Всем доброго времени суток! Возникла проблемма с поднятием ipsec туннеля между циской и ракуном на FreeBSD. xx.xx.xx.xx - айпи белый на бсд
yy.yy.yy.yy - белій на кошке, которая стоит в локалке за натом
Конфиг циски(к которой нет доступа)
crypto isakmp policy 10
encr aes 256
authentication pre-share
group 2
!
crypto isakmp key <KEY> address xx.xx.xx.xx
!
crypto ipsec transform-set VPN-SECURE-SET esp-aes 256 esp-sha-hmac
mode transport
!
crypto map VPN-MAP 720 ipsec-isakmp
set peer xx.xx.xx.xx
set transform-set VPN-SECURE-SET
set pfs group2
match address VPN-ACL
!
interface Tunnel1
ip address 172.17.6.5 255.255.255.252
ip verify unicast reverse-path allow-self-ping
no ip redirects
no ip unreachables
no ip proxy-arp
ip mtu 1400
ip virtual-reassembly
ip tcp adjust-mss 1360
qos pre-classify
tunnel source GigabitEthernet0/0
tunnel destination 212.82.194.10
tunnel path-mtu-discovery
!
ip access-list extended VPN-ACL
permit gre host 172.17.254.6 host xx.xx.xx.xx
!
конфиги на бсд
ipsec.conf
flush;
spdflush;
spdadd xx.xx.xx.xx/32 yy.yy.yy.yy/32 any -P out ipsec esp/transport//use;
spdadd yy.yy.yy.yy/32 xx.xx.xx.xx/32 any -P in ipsec esp/transport//use;
racoon.conf
path include "/etc/racoon";
path pre_shared_key "/usr/local/etc/racoon/psk.txt";
log debug2;
padding
{
strict_check on; # enable strict check.
exclusive_tail off; # extract last one octet.
}
listen
{
isakmp xx.xx.xx.xx [500];
isakmp_natt xx.xx.xx.xx [4500];
}
timer
{
# These value can be changed per remote node.
# timer for waiting to complete each phase.
phase1 60 sec;
phase2 30 sec;
}
## IKE phase 1
remote yy.yy.yy.yy
{
exchange_mode main,aggressive;
dpd_delay 10;
situation identity_only;
initial_contact on;
my_identifier address 212.82.194.10;
peers_identifier address 212.160.248.2;
nat_traversal on;
proposal_check obey; # obey, strict or claim
proposal {
encryption_algorithm aes256;
hash_algorithm sha1;
authentication_method pre_shared_key;
dh_group 2;
lifetime time 7200 sec;
}
# generate_policy off;
}
## IKE phase 2
sainfo address xx.xx.xx.xx any address yy.yy.yy.yy any {
pfs_group 2;
encryption_algorithm aes256;
authentication_algorithm hmac_sha1;
lifetime time 3600 sec;
compression_algorithm deflate;
}
Пепвую фазу проходит нормально. На второй все и останавливается в лог пишет DEBUG: notification message 14:NO-PROPOSAL-CHOSEN
Уже все перерыл, хз что делать.Надеюсь на помощь.
