forum.opennet.ru - "Проблема с настройкой L2TP на PIX 515" (9)

форумы

помощь

поиск

регистрация

майллист

вход/выход

слежка

"Проблема с настройкой L2TP на PIX 515"

Форум Маршрутизаторы CISCO и др. оборудование. (VPN, VLAN, туннель)
Вариант для распечатки		Пред. тема \| След. тема
Изначальное сообщение		[ Отслеживать ]

"Проблема с настройкой L2TP на PIX 515"	+/–
Сообщение от don_kuklachev (ok) on 23-Янв-13, 18:05
Столкнулся с проблемой в настройке remote access vpn на PIX. Нужно чтобы работал через стандартный MS VPN client, в дальнейшем android,IOS. Через cisco клиент все прекрасно работает. Настраивать пробовал и через визард АСДМ и через консоль. Проблема как я понял не новая, но решения что то никак не найду. Есть подобная тема http://www.opennet.ru/openforum/vsluhforumID6/11711.html. - вот только товарищ умалчивает как он решил проблему. Делал по анологии с http://www.cisco.com/en/US/products/ps6120/products_configur... Выкладываю свой конфиг: access-list NONAT extended permit ip object-group NET(внутренняя сеть) 172.21.15.0 255.255.255.0 nat(innet1) 0 access-list NONAT ip local pool iphone-pool 172.21.15.10 - 172.21.15.20 mask 255.255.255.0 nat (Asnet) 1 172.21.15.0 255.255.255.224 group-policy DefaultRAGroup internal group-policy DefaultRAGroup attributes vpn-tunnel-protocol IPSec l2tp-ipsec username test pass test crypto ipsec transform-set TRANS_ESP_3DES_MD5 esp-3des esp-md5-hmac crypto ipsec transform-set TRANS_ESP_3DES_MD5 mode transport crypto dynamic-map outside_dyn_map 20 set transform-set TRANS_ESP_3DES_MD5 crypto map office 33 ipsec-isakmp dynamic outside_dyn_map crypto map office interface ASnet crypto isakmp enable ASnet crypto isakmp nat-traversal 20 crypto isakmp policy 40 authentication pre-share encryption 3des hash md5 group 2 lifetime 86400 tunnel-group DefaultRAGroup general-attributes address-pool NET1 default-group-policy DefaultRAGroup tunnel-group DefaultRAGroup ipsec-attributes pre-shared-key * tunnel-group DefaultRAGroup ppp-attributes no authentication chap authentication ms-chap-v2 Настройки MS Vpn клиента как в примере.Выдает ошибку 789. Вот что debug crypto isakmp 7 выдает: Jan 23 13:59:56 [IKEv1]: IP = 95.24.254.251, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 384 Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing SA payload Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, Oakley proposal is acceptable Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing VID payload Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing VID payload Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, Received NAT-Traversal RFC VID Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing VID payload Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, Received NAT-Traversal ver 02 VID Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing VID payload Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, Received Fragmentation VID Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing VID payload Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing VID payload Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing VID payload Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing IKE SA payload Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, IKE SA Proposal # 1, Transform # 5 acceptable Matches global IKE entry # 7 Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, constructing ISAKMP SA payload Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, constructing NAT-Traversal VID ver 02 payload Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, constructing Fragmentation VID + extended capabilities payload Jan 23 13:59:56 [IKEv1]: IP = 95.24.254.251, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 124 Jan 23 13:59:56 [IKEv1]: IP = 95.24.254.251, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + KE (4) + NONCE (10) + NAT-D (130) + NAT-D (130) + NONE (0) total length : 260 Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing ke payload Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing ISA_KE payload Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing nonce payload Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing NAT-Discovery payload Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, computing NAT Discovery hash Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing NAT-Discovery payload Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, computing NAT Discovery hash Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, constructing ke payload Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, constructing nonce payload Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, constructing Cisco Unity VID payload Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, constructing xauth V6 VID payload Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, Send IOS VID Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, Constructing ASA spoofing IOS Vendor ID payload (version: 1.0.0, capabilities: 20000001) Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, constructing VID payload Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, Send Altiga/Cisco VPN3000/Cisco ASA GW VID Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, constructing NAT-Discovery payload Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, computing NAT Discovery hash Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, constructing NAT-Discovery payload Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, computing NAT Discovery hash Jan 23 13:59:56 [IKEv1]: IP = 95.24.254.251, Connection landed on tunnel_group DefaultRAGroup Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, Generating keys for Responder... Jan 23 13:59:56 [IKEv1]: IP = 95.24.254.251, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + KE (4) + NONCE (10) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NAT-D (130) + NAT-D (130) + NONE (0) total length : 304 %PIX-3-713119: Group = DefaultRAGroup, IP = 95.24.254.251, PHASE 1 COMPLETED %PIX-3-713122: IP = 95.24.254.251, Keep-alives configured on but peer does not support keep-alives (type = None) : IP = 95.24.254.251, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + ID (5) + HASH (8) + NONE (0) total length : 64 Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, processing ID payload Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, processing hash payload Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, Computing hash for ISAKMP Jan 23 13:59:56 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, Automatic NAT Detection Status: Remote end IS behind a NAT device This end is NOT behind a NAT device Jan 23 13:59:56 [IKEv1]: IP = 95.24.254.251, Connection landed on tunnel_group DefaultRAGroup Jan 23 13:59:56 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, Freeing previously allocated memory for authorization-dn-attributes Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, constructing ID payload Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, constructing hash payload Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, Computing hash for ISAKMP Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, constructing dpd vid payload Jan 23 13:59:56 [IKEv1]: IP = 95.24.254.251, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + ID (5) + HASH (8) + VENDOR (13) + NONE (0) total length : 84 Jan 23 13:59:56 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, PHASE 1 COMPLETED Jan 23 13:59:56 [IKEv1]: IP = 95.24.254.251, Keep-alive type for this connection: None Jan 23 13:59:56 [IKEv1]: IP = 95.24.254.251, Keep-alives configured on but peer does not support keep-alives (type = None) Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, Starting P1 rekey timer: 21600 seconds. %PIX-3-713902: Group = DefaultRAGroup, IP = 95.24.254.251, QM FSM error (P2 struct &0x2c44938, mess id 0x1)! %PIX-3-713902: Group = DefaultRAGroup, IP = 95.24.254.251, Removing peer from correlator table failed, no match! Jan 23 13:59:56 [IKEv1]: IP = 95.24.254.251, IKE_DECODE RECEIVED Message (msgid=1) with payloads : HDR + HASH (8) + SA (1) + NONCE (10) + ID (5) + ID (5) + NAT-OA (131) + NONE (0) total length : 312 Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, processing hash payload Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, processing SA payload Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, processing nonce payload Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, processing ID payload Jan 23 13:59:56 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, Received remote Proxy Host data in ID Payload: Address 192.168.1.134, Protocol 17, Port 1701 Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, processing ID payload Jan 23 13:59:56 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, Received local Proxy Host data in ID Payload: Address 193.106.72.5, Protocol 17, Port 1701 Jan 23 13:59:56 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, L2TP/IPSec session detected. Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, processing NAT-Original-Address payload Jan 23 13:59:56 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, QM IsRekeyed old sa not found by addr Jan 23 13:59:56 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, Static Crypto Map check, checking map = office, seq = 30... Jan 23 13:59:56 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, Static Crypto Map check, map = office, seq = 30, no ACL configured Jan 23 13:59:56 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, Static Crypto Map check, checking map = office, seq = 31... Jan 23 13:59:56 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, Static Crypto Map check, map = office, seq = 31, ACL does not match proxy IDs src:95.24.254.251 dst:193.106.72.5 Jan 23 13:59:56 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, Static Crypto Map check, checking map = office, seq = 32... Jan 23 13:59:56 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, Static Crypto Map check, map = office, seq = 32, no ACL configured Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, Selecting only UDP-Encapsulated-Tunnel and UDP-Encapsulated-Transport modes defined by NAT-Traversal Jan 23 13:59:56 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, IKE Remote Peer configured for crypto map: DYNMAP Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, processing IPSec SA payload Jan 23 13:59:56 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, All IPSec SA proposals found unacceptable! Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, sending notify message Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, constructing blank hash payload Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, constructing ipsec notify payload for msg id 1 Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, constructing qm hash payload Jan 23 13:59:56 [IKEv1]: IP = 95.24.254.251, IKE_DECODE SENDING Message (msgid=fdf24661) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 84 Jan 23 13:59:56 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, QM FSM error (P2 struct &0x2c44938, mess id 0x1)! Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, IKE QM Responder FSM error history (struct &0x2c44938) <state>, <event>: QM_DONE, EV_ERROR-->QM_BLD_MSG2, EV_NEGO_SA-->QM_BLD_MSG2, EV_IS_REKEY-->QM_BLD_MSG2, EV_CONFIRM_SA-->QM_BLD_MSG2, EV_PROC_MSG-->QM_BLD_MSG2, EV_HASH_OK-->QM_BLD_MSG2, NullEvent-->QM_BLD_MSG2, EV_COMP_HASH Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, sending delete/delete with reason message Jan 23 13:59:56 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, Removing peer from correlator table failed, no match! Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, IKE SA MM:a6345da0 rcv'd Terminate: state MM_ACTIVE flags 0x00000042, refcnt 1, tuncnt 0 Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, IKE SA MM:a6345da0 terminating: flags 0x01000002, refcnt 0, tuncnt 0 Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, sending delete/delete with reason message Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, constructing blank hash payload Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, constructing IKE delete payload Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, constructing qm hash payload Jan 23 13:59:56 [IKEv1]: IP = 95.24.254.251, IKE_DECODE SENDING Message (msgid=4eee6bc6) with payloads : HDR + HASH (8) + DELETE (12) + NONE (0) total length : 80 Jan 23 13:59:56 [IKEv1]: IP = 95.24.254.251, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 384 Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing SA payload Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, Oakley proposal is acceptable Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing VID payload Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing VID payload Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, Received NAT-Traversal RFC VID Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing VID payload Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, Received NAT-Traversal ver 02 VID Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing VID payload Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, Received Fragmentation VID Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing VID payload Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing VID payload Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing VID payload Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing IKE SA payload Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, IKE SA Proposal # 1, Transform # 5 acceptable Matches global IKE entry # 7 Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, constructing ISAKMP SA payload Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, constructing NAT-Traversal VID ver 02 payload Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, constructing Fragmentation VID + extended capabilities payload Jan 23 13:59:56 [IKEv1]: IP = 95.24.254.251, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 124 Jan 23 14:00:04 [IKEv1]: IP = 95.24.254.251, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 124 Jan 23 14:00:12 [IKEv1]: IP = 95.24.254.251, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 124 Debug crypto ipsec 7: %PIX-3-713119: Group = DefaultRAGroup, IP = 95.24.254.251, PHASE 1 COMPLETED %PIX-3-713122: IP = 95.24.254.251, Keep-alives configured on but peer does not support keep-alives (type = None) %PIX-3-713902: Group = DefaultRAGroup, IP = 95.24.254.251, QM FSM error (P2 struct &0x32bc3b0, mess id 0x1)! %PIX-3-713902: Group = DefaultRAGroup, IP = 95.24.254.251, Removing peer from correlator table failed, no match! Проблема как я понимаю во второй фазе. Также не понятно почему PIX ругается на команду: PIX525(config)# crypto map office 33 ipsec-isakmp dynamic outside_dyn_map WARNING: dynamic map has incomplete entries Заранее спасибо, кто не поленился прочитать))
Ответить \| Правка \| Cообщить модератору

Оглавление

Проблема с настройкой L2TP на PIX 515, spiegel, 21:57 , 23-Янв-13, (1)

Проблема с настройкой L2TP на PIX 515, don_kuklachev, 11:38 , 24-Янв-13, (2)

Проблема с настройкой L2TP на PIX 515, don_kuklachev, 12:00 , 24-Янв-13, (3)

Проблема с настройкой L2TP на PIX 515, spiegel, 17:48 , 24-Янв-13, (4)

Проблема с настройкой L2TP на PIX 515, don_kuklachev, 17:57 , 24-Янв-13, (5)

Проблема с настройкой L2TP на PIX 515, don_kuklachev, 17:58 , 24-Янв-13, (6)

Проблема с настройкой L2TP на PIX 515, don_kuklachev, 18:10 , 24-Янв-13, (7)

Проблема с настройкой L2TP на PIX 515, spiegel, 18:35 , 24-Янв-13, (8)

Проблема с настройкой L2TP на PIX 515, spiegel, 18:39 , 24-Янв-13, (9)

Сообщения по теме [Сортировка по времени | RSS]

1. "Проблема с настройкой L2TP на PIX 515" +/–

Сообщение от spiegel (ok) on 23-Янв-13, 21:57

Тут навскидку сразу 2 ошибки:
1.access-list:
Jan 23 13:59:56 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, Static Crypto Map check, map = office, seq = 31, ACL does not match proxy IDs src:95.24.254.251 dst:193.106.72.5
Jan 23 13:59:56 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, Static Crypto Map check, checking map = office, seq = 32...
Jan 23 13:59:56 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, Static Crypto Map check, map = office, seq = 32, no ACL configured
2.ipsec sa не совпадает:
Jan 23 13:59:56 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, All IPSec
SA proposals found unacceptable!
посмотрите, что выдаст deb crypto ipsec

Ответить | Правка | ^ к родителю #0 | Наверх | Cообщить модератору

2. "Проблема с настройкой L2TP на PIX 515" +/–

Сообщение от don_kuklachev (ok) on 24-Янв-13, 11:38

1. В crypto map office действительно висел еще один dynamic map под номером 40 и 2 static под номерами 30 и 31. Поставил crypto map office 10 ipsec-isakmp dynamic outside_dyn_map.
debug crypto isakmp:
Jan 24 11:01:35 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, IKE Remote Peer configured for crypto map: outside_dyn_map
Jan 24 11:01:35 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, processing IPSec SA payload
Jan 24 11:01:35 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, All IPSec SA proposals found unacceptable!
Jan 24 11:01:35 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, sending notify message
Jan 24 11:01:35 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, constructing blank hash payload
Jan 24 11:01:35 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, constructing ipsec notify payload for msg id 1
Jan 24 11:01:35 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, constructing qm hash payload
Jan 24 11:01:35 [IKEv1]: IP = 95.24.254.251, IKE_DECODE SENDING Message (msgid=2f12737a) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 84
Jan 24 11:01:35 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, QM FSM error (P2 struct &0x2c9d860, mess id 0x1)!
Jan 24 11:01:35 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, IKE QM Responder FSM error history (struct &0x2c9d860)  <state>, <event>:  QM_DONE, EV_ERROR-->QM_BLD_MSG2, EV_NEGO_SA-->QM_BLD_MSG2, EV_IS_REKEY-->QM_BLD_MSG2, EV_CONFIRM_SA-->QM_BLD_MSG2, EV_PROC_MSG-->QM_BLD_MSG2, EV_HASH_OK-->QM_BLD_MSG2, NullEvent-->QM_BLD_MSG2, EV_COMP_HASH
Jan 24 11:01:35 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, sending delete/delete with reason message
Jan 24 11:01:35 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, Removing peer from correlator table failed, no match!
Jan 24 11:01:35 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, IKE SA MM:e260abc8 rcv'd Terminate: state MM_ACTIVE  flags 0x00000042, refcnt 1, tuncnt 0
Jan 24 11:01:35 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, IKE SA MM:e260abc8 terminating:  flags 0x01000002, refcnt 0, tuncnt 0
Jan 24 11:01:35 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, sending delete/delete with reason message
Jan 24 11:01:35 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, constructing blank hash payload
Jan 24 11:01:35 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, constructing IKE delete payload
Jan 24 11:01:35 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, constructing qm hash payload
Jan 24 11:01:35 [IKEv1]: IP = 95.24.254.251, IKE_DECODE SENDING Message (msgid=80e69a1) with payloads : HDR + HASH (8) + DELETE (12) + NONE (0) total length : 80
Jan 24 11:01:36 [IKEv1]: IP = 95.24.254.251, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 384
Jan 24 11:01:36 [IKEv1 DEBUG]: IP = 95.24.254.251, processing SA payload
Jan 24 11:01:36 [IKEv1 DEBUG]: IP = 95.24.254.251, Oakley proposal is acceptable
Jan 24 11:01:36 [IKEv1 DEBUG]: IP = 95.24.254.251, processing VID payload
Jan 24 11:01:36 [IKEv1 DEBUG]: IP = 95.24.254.251, processing VID payload
Jan 24 11:01:36 [IKEv1 DEBUG]: IP = 95.24.254.251, Received NAT-Traversal RFC VID
Jan 24 11:01:36 [IKEv1 DEBUG]: IP = 95.24.254.251, processing VID payload
Jan 24 11:01:36 [IKEv1 DEBUG]: IP = 95.24.254.251, Received NAT-Traversal ver 02 VID
Jan 24 11:01:36 [IKEv1 DEBUG]: IP = 95.24.254.251, processing VID payload
Jan 24 11:01:36 [IKEv1 DEBUG]: IP = 95.24.254.251, Received Fragmentation VID
Jan 24 11:01:36 [IKEv1 DEBUG]: IP = 95.24.254.251, processing VID payload
Jan 24 11:01:36 [IKEv1 DEBUG]: IP = 95.24.254.251, processing VID payload
Jan 24 11:01:36 [IKEv1 DEBUG]: IP = 95.24.254.251, processing VID payload
Jan 24 11:01:36 [IKEv1 DEBUG]: IP = 95.24.254.251, processing IKE SA payload
Jan 24 11:01:36 [IKEv1 DEBUG]: IP = 95.24.254.251, IKE SA Proposal # 1, Transform # 5 acceptable  Matches global IKE entry # 7
Jan 24 11:01:36 [IKEv1 DEBUG]: IP = 95.24.254.251, constructing ISAKMP SA payload
Jan 24 11:01:36 [IKEv1 DEBUG]: IP = 95.24.254.251, constructing NAT-Traversal VID ver 02 payload
Jan 24 11:01:36 [IKEv1 DEBUG]: IP = 95.24.254.251, constructing Fragmentation VID + extended capabilities payload
Jan 24 11:01:36 [IKEv1]: IP = 95.24.254.251, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 124
Jan 24 11:01:44 [IKEv1]: IP = 95.24.254.251, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 124
Jan 24 11:01:52 [IKEv1]: IP = 95.24.254.251, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 124
Jan 24 11:02:00 [IKEv1]: IP = 95.24.254.251, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 124
%PIX-3-713902: IP = 95.24.254.251, Removing peer from peer table failed, no match!
Jan 24 11:02:08 [IKEv1 DEBUG]: IP = 95.24.254.251, IKE MM Responder FSM error history (struct &0x35f96c0)  <state>, <event>:  MM_DONE, EV_ERROR-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent-->MM_SND_MSG2, EV_SND_MSG-->MM_SND_MSG2, EV_START_TMR-->MM_SND_MSG2, EV_RESEND_MSG-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent
Jan 24 11:02:08 [IKEv1 DEBUG]: IP = 95.24.254.251, IKE SA MM:32643119 terminating:  flags 0x01000002, refcnt 0, tuncnt 0
Jan 24 11:02:08 [IKEv1 DEBUG]: IP = 95.24.254.251, sending delete/delete with reason message
Jan 24 11:02:08 [IKEv1]: IP = 95.24.254.251, Removing peer from peer table failed, no match!
Jan 24 11:02:08 [IKEv1]: IP = 95.24.254.251, Error: Unable to remove PeerTblEntry
debug crypto ipsec при этом выдает тоже самое:
%PIX-3-713119: Group = DefaultRAGroup, IP = 95.24.254.251, PHASE 1 COMPLETED
%PIX-3-713122: IP = 95.24.254.251, Keep-alives configured on but peer does not support keep-alives (type = None)
%PIX-3-713902: Group = DefaultRAGroup, IP = 95.24.254.251, QM FSM error (P2 struct &0x2d445c0, mess id 0x1)!
%PIX-3-713902: Group = DefaultRAGroup, IP = 95.24.254.251, Removing peer from correlator table failed, no match!
Через android пробовал подключаться, вроде лучше, но все равно не подключает
debug crypto ipsec
%PIX-3-713119: Group = DefaultRAGroup, IP = 83.149.9.16, PHASE 1 COMPLETED
IPSEC: New embryonic SA created @ 0x03479028,
    SCB: 0x027A7AF0,
    Direction: inbound
    SPI      : 0x678D8C87
    Session ID: 0x00000234
    VPIF num  : 0x00000001
    Tunnel type: ra
    Protocol   : esp
    Lifetime   : 240 seconds
IPSEC: New embryonic SA created @ 0x034B2EF8,
    SCB: 0x02D030F0,
    Direction: outbound
    SPI      : 0x00674805
    Session ID: 0x00000234
    VPIF num  : 0x00000001
    Tunnel type: ra
    Protocol   : esp
    Lifetime   : 240 seconds
IPSEC: Completed host OBSA update, SPI 0x00674805
IPSEC: Creating outbound VPN context, SPI 0x00674805
    Flags: 0x00000225
    SA   : 0x034B2EF8
    SPI  : 0x00674805
    MTU  : 1500 bytes
    VCID : 0x00000000
    Peer : 0x00000000
    SCB  : 0x02D030F0
    Channel: 0x01765858
IPSEC: Completed outbound VPN context, SPI 0x00674805
    VPN handle: 0x01964BF4
IPSEC: New outbound encrypt rule, SPI 0x00674805
    Src addr: 193.106.72.5
    Src mask: 255.255.255.255
    Dst addr: 83.149.9.16
    Dst mask: 255.255.255.255
    Src ports
      Upper: 1701
      Lower: 1701
      Op   : equal
    Dst ports
      Upper: 3427
      Lower: 3427
      Op   : equal
    Protocol: 17
    Use protocol: true
    SPI: 0x00000000
    Use SPI: false
IPSEC: Completed outbound encrypt rule, SPI 0x00674805
    Rule ID: 0x0352DA90
IPSEC: New outbound permit rule, SPI 0x00674805
    Src addr: 193.106.72.5
    Src mask: 255.255.255.255
    Dst addr: 83.149.9.16
    Dst mask: 255.255.255.255
    Src ports
      Upper: 4500
      Lower: 4500
      Op   : equal
    Dst ports
      Upper: 3427
      Lower: 3427
      Op   : equal
    Protocol: 17
    Use protocol: true
    SPI: 0x00000000
    Use SPI: false
IPSEC: Completed outbound permit rule, SPI 0x00674805
    Rule ID: 0x036FC3E8
IPSEC: Completed host IBSA update, SPI 0x678D8C87
IPSEC: Creating inbound VPN context, SPI 0x678D8C87
    Flags: 0x00000226
    SA   : 0x03479028
    SPI  : 0x678D8C87
    MTU  : 0 bytes
    VCID : 0x00000000
    Peer : 0x01964BF4
    SCB  : 0x027A7AF0
    Channel: 0x01765858
IPSEC: Completed inbound VPN context, SPI 0x678D8C87
    VPN handle: 0x0196B614
IPSEC: Updating outbound VPN context 0x01964BF4, SPI 0x00674805
    Flags: 0x00000225
    SA   : 0x034B2EF8
    SPI  : 0x00674805
    MTU  : 1500 bytes
    VCID : 0x00000000
    Peer : 0x0196B614
    SCB  : 0x02D030F0
    Channel: 0x01765858
IPSEC: Completed outbound VPN context, SPI 0x00674805
    VPN handle: 0x01964BF4
IPSEC: Completed outbound inner rule, SPI 0x00674805
    Rule ID: 0x0352DA90
IPSEC: Completed outbound outer SPD rule, SPI 0x00674805
    Rule ID: 0x036FC3E8
IPSEC: New inbound tunnel flow rule, SPI 0x678D8C87
    Src addr: 83.149.9.16
    Src mask: 255.255.255.255
    Dst addr: 193.106.72.5
    Dst mask: 255.255.255.255
    Src ports
      Upper: 0
      Lower: 0
      Op   : ignore
    Dst ports
      Upper: 1701
      Lower: 1701
      Op   : equal
    Protocol: 17
    Use protocol: true
    SPI: 0x00000000
    Use SPI: false
IPSEC: Completed inbound tunnel flow rule, SPI 0x678D8C87
    Rule ID: 0x02BDCD08
IPSEC: New inbound decrypt rule, SPI 0x678D8C87
    Src addr: 83.149.9.16
    Src mask: 255.255.255.255
    Dst addr: 193.106.72.5
    Dst mask: 255.255.255.255
    Src ports
      Upper: 3427
      Lower: 3427
      Op   : equal
    Dst ports
      Upper: 4500
      Lower: 4500
      Op   : equal
    Protocol: 17
    Use protocol: true
    SPI: 0x00000000
    Use SPI: false
IPSEC: Completed inbound decrypt rule, SPI 0x678D8C87
    Rule ID: 0x032090F8
IPSEC: New inbound permit rule, SPI 0x678D8C87
    Src addr: 83.149.9.16
    Src mask: 255.255.255.255
    Dst addr: 193.106.72.5
    Dst mask: 255.255.255.255
    Src ports
      Upper: 3427
      Lower: 3427
      Op   : equal
    Dst ports
      Upper: 4500
      Lower: 4500
      Op   : equal
    Protocol: 17
    Use protocol: true
    SPI: 0x00000000
    Use SPI: false
IPSEC: Completed inbound permit rule, SPI 0x678D8C87
    Rule ID: 0x0356CF48
IPSEC: Deleted inbound decrypt rule, SPI 0x678D8C87
    Rule ID: 0x032090F8
IPSEC: Deleted inbound permit rule, SPI 0x678D8C87
    Rule ID: 0x0356CF48
IPSEC: Deleted inbound tunnel flow rule, SPI 0x678D8C87
    Rule ID: 0x02BDCD08
IPSEC: Deleted inbound VPN context, SPI 0x678D8C87
    VPN handle: 0x0196B614
IPSEC: Deleted outbound encrypt rule, SPI 0x00674805
    Rule ID: 0x0352DA90
IPSEC: Deleted outbound permit rule, SPI 0x00674805
    Rule ID: 0x036FC3E8
IPSEC: Deleted outbound VPN context, SPI 0x00674805
    VPN handle: 0x01964BF4
А по пункту 2 я не очень понял почему так происходит, что посоветуете? При подключении через смартфон такой дебаг такое не выдает

Ответить | Правка | ^ к родителю #1 | Наверх | Cообщить модератору

3. "Проблема с настройкой L2TP на PIX 515" +/–

Сообщение от don_kuklachev (ok) on 24-Янв-13, 12:00

>>2.ipsec sa не совпадает:
Jan 23 13:59:56 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, All IPSec
SA proposals found unacceptable!
с этим разобрался -добавил еще один transform-set esp-3des esp-sha-hmac
Винда стала выдавать 691 ошибку - пароль конечно верный.
Debug crypto ipsec
%PIX-3-713119: Group = DefaultRAGroup, IP = 95.24.254.251, PHASE 1 COMPLETED
%PIX-3-713122: IP = 95.24.254.251, Keep-alives configured on but peer does not support keep-alives (type = None)
IPSEC: New embryonic SA created @ 0x0396CCA8,
    SCB: 0x02D0ADE8,
    Direction: inbound
    SPI      : 0xD661ABA1
    Session ID: 0x00000246
    VPIF num  : 0x00000001
    Tunnel type: ra
    Protocol   : esp
    Lifetime   : 240 seconds
IPSEC: New embryonic SA created @ 0x03479028,
    SCB: 0x030E8618,
    Direction: outbound
    SPI      : 0xB620C9AD
    Session ID: 0x00000246
    VPIF num  : 0x00000001
    Tunnel type: ra
    Protocol   : esp
    Lifetime   : 240 seconds
IPSEC: Completed host OBSA update, SPI 0xB620C9AD
IPSEC: Creating outbound VPN context, SPI 0xB620C9AD
    Flags: 0x00000225
    SA   : 0x03479028
    SPI  : 0xB620C9AD
    MTU  : 1500 bytes
    VCID : 0x00000000
    Peer : 0x00000000
    SCB  : 0x030E8618
    Channel: 0x01765858
IPSEC: Completed outbound VPN context, SPI 0xB620C9AD
    VPN handle: 0x019C6F14
IPSEC: New outbound encrypt rule, SPI 0xB620C9AD
    Src addr: 193.106.72.5
    Src mask: 255.255.255.255
    Dst addr: 95.24.254.251
    Dst mask: 255.255.255.255
    Src ports
      Upper: 1701
      Lower: 1701
      Op   : equal
    Dst ports
      Upper: 4500
      Lower: 4500
      Op   : equal
    Protocol: 17
    Use protocol: true
    SPI: 0x00000000
    Use SPI: false
IPSEC: Completed outbound encrypt rule, SPI 0xB620C9AD
    Rule ID: 0x02AA2638
IPSEC: New outbound permit rule, SPI 0xB620C9AD
    Src addr: 193.106.72.5
    Src mask: 255.255.255.255
    Dst addr: 95.24.254.251
    Dst mask: 255.255.255.255
    Src ports
      Upper: 4500
      Lower: 4500
      Op   : equal
    Dst ports
      Upper: 4500
      Lower: 4500
      Op   : equal
    Protocol: 17
    Use protocol: true
    SPI: 0x00000000
    Use SPI: false
IPSEC: Completed outbound permit rule, SPI 0xB620C9AD
    Rule ID: 0x033DB2C8
IPSEC: Completed host IBSA update, SPI 0xD661ABA1
IPSEC: Creating inbound VPN context, SPI 0xD661ABA1
    Flags: 0x00000226
    SA   : 0x0396CCA8
    SPI  : 0xD661ABA1
    MTU  : 0 bytes
    VCID : 0x00000000
    Peer : 0x019C6F14
    SCB  : 0x02D0ADE8
    Channel: 0x01765858
IPSEC: Completed inbound VPN context, SPI 0xD661ABA1
    VPN handle: 0x019CAAB4
IPSEC: Updating outbound VPN context 0x019C6F14, SPI 0xB620C9AD
    Flags: 0x00000225
    SA   : 0x03479028
    SPI  : 0xB620C9AD
    MTU  : 1500 bytes
    VCID : 0x00000000
    Peer : 0x019CAAB4
    SCB  : 0x030E8618
    Channel: 0x01765858
IPSEC: Completed outbound VPN context, SPI 0xB620C9AD
    VPN handle: 0x019C6F14
IPSEC: Completed outbound inner rule, SPI 0xB620C9AD
    Rule ID: 0x02AA2638
IPSEC: Completed outbound outer SPD rule, SPI 0xB620C9AD
    Rule ID: 0x033DB2C8
IPSEC: New inbound tunnel flow rule, SPI 0xD661ABA1
    Src addr: 95.24.254.251
    Src mask: 255.255.255.255
    Dst addr: 193.106.72.5
    Dst mask: 255.255.255.255
    Src ports
      Upper: 0
      Lower: 0
      Op   : ignore
    Dst ports
      Upper: 1701
      Lower: 1701
      Op   : equal
    Protocol: 17
    Use protocol: true
    SPI: 0x00000000
    Use SPI: false
IPSEC: Completed inbound tunnel flow rule, SPI 0xD661ABA1
    Rule ID: 0x035910D0
IPSEC: New inbound decrypt rule, SPI 0xD661ABA1
    Src addr: 95.24.254.251
    Src mask: 255.255.255.255
    Dst addr: 193.106.72.5
    Dst mask: 255.255.255.255
    Src ports
      Upper: 4500
      Lower: 4500
      Op   : equal
    Dst ports
      Upper: 4500
      Lower: 4500
      Op   : equal
    Protocol: 17
    Use protocol: true
    SPI: 0x00000000
    Use SPI: false
IPSEC: Completed inbound decrypt rule, SPI 0xD661ABA1
    Rule ID: 0x03537120
IPSEC: New inbound permit rule, SPI 0xD661ABA1
    Src addr: 95.24.254.251
    Src mask: 255.255.255.255
    Dst addr: 193.106.72.5
    Dst mask: 255.255.255.255
    Src ports
      Upper: 4500
      Lower: 4500
      Op   : equal
    Dst ports
      Upper: 4500
      Lower: 4500
      Op   : equal
    Protocol: 17
    Use protocol: true
    SPI: 0x00000000
    Use SPI: false
IPSEC: Completed inbound permit rule, SPI 0xD661ABA1
    Rule ID: 0x029F87E8
IPSEC: Deleted inbound decrypt rule, SPI 0xD661ABA1
    Rule ID: 0x03537120
IPSEC: Deleted inbound permit rule, SPI 0xD661ABA1
    Rule ID: 0x029F87E8
IPSEC: Deleted inbound tunnel flow rule, SPI 0xD661ABA1
    Rule ID: 0x035910D0
IPSEC: Deleted inbound VPN context, SPI 0xD661ABA1
    VPN handle: 0x019CAAB4
IPSEC: Deleted outbound encrypt rule, SPI 0xB620C9AD
    Rule ID: 0x02AA2638
IPSEC: Deleted outbound permit rule, SPI 0xB620C9AD
    Rule ID: 0x033DB2C8
IPSEC: Deleted outbound VPN context, SPI 0xB620C9AD
    VPN handle: 0x019C6F14

Ответить | Правка | ^ к родителю #2 | Наверх | Cообщить модератору

4. "Проблема с настройкой L2TP на PIX 515" +/–

Сообщение от spiegel (ok) on 24-Янв-13, 17:48

>[оверквотинг удален]
> IPSEC: Deleted inbound tunnel flow rule, SPI 0xD661ABA1
>     Rule ID: 0x035910D0
> IPSEC: Deleted inbound VPN context, SPI 0xD661ABA1
>     VPN handle: 0x019CAAB4
> IPSEC: Deleted outbound encrypt rule, SPI 0xB620C9AD
>     Rule ID: 0x02AA2638
> IPSEC: Deleted outbound permit rule, SPI 0xB620C9AD
>     Rule ID: 0x033DB2C8
> IPSEC: Deleted outbound VPN context, SPI 0xB620C9AD
>     VPN handle: 0x019C6F14
проверил ваш конфиг на GNS3. Вначале не пошло, но после:
username igor password cisco  mschap
все заработало!
Проверял на XP, на 7 не работает. Также надо отключить службу cisco vpn client, если он конечно установлен.

Ответить | Правка | ^ к родителю #3 | Наверх | Cообщить модератору

5. "Проблема с настройкой L2TP на PIX 515" +/–

Сообщение от don_kuklachev (ok) on 24-Янв-13, 17:57

>[оверквотинг удален]
>>     Rule ID: 0x02AA2638
>> IPSEC: Deleted outbound permit rule, SPI 0xB620C9AD
>>     Rule ID: 0x033DB2C8
>> IPSEC: Deleted outbound VPN context, SPI 0xB620C9AD
>>     VPN handle: 0x019C6F14
> проверил ваш конфиг на GNS3. Вначале не пошло, но после:
> username igor password cisco  mschap
> все заработало!
> Проверял на XP, на 7 не работает. Также надо отключить службу cisco
> vpn client, если он конечно установлен.
Благодарю, час назад тоже разобрался- достаточно было добавить mschap к логину)

Ответить | Правка | ^ к родителю #4 | Наверх | Cообщить модератору

6. "Проблема с настройкой L2TP на PIX 515" +/–

Сообщение от don_kuklachev (ok) on 24-Янв-13, 17:58

>[оверквотинг удален]
>>> IPSEC: Deleted outbound permit rule, SPI 0xB620C9AD
>>>     Rule ID: 0x033DB2C8
>>> IPSEC: Deleted outbound VPN context, SPI 0xB620C9AD
>>>     VPN handle: 0x019C6F14
>> проверил ваш конфиг на GNS3. Вначале не пошло, но после:
>> username igor password cisco  mschap
>> все заработало!
>> Проверял на XP, на 7 не работает. Также надо отключить службу cisco
>> vpn client, если он конечно установлен.
> Благодарю, час назад тоже разобрался- достаточно было добавить mschap к логину)
на андроиде тоже полет нормальный

Ответить | Правка | ^ к родителю #5 | Наверх | Cообщить модератору

7. "Проблема с настройкой L2TP на PIX 515" +/–

Сообщение от don_kuklachev (ok) on 24-Янв-13, 18:10

>[оверквотинг удален]
>>     Rule ID: 0x035910D0
>> IPSEC: Deleted inbound VPN context, SPI 0xD661ABA1
>>     VPN handle: 0x019CAAB4
>> IPSEC: Deleted outbound encrypt rule, SPI 0xB620C9AD
>>     Rule ID: 0x02AA2638
>> IPSEC: Deleted outbound permit rule, SPI 0xB620C9AD
>>     Rule ID: 0x033DB2C8
>> IPSEC: Deleted outbound VPN context, SPI 0xB620C9AD
>>     VPN handle: 0x019C6F14
> проверил ваш конфиг на GNS3. Вначале не пошло, но после:
А как вы собрали такую схему в gns, поделитесь? PIX-router-cloud?

Ответить | Правка | ^ к родителю #4 | Наверх | Cообщить модератору

8. "Проблема с настройкой L2TP на PIX 515" +/–

Сообщение от spiegel (ok) on 24-Янв-13, 18:35

>[оверквотинг удален]
>>> IPSEC: Deleted inbound VPN context, SPI 0xD661ABA1
>>>     VPN handle: 0x019CAAB4
>>> IPSEC: Deleted outbound encrypt rule, SPI 0xB620C9AD
>>>     Rule ID: 0x02AA2638
>>> IPSEC: Deleted outbound permit rule, SPI 0xB620C9AD
>>>     Rule ID: 0x033DB2C8
>>> IPSEC: Deleted outbound VPN context, SPI 0xB620C9AD
>>>     VPN handle: 0x019C6F14
>> проверил ваш конфиг на GNS3. Вначале не пошло, но после:
> А как вы собрали такую схему в gns, поделитесь? PIX-router-cloud?
pix-host(vmnet1). vmnet1 - адаптер от VMWare, к нему подключен WinXP на виртуалке.

Ответить | Правка | ^ к родителю #7 | Наверх | Cообщить модератору

9. "Проблема с настройкой L2TP на PIX 515" +/–

Сообщение от spiegel (ok) on 24-Янв-13, 18:39

>[оверквотинг удален]
>>>>     VPN handle: 0x019CAAB4
>>>> IPSEC: Deleted outbound encrypt rule, SPI 0xB620C9AD
>>>>     Rule ID: 0x02AA2638
>>>> IPSEC: Deleted outbound permit rule, SPI 0xB620C9AD
>>>>     Rule ID: 0x033DB2C8
>>>> IPSEC: Deleted outbound VPN context, SPI 0xB620C9AD
>>>>     VPN handle: 0x019C6F14
>>> проверил ваш конфиг на GNS3. Вначале не пошло, но после:
>> А как вы собрали такую схему в gns, поделитесь? PIX-router-cloud?
> pix-host(vmnet1). vmnet1 - адаптер от VMWare, к нему подключен WinXP на виртуалке.
точнее pix-switch-host. Напрямую не разрешает.

Ответить | Правка | ^ к родителю #8 | Наверх | Cообщить модератору

Архив | Удалить

Рекомендовать для помещения в FAQ | Индекс форумов | Темы | Пред. тема | След. тема

Партнёры:

Хостинг:

Закладки на сайте
Проследить за страницей

Created 1996-2024 by Maxim Chirkov
Добавить, Поддержать, Вебмастеру

1. "Проблема с настройкой L2TP на PIX 515"	+/–
Сообщение от spiegel (ok) on 23-Янв-13, 21:57
Тут навскидку сразу 2 ошибки: 1.access-list: Jan 23 13:59:56 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, Static Crypto Map check, map = office, seq = 31, ACL does not match proxy IDs src:95.24.254.251 dst:193.106.72.5 Jan 23 13:59:56 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, Static Crypto Map check, checking map = office, seq = 32... Jan 23 13:59:56 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, Static Crypto Map check, map = office, seq = 32, no ACL configured 2.ipsec sa не совпадает: Jan 23 13:59:56 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, All IPSec SA proposals found unacceptable! посмотрите, что выдаст deb crypto ipsec
Ответить \| Правка \| ^ к родителю #0 \| Наверх \| Cообщить модератору


	2. "Проблема с настройкой L2TP на PIX 515"	+/–
	Сообщение от don_kuklachev (ok) on 24-Янв-13, 11:38
	1. В crypto map office действительно висел еще один dynamic map под номером 40 и 2 static под номерами 30 и 31. Поставил crypto map office 10 ipsec-isakmp dynamic outside_dyn_map. debug crypto isakmp: Jan 24 11:01:35 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, IKE Remote Peer configured for crypto map: outside_dyn_map Jan 24 11:01:35 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, processing IPSec SA payload Jan 24 11:01:35 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, All IPSec SA proposals found unacceptable! Jan 24 11:01:35 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, sending notify message Jan 24 11:01:35 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, constructing blank hash payload Jan 24 11:01:35 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, constructing ipsec notify payload for msg id 1 Jan 24 11:01:35 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, constructing qm hash payload Jan 24 11:01:35 [IKEv1]: IP = 95.24.254.251, IKE_DECODE SENDING Message (msgid=2f12737a) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 84 Jan 24 11:01:35 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, QM FSM error (P2 struct &0x2c9d860, mess id 0x1)! Jan 24 11:01:35 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, IKE QM Responder FSM error history (struct &0x2c9d860) <state>, <event>: QM_DONE, EV_ERROR-->QM_BLD_MSG2, EV_NEGO_SA-->QM_BLD_MSG2, EV_IS_REKEY-->QM_BLD_MSG2, EV_CONFIRM_SA-->QM_BLD_MSG2, EV_PROC_MSG-->QM_BLD_MSG2, EV_HASH_OK-->QM_BLD_MSG2, NullEvent-->QM_BLD_MSG2, EV_COMP_HASH Jan 24 11:01:35 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, sending delete/delete with reason message Jan 24 11:01:35 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, Removing peer from correlator table failed, no match! Jan 24 11:01:35 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, IKE SA MM:e260abc8 rcv'd Terminate: state MM_ACTIVE flags 0x00000042, refcnt 1, tuncnt 0 Jan 24 11:01:35 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, IKE SA MM:e260abc8 terminating: flags 0x01000002, refcnt 0, tuncnt 0 Jan 24 11:01:35 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, sending delete/delete with reason message Jan 24 11:01:35 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, constructing blank hash payload Jan 24 11:01:35 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, constructing IKE delete payload Jan 24 11:01:35 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, constructing qm hash payload Jan 24 11:01:35 [IKEv1]: IP = 95.24.254.251, IKE_DECODE SENDING Message (msgid=80e69a1) with payloads : HDR + HASH (8) + DELETE (12) + NONE (0) total length : 80 Jan 24 11:01:36 [IKEv1]: IP = 95.24.254.251, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 384 Jan 24 11:01:36 [IKEv1 DEBUG]: IP = 95.24.254.251, processing SA payload Jan 24 11:01:36 [IKEv1 DEBUG]: IP = 95.24.254.251, Oakley proposal is acceptable Jan 24 11:01:36 [IKEv1 DEBUG]: IP = 95.24.254.251, processing VID payload Jan 24 11:01:36 [IKEv1 DEBUG]: IP = 95.24.254.251, processing VID payload Jan 24 11:01:36 [IKEv1 DEBUG]: IP = 95.24.254.251, Received NAT-Traversal RFC VID Jan 24 11:01:36 [IKEv1 DEBUG]: IP = 95.24.254.251, processing VID payload Jan 24 11:01:36 [IKEv1 DEBUG]: IP = 95.24.254.251, Received NAT-Traversal ver 02 VID Jan 24 11:01:36 [IKEv1 DEBUG]: IP = 95.24.254.251, processing VID payload Jan 24 11:01:36 [IKEv1 DEBUG]: IP = 95.24.254.251, Received Fragmentation VID Jan 24 11:01:36 [IKEv1 DEBUG]: IP = 95.24.254.251, processing VID payload Jan 24 11:01:36 [IKEv1 DEBUG]: IP = 95.24.254.251, processing VID payload Jan 24 11:01:36 [IKEv1 DEBUG]: IP = 95.24.254.251, processing VID payload Jan 24 11:01:36 [IKEv1 DEBUG]: IP = 95.24.254.251, processing IKE SA payload Jan 24 11:01:36 [IKEv1 DEBUG]: IP = 95.24.254.251, IKE SA Proposal # 1, Transform # 5 acceptable Matches global IKE entry # 7 Jan 24 11:01:36 [IKEv1 DEBUG]: IP = 95.24.254.251, constructing ISAKMP SA payload Jan 24 11:01:36 [IKEv1 DEBUG]: IP = 95.24.254.251, constructing NAT-Traversal VID ver 02 payload Jan 24 11:01:36 [IKEv1 DEBUG]: IP = 95.24.254.251, constructing Fragmentation VID + extended capabilities payload Jan 24 11:01:36 [IKEv1]: IP = 95.24.254.251, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 124 Jan 24 11:01:44 [IKEv1]: IP = 95.24.254.251, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 124 Jan 24 11:01:52 [IKEv1]: IP = 95.24.254.251, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 124 Jan 24 11:02:00 [IKEv1]: IP = 95.24.254.251, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 124 %PIX-3-713902: IP = 95.24.254.251, Removing peer from peer table failed, no match! Jan 24 11:02:08 [IKEv1 DEBUG]: IP = 95.24.254.251, IKE MM Responder FSM error history (struct &0x35f96c0) <state>, <event>: MM_DONE, EV_ERROR-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent-->MM_SND_MSG2, EV_SND_MSG-->MM_SND_MSG2, EV_START_TMR-->MM_SND_MSG2, EV_RESEND_MSG-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent Jan 24 11:02:08 [IKEv1 DEBUG]: IP = 95.24.254.251, IKE SA MM:32643119 terminating: flags 0x01000002, refcnt 0, tuncnt 0 Jan 24 11:02:08 [IKEv1 DEBUG]: IP = 95.24.254.251, sending delete/delete with reason message Jan 24 11:02:08 [IKEv1]: IP = 95.24.254.251, Removing peer from peer table failed, no match! Jan 24 11:02:08 [IKEv1]: IP = 95.24.254.251, Error: Unable to remove PeerTblEntry debug crypto ipsec при этом выдает тоже самое: %PIX-3-713119: Group = DefaultRAGroup, IP = 95.24.254.251, PHASE 1 COMPLETED %PIX-3-713122: IP = 95.24.254.251, Keep-alives configured on but peer does not support keep-alives (type = None) %PIX-3-713902: Group = DefaultRAGroup, IP = 95.24.254.251, QM FSM error (P2 struct &0x2d445c0, mess id 0x1)! %PIX-3-713902: Group = DefaultRAGroup, IP = 95.24.254.251, Removing peer from correlator table failed, no match! Через android пробовал подключаться, вроде лучше, но все равно не подключает debug crypto ipsec %PIX-3-713119: Group = DefaultRAGroup, IP = 83.149.9.16, PHASE 1 COMPLETED IPSEC: New embryonic SA created @ 0x03479028, SCB: 0x027A7AF0, Direction: inbound SPI : 0x678D8C87 Session ID: 0x00000234 VPIF num : 0x00000001 Tunnel type: ra Protocol : esp Lifetime : 240 seconds IPSEC: New embryonic SA created @ 0x034B2EF8, SCB: 0x02D030F0, Direction: outbound SPI : 0x00674805 Session ID: 0x00000234 VPIF num : 0x00000001 Tunnel type: ra Protocol : esp Lifetime : 240 seconds IPSEC: Completed host OBSA update, SPI 0x00674805 IPSEC: Creating outbound VPN context, SPI 0x00674805 Flags: 0x00000225 SA : 0x034B2EF8 SPI : 0x00674805 MTU : 1500 bytes VCID : 0x00000000 Peer : 0x00000000 SCB : 0x02D030F0 Channel: 0x01765858 IPSEC: Completed outbound VPN context, SPI 0x00674805 VPN handle: 0x01964BF4 IPSEC: New outbound encrypt rule, SPI 0x00674805 Src addr: 193.106.72.5 Src mask: 255.255.255.255 Dst addr: 83.149.9.16 Dst mask: 255.255.255.255 Src ports Upper: 1701 Lower: 1701 Op : equal Dst ports Upper: 3427 Lower: 3427 Op : equal Protocol: 17 Use protocol: true SPI: 0x00000000 Use SPI: false IPSEC: Completed outbound encrypt rule, SPI 0x00674805 Rule ID: 0x0352DA90 IPSEC: New outbound permit rule, SPI 0x00674805 Src addr: 193.106.72.5 Src mask: 255.255.255.255 Dst addr: 83.149.9.16 Dst mask: 255.255.255.255 Src ports Upper: 4500 Lower: 4500 Op : equal Dst ports Upper: 3427 Lower: 3427 Op : equal Protocol: 17 Use protocol: true SPI: 0x00000000 Use SPI: false IPSEC: Completed outbound permit rule, SPI 0x00674805 Rule ID: 0x036FC3E8 IPSEC: Completed host IBSA update, SPI 0x678D8C87 IPSEC: Creating inbound VPN context, SPI 0x678D8C87 Flags: 0x00000226 SA : 0x03479028 SPI : 0x678D8C87 MTU : 0 bytes VCID : 0x00000000 Peer : 0x01964BF4 SCB : 0x027A7AF0 Channel: 0x01765858 IPSEC: Completed inbound VPN context, SPI 0x678D8C87 VPN handle: 0x0196B614 IPSEC: Updating outbound VPN context 0x01964BF4, SPI 0x00674805 Flags: 0x00000225 SA : 0x034B2EF8 SPI : 0x00674805 MTU : 1500 bytes VCID : 0x00000000 Peer : 0x0196B614 SCB : 0x02D030F0 Channel: 0x01765858 IPSEC: Completed outbound VPN context, SPI 0x00674805 VPN handle: 0x01964BF4 IPSEC: Completed outbound inner rule, SPI 0x00674805 Rule ID: 0x0352DA90 IPSEC: Completed outbound outer SPD rule, SPI 0x00674805 Rule ID: 0x036FC3E8 IPSEC: New inbound tunnel flow rule, SPI 0x678D8C87 Src addr: 83.149.9.16 Src mask: 255.255.255.255 Dst addr: 193.106.72.5 Dst mask: 255.255.255.255 Src ports Upper: 0 Lower: 0 Op : ignore Dst ports Upper: 1701 Lower: 1701 Op : equal Protocol: 17 Use protocol: true SPI: 0x00000000 Use SPI: false IPSEC: Completed inbound tunnel flow rule, SPI 0x678D8C87 Rule ID: 0x02BDCD08 IPSEC: New inbound decrypt rule, SPI 0x678D8C87 Src addr: 83.149.9.16 Src mask: 255.255.255.255 Dst addr: 193.106.72.5 Dst mask: 255.255.255.255 Src ports Upper: 3427 Lower: 3427 Op : equal Dst ports Upper: 4500 Lower: 4500 Op : equal Protocol: 17 Use protocol: true SPI: 0x00000000 Use SPI: false IPSEC: Completed inbound decrypt rule, SPI 0x678D8C87 Rule ID: 0x032090F8 IPSEC: New inbound permit rule, SPI 0x678D8C87 Src addr: 83.149.9.16 Src mask: 255.255.255.255 Dst addr: 193.106.72.5 Dst mask: 255.255.255.255 Src ports Upper: 3427 Lower: 3427 Op : equal Dst ports Upper: 4500 Lower: 4500 Op : equal Protocol: 17 Use protocol: true SPI: 0x00000000 Use SPI: false IPSEC: Completed inbound permit rule, SPI 0x678D8C87 Rule ID: 0x0356CF48 IPSEC: Deleted inbound decrypt rule, SPI 0x678D8C87 Rule ID: 0x032090F8 IPSEC: Deleted inbound permit rule, SPI 0x678D8C87 Rule ID: 0x0356CF48 IPSEC: Deleted inbound tunnel flow rule, SPI 0x678D8C87 Rule ID: 0x02BDCD08 IPSEC: Deleted inbound VPN context, SPI 0x678D8C87 VPN handle: 0x0196B614 IPSEC: Deleted outbound encrypt rule, SPI 0x00674805 Rule ID: 0x0352DA90 IPSEC: Deleted outbound permit rule, SPI 0x00674805 Rule ID: 0x036FC3E8 IPSEC: Deleted outbound VPN context, SPI 0x00674805 VPN handle: 0x01964BF4 А по пункту 2 я не очень понял почему так происходит, что посоветуете? При подключении через смартфон такой дебаг такое не выдает
	Ответить \| Правка \| ^ к родителю #1 \| Наверх \| Cообщить модератору


	3. "Проблема с настройкой L2TP на PIX 515"	+/–
	Сообщение от don_kuklachev (ok) on 24-Янв-13, 12:00
	>>2.ipsec sa не совпадает: Jan 23 13:59:56 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, All IPSec SA proposals found unacceptable! с этим разобрался -добавил еще один transform-set esp-3des esp-sha-hmac Винда стала выдавать 691 ошибку - пароль конечно верный. Debug crypto ipsec %PIX-3-713119: Group = DefaultRAGroup, IP = 95.24.254.251, PHASE 1 COMPLETED %PIX-3-713122: IP = 95.24.254.251, Keep-alives configured on but peer does not support keep-alives (type = None) IPSEC: New embryonic SA created @ 0x0396CCA8, SCB: 0x02D0ADE8, Direction: inbound SPI : 0xD661ABA1 Session ID: 0x00000246 VPIF num : 0x00000001 Tunnel type: ra Protocol : esp Lifetime : 240 seconds IPSEC: New embryonic SA created @ 0x03479028, SCB: 0x030E8618, Direction: outbound SPI : 0xB620C9AD Session ID: 0x00000246 VPIF num : 0x00000001 Tunnel type: ra Protocol : esp Lifetime : 240 seconds IPSEC: Completed host OBSA update, SPI 0xB620C9AD IPSEC: Creating outbound VPN context, SPI 0xB620C9AD Flags: 0x00000225 SA : 0x03479028 SPI : 0xB620C9AD MTU : 1500 bytes VCID : 0x00000000 Peer : 0x00000000 SCB : 0x030E8618 Channel: 0x01765858 IPSEC: Completed outbound VPN context, SPI 0xB620C9AD VPN handle: 0x019C6F14 IPSEC: New outbound encrypt rule, SPI 0xB620C9AD Src addr: 193.106.72.5 Src mask: 255.255.255.255 Dst addr: 95.24.254.251 Dst mask: 255.255.255.255 Src ports Upper: 1701 Lower: 1701 Op : equal Dst ports Upper: 4500 Lower: 4500 Op : equal Protocol: 17 Use protocol: true SPI: 0x00000000 Use SPI: false IPSEC: Completed outbound encrypt rule, SPI 0xB620C9AD Rule ID: 0x02AA2638 IPSEC: New outbound permit rule, SPI 0xB620C9AD Src addr: 193.106.72.5 Src mask: 255.255.255.255 Dst addr: 95.24.254.251 Dst mask: 255.255.255.255 Src ports Upper: 4500 Lower: 4500 Op : equal Dst ports Upper: 4500 Lower: 4500 Op : equal Protocol: 17 Use protocol: true SPI: 0x00000000 Use SPI: false IPSEC: Completed outbound permit rule, SPI 0xB620C9AD Rule ID: 0x033DB2C8 IPSEC: Completed host IBSA update, SPI 0xD661ABA1 IPSEC: Creating inbound VPN context, SPI 0xD661ABA1 Flags: 0x00000226 SA : 0x0396CCA8 SPI : 0xD661ABA1 MTU : 0 bytes VCID : 0x00000000 Peer : 0x019C6F14 SCB : 0x02D0ADE8 Channel: 0x01765858 IPSEC: Completed inbound VPN context, SPI 0xD661ABA1 VPN handle: 0x019CAAB4 IPSEC: Updating outbound VPN context 0x019C6F14, SPI 0xB620C9AD Flags: 0x00000225 SA : 0x03479028 SPI : 0xB620C9AD MTU : 1500 bytes VCID : 0x00000000 Peer : 0x019CAAB4 SCB : 0x030E8618 Channel: 0x01765858 IPSEC: Completed outbound VPN context, SPI 0xB620C9AD VPN handle: 0x019C6F14 IPSEC: Completed outbound inner rule, SPI 0xB620C9AD Rule ID: 0x02AA2638 IPSEC: Completed outbound outer SPD rule, SPI 0xB620C9AD Rule ID: 0x033DB2C8 IPSEC: New inbound tunnel flow rule, SPI 0xD661ABA1 Src addr: 95.24.254.251 Src mask: 255.255.255.255 Dst addr: 193.106.72.5 Dst mask: 255.255.255.255 Src ports Upper: 0 Lower: 0 Op : ignore Dst ports Upper: 1701 Lower: 1701 Op : equal Protocol: 17 Use protocol: true SPI: 0x00000000 Use SPI: false IPSEC: Completed inbound tunnel flow rule, SPI 0xD661ABA1 Rule ID: 0x035910D0 IPSEC: New inbound decrypt rule, SPI 0xD661ABA1 Src addr: 95.24.254.251 Src mask: 255.255.255.255 Dst addr: 193.106.72.5 Dst mask: 255.255.255.255 Src ports Upper: 4500 Lower: 4500 Op : equal Dst ports Upper: 4500 Lower: 4500 Op : equal Protocol: 17 Use protocol: true SPI: 0x00000000 Use SPI: false IPSEC: Completed inbound decrypt rule, SPI 0xD661ABA1 Rule ID: 0x03537120 IPSEC: New inbound permit rule, SPI 0xD661ABA1 Src addr: 95.24.254.251 Src mask: 255.255.255.255 Dst addr: 193.106.72.5 Dst mask: 255.255.255.255 Src ports Upper: 4500 Lower: 4500 Op : equal Dst ports Upper: 4500 Lower: 4500 Op : equal Protocol: 17 Use protocol: true SPI: 0x00000000 Use SPI: false IPSEC: Completed inbound permit rule, SPI 0xD661ABA1 Rule ID: 0x029F87E8 IPSEC: Deleted inbound decrypt rule, SPI 0xD661ABA1 Rule ID: 0x03537120 IPSEC: Deleted inbound permit rule, SPI 0xD661ABA1 Rule ID: 0x029F87E8 IPSEC: Deleted inbound tunnel flow rule, SPI 0xD661ABA1 Rule ID: 0x035910D0 IPSEC: Deleted inbound VPN context, SPI 0xD661ABA1 VPN handle: 0x019CAAB4 IPSEC: Deleted outbound encrypt rule, SPI 0xB620C9AD Rule ID: 0x02AA2638 IPSEC: Deleted outbound permit rule, SPI 0xB620C9AD Rule ID: 0x033DB2C8 IPSEC: Deleted outbound VPN context, SPI 0xB620C9AD VPN handle: 0x019C6F14
	Ответить \| Правка \| ^ к родителю #2 \| Наверх \| Cообщить модератору


	4. "Проблема с настройкой L2TP на PIX 515"	+/–
	Сообщение от spiegel (ok) on 24-Янв-13, 17:48
	>[оверквотинг удален] > IPSEC: Deleted inbound tunnel flow rule, SPI 0xD661ABA1 > Rule ID: 0x035910D0 > IPSEC: Deleted inbound VPN context, SPI 0xD661ABA1 > VPN handle: 0x019CAAB4 > IPSEC: Deleted outbound encrypt rule, SPI 0xB620C9AD > Rule ID: 0x02AA2638 > IPSEC: Deleted outbound permit rule, SPI 0xB620C9AD > Rule ID: 0x033DB2C8 > IPSEC: Deleted outbound VPN context, SPI 0xB620C9AD > VPN handle: 0x019C6F14 проверил ваш конфиг на GNS3. Вначале не пошло, но после: username igor password cisco mschap все заработало! Проверял на XP, на 7 не работает. Также надо отключить службу cisco vpn client, если он конечно установлен.
	Ответить \| Правка \| ^ к родителю #3 \| Наверх \| Cообщить модератору


	5. "Проблема с настройкой L2TP на PIX 515"	+/–
	Сообщение от don_kuklachev (ok) on 24-Янв-13, 17:57
	>[оверквотинг удален] >> Rule ID: 0x02AA2638 >> IPSEC: Deleted outbound permit rule, SPI 0xB620C9AD >> Rule ID: 0x033DB2C8 >> IPSEC: Deleted outbound VPN context, SPI 0xB620C9AD >> VPN handle: 0x019C6F14 > проверил ваш конфиг на GNS3. Вначале не пошло, но после: > username igor password cisco mschap > все заработало! > Проверял на XP, на 7 не работает. Также надо отключить службу cisco > vpn client, если он конечно установлен. Благодарю, час назад тоже разобрался- достаточно было добавить mschap к логину)
	Ответить \| Правка \| ^ к родителю #4 \| Наверх \| Cообщить модератору


	6. "Проблема с настройкой L2TP на PIX 515"	+/–
	Сообщение от don_kuklachev (ok) on 24-Янв-13, 17:58
	>[оверквотинг удален] >>> IPSEC: Deleted outbound permit rule, SPI 0xB620C9AD >>> Rule ID: 0x033DB2C8 >>> IPSEC: Deleted outbound VPN context, SPI 0xB620C9AD >>> VPN handle: 0x019C6F14 >> проверил ваш конфиг на GNS3. Вначале не пошло, но после: >> username igor password cisco mschap >> все заработало! >> Проверял на XP, на 7 не работает. Также надо отключить службу cisco >> vpn client, если он конечно установлен. > Благодарю, час назад тоже разобрался- достаточно было добавить mschap к логину) на андроиде тоже полет нормальный
	Ответить \| Правка \| ^ к родителю #5 \| Наверх \| Cообщить модератору


	7. "Проблема с настройкой L2TP на PIX 515"	+/–
	Сообщение от don_kuklachev (ok) on 24-Янв-13, 18:10
	>[оверквотинг удален] >> Rule ID: 0x035910D0 >> IPSEC: Deleted inbound VPN context, SPI 0xD661ABA1 >> VPN handle: 0x019CAAB4 >> IPSEC: Deleted outbound encrypt rule, SPI 0xB620C9AD >> Rule ID: 0x02AA2638 >> IPSEC: Deleted outbound permit rule, SPI 0xB620C9AD >> Rule ID: 0x033DB2C8 >> IPSEC: Deleted outbound VPN context, SPI 0xB620C9AD >> VPN handle: 0x019C6F14 > проверил ваш конфиг на GNS3. Вначале не пошло, но после: А как вы собрали такую схему в gns, поделитесь? PIX-router-cloud?
	Ответить \| Правка \| ^ к родителю #4 \| Наверх \| Cообщить модератору


	8. "Проблема с настройкой L2TP на PIX 515"	+/–
	Сообщение от spiegel (ok) on 24-Янв-13, 18:35
	>[оверквотинг удален] >>> IPSEC: Deleted inbound VPN context, SPI 0xD661ABA1 >>> VPN handle: 0x019CAAB4 >>> IPSEC: Deleted outbound encrypt rule, SPI 0xB620C9AD >>> Rule ID: 0x02AA2638 >>> IPSEC: Deleted outbound permit rule, SPI 0xB620C9AD >>> Rule ID: 0x033DB2C8 >>> IPSEC: Deleted outbound VPN context, SPI 0xB620C9AD >>> VPN handle: 0x019C6F14 >> проверил ваш конфиг на GNS3. Вначале не пошло, но после: > А как вы собрали такую схему в gns, поделитесь? PIX-router-cloud? pix-host(vmnet1). vmnet1 - адаптер от VMWare, к нему подключен WinXP на виртуалке.
	Ответить \| Правка \| ^ к родителю #7 \| Наверх \| Cообщить модератору


	9. "Проблема с настройкой L2TP на PIX 515"	+/–
	Сообщение от spiegel (ok) on 24-Янв-13, 18:39
	>[оверквотинг удален] >>>> VPN handle: 0x019CAAB4 >>>> IPSEC: Deleted outbound encrypt rule, SPI 0xB620C9AD >>>> Rule ID: 0x02AA2638 >>>> IPSEC: Deleted outbound permit rule, SPI 0xB620C9AD >>>> Rule ID: 0x033DB2C8 >>>> IPSEC: Deleted outbound VPN context, SPI 0xB620C9AD >>>> VPN handle: 0x019C6F14 >>> проверил ваш конфиг на GNS3. Вначале не пошло, но после: >> А как вы собрали такую схему в gns, поделитесь? PIX-router-cloud? > pix-host(vmnet1). vmnet1 - адаптер от VMWare, к нему подключен WinXP на виртуалке. точнее pix-switch-host. Напрямую не разрешает.
	Ответить \| Правка \| ^ к родителю #8 \| Наверх \| Cообщить модератору