к собеседнику, хамство, унизительное обращение, ненормативная лексика, переход на личности, агрессивное поведение, обесценивание собеседника, провоцирование флейма голословными и заведомо ложными заявлениями. Не отвечайте на сообщения, явно нарушающие правила - удаляются не только сами нарушения, но и все ответы на них. Лог модерирования.

Партнёры:

Хостинг:

Закладки на сайте
Проследить за страницей

Created 1996-2024 by Maxim Chirkov
Добавить, Поддержать, Вебмастеру