The OpenNET Project / Index page

[ новости /+++ | форум | теги | ]

форумы  помощь  поиск  регистрация  вход/выход  слежка  RSS
"CISCO 891 ipsec DLINK dsr-1000"
Вариант для распечатки  
Пред. тема | След. тема 
Форум Маршрутизаторы CISCO и др. оборудование. (VPN, VLAN, туннель)
Изначальное сообщение [ Отслеживать ]

"CISCO 891 ipsec DLINK dsr-1000"  +/
Сообщение от KomaLex (ok) on 09-Окт-16, 16:13 
Здравствуйте.  нужно объеденить две сети. В одно в качестве шлюза cisco 891 во второй dlink dsr-1000
настройки dlink


Policy Name ikcpolicy
  
Policy Type Auto Policy
  
IP Protocol Version IPv4
  
IKE Version IKEv1
  
L2TP Mode None
  
IPSec Mode Tunnel Mode
  
Select Local Gateway
wan1

Remote Endpoint
  
IP Address / FQDN
x.x.30.214
  
Enable Mode Config Disabled
  
Enable NetBIOS Disabled
  
Enable RollOver Disabled
  
Protocol ESP
  
Enable DHCP Disabled
  
Local IP
  
Local Start IP Address
172.22.32.1
  
Local Subnet Mask
255.255.254.0
  
Remote IP
  
Remote Start IP Address
192.168.11.1
  
Remote Subnet Mask
255.255.255.0
  
Enable Keepalive Disabled
  
Phase1(IKE SA Parameters)
Exchange Mode Main
  
Direction / Type Both
  
Nat Traversal off
  
Local Identifier Type
  
Remote Identifier Type
  
Encryption Algorithm
DES
Authentication Algorithm
SHA-1

Authentication Method Pre-Shared key
  
Pre-Shared Key secret_key
  
Diffie-Hellman (DH) Group Group 2 (1024 bit)
  
SA-Lifetime 86400
  
Enable Dead Peer Detection Disabled
  
Extended Authentication None
  
  
  
  
  
  
  
  
Phase2-(Auto Policy Parameters)
SA Lifetime 3600 Seconds
  
Encryption Algorithm
  
DES

Integrity Algorithm
SHA-1 ON

PFS Key Group Disabled

настройки cisco

crypto keyring wgsecret
  pre-shared-key address 0.0.0.0 0.0.0.0 key secret_key
!
crypto isakmp policy 10
authentication pre-share
group 2
crypto isakmp profile WGprofile
   keyring wgsecret
   match identity address 0.0.0.0
!
!
crypto ipsec transform-set WGTS esp-des esp-sha-hmac
mode tunnel
!
!
!
crypto dynamic-map WGDM 10
set transform-set WGTS
set isakmp-profile WGprofile
match address WGCLUBNET
reverse-route
!
!
!
crypto map WGMap 10 ipsec-isakmp dynamic WGDM
!
!
!
!
!
interface Loopback1
ip address 10.11.12.1 255.255.255.0
ip nat enable
!
interface FastEthernet0
no ip address
!
interface FastEthernet1
no ip address
!
interface FastEthernet2
no ip address
!
interface FastEthernet3
no ip address
!
interface FastEthernet4
no ip address
!
interface FastEthernet5
no ip address
!
interface FastEthernet6
no ip address
!
interface FastEthernet7
no ip address
!
interface FastEthernet8
no ip address
duplex auto
speed auto
pppoe enable group global
pppoe-client dial-pool-number 1
!
interface Virtual-Template1
ip address 10.11.11.1 255.255.255.0
peer default ip address pool vpnpool
no keepalive
ppp encrypt mppe auto
ppp authentication pap chap ms-chap ms-chap-v2
!
interface GigabitEthernet0
no ip address
shutdown
duplex auto
speed auto
!
interface Vlan1
ip address 192.168.11.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
!
interface Async1
no ip address
encapsulation slip
!
interface Dialer1
ip address negotiated
ip mtu 1452
ip nat outside
ip virtual-reassembly in
encapsulation ppp
dialer pool 1
dialer-group 1
ppp authentication pap chap callin
ppp chap hostname 381035811
ppp chap password 7 050E050B2443480C13
ppp pap sent-username 381035811 password 7 050E050B2443480C13
no cdp enable
crypto map WGMap
!
ip local pool vpnpool 10.11.11.32 10.11.11.127
ip forward-protocol nd
no ip http server
no ip http secure-server
!
!
ip nat inside source list 122 interface Dialer1 overload
ip nat inside source static tcp 192.168.11.6 22 x.x.30.214 22 extendable
ip nat inside source static tcp 192.168.11.6 80 x.x.30.214 80 extendable
ip nat inside source static tcp 192.168.11.5 3389 x.x.30.214 33891 extendable
ip nat inside source static tcp 192.168.11.22 3389 x.x.30.214 33892 extendable
ip route 0.0.0.0 0.0.0.0 Dialer1
ip route 172.22.32.0 255.255.254.0 Dialer1
!
ip access-list extended WGCLUBNET
permit ip host x.x.30.214 host x.x.54.66
permit ip 192.168.11.0 0.0.0.255 172.22.32.0 0.0.1.255
!
dialer-list 1 protocol ip permit
!
!
access-list 23 permit 192.168.11.0 0.0.0.255
access-list 122 permit ip 192.168.11.0 0.0.0.255 any
!


фаза 1 проходит, фаза 2 нет. Вот что пишет в логи длинк:

Sun Oct 09 12:04:19 2016 (GMT +0000): [DSR-1000] [IKE] ERROR: Unknown notify message from x.x.30.214[500].No phase2 handle found.
Sun Oct 09 12:04:19 2016 (GMT +0000): [DSR-1000] [IKE] INFO: accept a request to establish IKE-SA: x.x.30.214
Sun Oct 09 12:04:19 2016 (GMT +0000): [DSR-1000] [IKE] INFO: Configuration found for x.x.30.214.
Sun Oct 09 12:04:19 2016 (GMT +0000): [DSR-1000] [IKE] INFO: Configuration found for x.x.30.214.
Sun Oct 09 12:04:19 2016 (GMT +0000): [DSR-1000] [IKE] INFO: Initiating new phase 2 negotiation: x.x.54.66[500]<=>x.x.30.214[0]

а вот логи cisco


*Oct  9 11:34:45.078: ISAKMP (2003): received packet from 195.206.54.66 dport 500 sport 500 Global (R) QM_IDLE
*Oct  9 11:34:45.078: ISAKMP: set new node -598716224 to QM_IDLE
*Oct  9 11:34:45.078: ISAKMP:(2003): processing HASH payload. message ID = 3696251072
*Oct  9 11:34:45.078: ISAKMP:(2003): processing SA payload. message ID = 3696251072
*Oct  9 11:34:45.078: ISAKMP:(2003):Checking IPSec proposal 1
*Oct  9 11:34:45.078: ISAKMP: transform 1, ESP_DES
*Oct  9 11:34:45.078: ISAKMP:   attributes in transform:
*Oct  9 11:34:45.078: ISAKMP:      SA life type in seconds
*Oct  9 11:34:45.078: ISAKMP:      SA life duration (basic) of 3600
*Oct  9 11:34:45.078: ISAKMP:      encaps is 1 (Tunnel)
*Oct  9 11:34:45.078: ISAKMP:      authenticator is HMAC-SHA
*Oct  9 11:34:45.078: ISAKMP:(2003):atts are acceptable.
*Oct  9 11:34:45.078: IPSEC(validate_proposal_request): proposal part #1
*Oct  9 11:34:45.078: IPSEC(initialize_sas): invalid IPv4 proxy IDs
*Oct  9 11:34:45.082: ISAKMP:(2003): IPSec policy invalidated proposal with error 32
*Oct  9 11:34:45.082: ISAKMP:(2003): phase 2 SA policy not acceptable! (local x.x.30.214 remote x.x.54.66)
*Oct  9 11:34:45.082: ISAKMP: set new node 1773506091 to QM_IDLE
cisco-gw#sh run
*Oct  9 11:34:45.082: ISAKMP:(2003):Sending NOTIFY PROPOSAL_NOT_CHOSEN protocol 3
        spi 2371042928, message ID = 1773506091
*Oct  9 11:34:45.082: ISAKMP:(2003): sending packet to x.x.54.66 my_port 500 peer_port 500 (R) QM_IDLE
*Oct  9 11:34:45.082: ISAKMP:(2003):Sending an IKE IPv4 Packet.
*Oct  9 11:34:45.082: ISAKMP:(2003):purging node 1773506091
*Oct  9 11:34:45.082: ISAKMP:(2003):deleting node -598716224 error TRUE reason "QM rejected"
*Oct  9 11:34:45.082: ISAKMP:(2003):Node 3696251072, Input = IKE_MESG_FROM_PEER, IKE_QM_EXCH
*Oct  9 11:34:45.082: ISAKMP:(2003):Old State = IKE_QM_READY  New State = IKE_QM_READY
cisco-gw#sh run
*Oct  9 11:34:55.110: ISAKMP (2003): received packet from 195.206.54.66 dport 500 sport 500 Global (R) QM_IDLE
*Oct  9 11:34:55.110: ISAKMP:(2003): phase 2 packet is a duplicate of a previous packet.
*Oct  9 11:34:55.110: ISAKMP:(2003): retransmitting due to retransmit phase 2
*Oct  9 11:34:55.110: ISAKMP:(2003): Quick Mode is being processed. Ignoring retransmission

Судя по ошибкам и гуглению по этим ошибкам что то не так с access листами, но вот что. Помогите разобраться. Уже неделю тунель поднять не могу. Все перепробовал.

Ответить | Правка | Cообщить модератору

Оглавление

Сообщения по теме [Сортировка по времени | RSS]


1. "CISCO 891 ipsec DLINK dsr-1000"  +/
Сообщение от ShyLion (ok) on 10-Окт-16, 07:09 
> crypto dynamic-map WGDM 10

а с какой целью динамическая мапа?

> permit ip host x.x.30.214 host x.x.54.66

это лишнее

Ответить | Правка | ^ к родителю #0 | Наверх | Cообщить модератору

2. "CISCO 891 ipsec DLINK dsr-1000"  +/
Сообщение от ShyLion (ok) on 10-Окт-16, 07:12 
> Encryption Algorithm
> DES
> Authentication Algorithm
> SHA-1

Алгортимы очень слабые на сегодняшний день.

Ответить | Правка | ^ к родителю #0 | Наверх | Cообщить модератору

3. "CISCO 891 ipsec DLINK dsr-1000"  +/
Сообщение от ShyLion (ok) on 10-Окт-16, 07:19 
> crypto dynamic-map WGDM 10
>  set transform-set WGTS
>  set isakmp-profile WGprofile
>  match address WGCLUBNET
>  reverse-route

Думаю что match address тут лишнее.

Ответить | Правка | ^ к родителю #0 | Наверх | Cообщить модератору

4. "CISCO 891 ipsec DLINK dsr-1000"  +/
Сообщение от KomaLex (ok) on 10-Окт-16, 07:41 
>> crypto dynamic-map WGDM 10
>>  set transform-set WGTS
>>  set isakmp-profile WGprofile
>>  match address WGCLUBNET
>>  reverse-route
> Думаю что match address тут лишнее.

Динамическая мапа, потому что будет несколько подключений. Пробовал делать через статические мапы, результат тот же.

permit ip host host
Убирал результат тот же.

match address убирал не помогло.
Подскажите что еще можно попробовать и где посмотреть. Может еще какой то дебуг, где будет более понятно что именно не нравится.

Ответить | Правка | ^ к родителю #3 | Наверх | Cообщить модератору

5. "CISCO 891 ipsec DLINK dsr-1000"  +/
Сообщение от ShyLion (ok) on 10-Окт-16, 09:38 
> Local Start IP Address
> 172.22.32.1
> Local Subnet Mask
> 255.255.254.0
> Remote IP
> Remote Start IP Address
> 192.168.11.1
> Remote Subnet Mask
> 255.255.255.0

а вот тут не .0 должно быть в адресах?

Ответить | Правка | ^ к родителю #0 | Наверх | Cообщить модератору

6. "CISCO 891 ipsec DLINK dsr-1000"  +/
Сообщение от KomaLex (ok) on 10-Окт-16, 09:58 
>> Local Start IP Address
>> 172.22.32.1
>> Local Subnet Mask
>> 255.255.254.0
>> Remote IP
>> Remote Start IP Address
>> 192.168.11.1
>> Remote Subnet Mask
>> 255.255.255.0
> а вот тут не .0 должно быть в адресах?

Он там не дает 0 ставить. тоже показалось странным, адрес сети ведь нулевой адрес. Но у них в длинке видимо по другому.

Ответить | Правка | ^ к родителю #5 | Наверх | Cообщить модератору

7. "CISCO 891 ipsec DLINK dsr-1000"  +/
Сообщение от ShyLion (ok) on 11-Окт-16, 06:38 
>[оверквотинг удален]
>>> Local Subnet Mask
>>> 255.255.254.0
>>> Remote IP
>>> Remote Start IP Address
>>> 192.168.11.1
>>> Remote Subnet Mask
>>> 255.255.255.0
>> а вот тут не .0 должно быть в адресах?
> Он там не дает 0 ставить. тоже показалось странным, адрес сети ведь
> нулевой адрес. Но у них в длинке видимо по другому.

show debug

debug crypto ipsec включен?

Ответить | Правка | ^ к родителю #6 | Наверх | Cообщить модератору

8. "CISCO 891 ipsec DLINK dsr-1000"  +/
Сообщение от KomaLex (ok) on 11-Окт-16, 06:48 
>[оверквотинг удален]
>>>> Remote IP
>>>> Remote Start IP Address
>>>> 192.168.11.1
>>>> Remote Subnet Mask
>>>> 255.255.255.0
>>> а вот тут не .0 должно быть в адресах?
>> Он там не дает 0 ставить. тоже показалось странным, адрес сети ведь
>> нулевой адрес. Но у них в длинке видимо по другому.
> show debug
> debug crypto ipsec включен?


show debug
Cryptographic Subsystem:
  Crypto ISAKMP debugging is on
  Crypto IPSEC debugging is on

Да. Попробовал убрать динамические мапы вот новый конфиг:


crypto keyring wgsecret
  pre-shared-key address x.x.54.66 255.255.255.252 key DEVopengl1982
!
crypto isakmp policy 10
authentication pre-share
group 2
crypto isakmp profile WGprofile
   keyring wgsecret
   match identity address x.x.54.66 255.255.255.252
!
!
crypto ipsec transform-set WGTS esp-des esp-sha-hmac
mode tunnel
!
!
!
!
!
!
crypto map WGMAp 10 ipsec-isakmp
! Incomplete
set transform-set WGTS
set isakmp-profile WGprofile
match address WGCLUBNET
reverse-route
!
ip access-list extended WGCLUBNET
permit ip 192.168.11.0 0.0.0.255 172.22.32.0 0.0.1.255

Результат тот же. Уже и не знаю что думать. Все перепробовал. Этот же длин с другим таким же длинком ipsec тунель держит нормально.
ВОт логи с циски:


*Oct 10 07:52:36.557: ISAKMP (0): received packet from x.x.54.66 dport 500 sport 500 Global (N) NEW SA
*Oct 10 07:52:36.557: ISAKMP: Created a peer struct for x.x.54.66, peer port 500
*Oct 10 07:52:36.557: ISAKMP: New peer created peer = 0x8B88D9E8 peer_handle = 0x8000000D
*Oct 10 07:52:36.557: ISAKMP: Locking peer struct 0x8B88D9E8, refcount 1 for crypto_isakmp_process_block
*Oct 10 07:52:36.557: ISAKMP: local port 500, remote port 500
*Oct 10 07:52:36.557: ISAKMP:(0):insert sa successfully sa = 8E0E6128
*Oct 10 07:52:36.557: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
*Oct 10 07:52:36.557: ISAKMP:(0):Old State = IKE_READY  New State = IKE_R_MM1

*Oct 10 07:52:36.557: ISAKMP:(0): processing SA payload. message ID = 0
*Oct 10 07:52:36.557: ISAKMP:(0): processing vendor id payload
*Oct 10 07:52:36.557: ISAKMP:(0): vendor ID is DPD
*Oct 10 07:52:36.557: ISAKMP:(0):found peer pre-shared key matching x.x.54.66
*Oct 10 07:52:36.557: ISAKMP:(0): local preshared key found
*Oct 10 07:52:36.557: ISAKMP : Scanning profiles for xauth ... WGprofile
*Oct 10 07:52:36.557: ISAKMP:(0):Checking ISAKMP transform 1 against priority 10 policy
*Oct 10 07:52:36.557: ISAKMP:      life type in seconds
*Oct 10 07:52:36.557: ISAKMP:      life duration (VPI) of  0x0 0x1 0x51 0x80
*Oct 10 07:52:36.557: ISAKMP:      encryption DES-CBC
*Oct 10 07:52:36.557: ISAKMP:      auth pre-share
*Oct 10 07:52:36.557: ISAKMP:      hash SHA
*Oct 10 07:52:36.557: ISAKMP:      default group 2
*Oct 10 07:52:36.557: ISAKMP:(0):atts are acceptable. Next payload is 0
*Oct 10 07:52:36.557: ISAKMP:(0):Acceptable atts:actual life: 86400
*Oct 10 07:52:36.557: ISAKMP:(0):Acceptable atts:life: 0
*Oct 10 07:52:36.557: ISAKMP:(0):Fill atts in sa vpi_length:4
*Oct 10 07:52:36.557: ISAKMP:(0):Fill atts in sa life_in_seconds:86400
*Oct 10 07:52:36.557: ISAKMP:(0):Returning Actual lifetime: 86400
*Oct 10 07:52:36.557: ISAKMP:(0)::Started lifetime timer: 86400.

*Oct 10 07:52:36.561: ISAKMP:(0): processing vendor id payload
*Oct 10 07:52:36.561: ISAKMP:(0): vendor ID is DPD
*Oct 10 07:52:36.561: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
*Oct 10 07:52:36.561: ISAKMP:(0):Old State = IKE_R_MM1  New State = IKE_R_MM1

*Oct 10 07:52:36.561: ISAKMP:(0): sending packet to x.x.54.66 my_port 500 peer_port 500 (R) MM_SA_SETUP
*Oct 10 07:52:36.561: ISAKMP:(0):Sending an IKE IPv4 Packet.
*Oct 10 07:52:36.561: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
*Oct 10 07:52:36.561: ISAKMP:(0):Old State = IKE_R_MM1  New State = IKE_R_MM2

*Oct 10 07:52:36.809: ISAKMP (0): received packet from x.x.54.66 dport 500 sport 500 Global (R) MM_SA_SETUP
*Oct 10 07:52:36.809: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
*Oct 10 07:52:36.809: ISAKMP:(0):Old State = IKE_R_MM2  New State = IKE_R_MM3

*Oct 10 07:52:36.809: ISAKMP:(0): processing KE payload. message ID = 0
*Oct 10 07:52:36.829: ISAKMP:(0): processing NONCE payload. message ID = 0
*Oct 10 07:52:36.829: ISAKMP:(0):found peer pre-shared key matching x.x.54.66
*Oct 10 07:52:36.829: ISAKMP:(2004): processing vendor id payload
*Oct 10 07:52:36.829: ISAKMP:(2004): vendor ID seems Unity/DPD but major 139 mismatch
*Oct 10 07:52:36.833: ISAKMP:(2004):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
*Oct 10 07:52:36.833: ISAKMP:(2004):Old State = IKE_R_MM3  New State = IKE_R_MM3

*Oct 10 07:52:36.833: ISAKMP:(2004): sending packet to x.x.54.66 my_port 500 peer_port 500 (R) MM_KEY_EXCH
*Oct 10 07:52:36.833: ISAKMP:(2004):Sending an IKE IPv4 Packet.
*Oct 10 07:52:36.833: ISAKMP:(2004):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
*Oct 10 07:52:36.833: ISAKMP:(2004):Old State = IKE_R_MM3  New State = IKE_R_MM4

*Oct 10 07:52:37.497: ISAKMP (2004): received packet from x.x.54.66 dport 500 sport 500 Global (R) MM_KEY_EXCH
*Oct 10 07:52:37.501: ISAKMP:(2004):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
*Oct 10 07:52:37.501: ISAKMP:(2004):Old State = IKE_R_MM4  New State = IKE_R_MM5

*Oct 10 07:52:37.501: ISAKMP:(2004): processing ID payload. message ID = 0
*Oct 10 07:52:37.501: ISAKMP (2004): ID payload
        next-payload : 8
        type         : 1
        address      : x.x.54.66
        protocol     : 17
        port         : 500
        length       : 12
*Oct 10 07:52:37.501: ISAKMP:(0):: peer matches WGprofile profile
*Oct 10 07:52:37.501: ISAKMP:(2004):Found ADDRESS key in keyring wgsecret
*Oct 10 07:52:37.501: ISAKMP:(2004): processing HASH payload. message ID = 0
*Oct 10 07:52:37.501: ISAKMP:(2004):SA authentication status:
        authenticated
*Oct 10 07:52:37.501: ISAKMP:(2004):SA has been authenticated with x.x.54.66
*Oct 10 07:52:37.501: ISAKMP: Trying to insert a peer x.x.30.214/x.x.54.66/500/,  and inserted successfully 8B88D9E8.
*Oct 10 07:52:37.501: ISAKMP:(2004):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
*Oct 10 07:52:37.501: ISAKMP:(2004):Old State = IKE_R_MM5  New State = IKE_R_MM5

*Oct 10 07:52:37.501: ISAKMP:(2004):SA is doing pre-shared key authentication using id type ID_IPV4_ADDR
*Oct 10 07:52:37.501: ISAKMP (2004): ID payload
        next-payload : 8
        type         : 1
        address      : x.x.30.214
        protocol     : 17
        port         : 500
        length       : 12
*Oct 10 07:52:37.501: ISAKMP:(2004):Total payload length: 12
*Oct 10 07:52:37.501: ISAKMP:(2004): sending packet to x.x.54.66 my_port 500 peer_port 500 (R) MM_KEY_EXCH
*Oct 10 07:52:37.501: ISAKMP:(2004):Sending an IKE IPv4 Packet.
*Oct 10 07:52:37.501: ISAKMP:(2004):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
*Oct 10 07:52:37.501: ISAKMP:(2004):Old State = IKE_R_MM5  New State = IKE_P1_COMPLETE

*Oct 10 07:52:37.501: ISAKMP:(2004):Input = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE
*Oct 10 07:52:37.501: ISAKMP:(2004):Old State = IKE_P1_COMPLETE  New State = IKE_P1_COMPLETE

*Oct 10 07:52:37.521: ISAKMP (2004): received packet from x.x.54.66 dport 500 sport 500 Global (R) QM_IDLE
*Oct 10 07:52:37.521: ISAKMP: set new node -328894163 to QM_IDLE
*Oct 10 07:52:37.521: ISAKMP:(2004): processing HASH payload. message ID = 3966073133
*Oct 10 07:52:37.521: ISAKMP:(2004): processing NOTIFY INITIAL_CONTACT protocol 1
        spi 0, message ID = 3966073133, sa = 0x8E0E6128
*Oct 10 07:52:37.521: ISAKMP:(2004):SA authentication status:
        authenticated
*Oct 10 07:52:37.521: ISAKMP:(2004): Process initial contact,
bring down existing phase 1 and 2 SA's with local x.x.30.214 remote x.x.54.66 remote port 500
cisco-gw#
*Oct 10 07:52:37.521: ISAKMP:(2004):deleting node -328894163 error FALSE reason "Informational (in) state 1"
*Oct 10 07:52:37.521: ISAKMP:(2004):Input = IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY
*Oct 10 07:52:37.521: ISAKMP:(2004):Old State = IKE_P1_COMPLETE  New State = IKE_P1_COMPLETE

*Oct 10 07:52:37.521: IPSEC(key_engine): got a queue event with 1 KMI message(s)
*Oct 10 07:52:38.537: ISAKMP (2004): received packet from x.x.54.66 dport 500 sport 500 Global (R) QM_IDLE
*Oct 10 07:52:38.537: ISAKMP: set new node -1813039523 to QM_IDLE
*Oct 10 07:52:38.537: ISAKMP:(2004): processing HASH payload. message ID = 2481927773
*Oct 10 07:52:38.537: ISAKMP:(2004): processing SA payload. message ID = 2481927773
*Oct 10 07:52:38.537: ISAKMP:(2004):Checking IPSec proposal 1
*Oct 10 07:52:38.537: ISAKMP: transform 1, ESP_DES
*Oct 10 07:52:38.537: ISAKMP:   attributes in transform:
*Oct 10 07:52:38.537: ISAKMP:      SA life type in seconds
*Oct 10 07:52:38.537: ISAKMP:      SA life duration (basic) of 3600
*Oct 10 07:52:38.537: ISAKMP:      encaps is 1 (Tunnel)
*Oct 10 07:52:38.537: ISAKMP:      authenticator is HMAC-SHA
*Oct 10 07:52:38.537: ISAKMP:(2004):atts are acceptable.
*Oct 10 07:52:38.537: IPSEC(validate_proposal_request): proposal part #1
*Oct 10 07:52:38.537: IPSEC(initialize_sas): invalid IPv4 proxy IDs
*Oct 10 07:52:38.537: ISAKMP:(2004): IPSec policy invalidated proposal with error 32
*Oct 10 07:52:38.537: ISAKMP:(2004): phase 2 SA policy not acceptable! (local x.x.30.214 remote x.x.54.66)
*Oct 10 07:52:38.537: ISAKMP: set new node 1494915460 to QM_IDLE
cisco-gw#
*Oct 10 07:52:38.537: ISAKMP:(2004):Sending NOTIFY PROPOSAL_NOT_CHOSEN protocol 3
        spi 2371042928, message ID = 1494915460
*Oct 10 07:52:38.537: ISAKMP:(2004): sending packet to x.x.54.66 my_port 500 peer_port 500 (R) QM_IDLE
*Oct 10 07:52:38.537: ISAKMP:(2004):Sending an IKE IPv4 Packet.
*Oct 10 07:52:38.537: ISAKMP:(2004):purging node 1494915460
*Oct 10 07:52:38.537: ISAKMP:(2004):deleting node -1813039523 error TRUE reason "QM rejected"
*Oct 10 07:52:38.537: ISAKMP:(2004):Node 2481927773, Input = IKE_MESG_FROM_PEER, IKE_QM_EXCH
*Oct 10 07:52:38.537: ISAKMP:(2004):Old State = IKE_QM_READY  New State = IKE_QM_READY
cisco-gw#
*Oct 10 07:52:48.557: ISAKMP (2004): received packet from x.x.54.66 dport 500 sport 500 Global (R) QM_IDLE
*Oct 10 07:52:48.557: ISAKMP:(2004): phase 2 packet is a duplicate of a previous packet.
*Oct 10 07:52:48.557: ISAKMP:(2004): retransmitting due to retransmit phase 2
*Oct 10 07:52:48.557: ISAKMP:(2004): Quick Mode is being processed. Ignoring retransmission
cisco-gw#
*Oct 10 07:52:58.573: ISAKMP (2004): received packet from x.x.54.66 dport 500 sport 500 Global (R) QM_IDLE
*Oct 10 07:52:58.573: ISAKMP:(2004): phase 2 packet is a duplicate of a previous packet.
*Oct 10 07:52:58.573: ISAKMP:(2004): retransmitting due to retransmit phase 2
*Oct 10 07:52:58.573: ISAKMP:(2004): Quick Mode is being processed. Ignoring retransmission
cisco-gw#
*Oct 10 07:53:08.585: ISAKMP (2004): received packet from x.x.54.66 dport 500 sport 500 Global (R) QM_IDLE
*Oct 10 07:53:08.585: ISAKMP:(2004): phase 2 packet is a duplicate of a previous packet.
*Oct 10 07:53:08.585: ISAKMP:(2004): retransmitting due to retransmit phase 2
*Oct 10 07:53:08.585: ISAKMP:(2004): Quick Mode is being processed. Ignoring retransmission
cisco-gw#
*Oct 10 07:53:18.601: ISAKMP (2004): received packet from x.x.54.66 dport 500 sport 500 Global (R) QM_IDLE
*Oct 10 07:53:18.601: ISAKMP:(2004): phase 2 packet is a duplicate of a previous packet.
*Oct 10 07:53:18.601: ISAKMP:(2004): retransmitting due to retransmit phase 2
*Oct 10 07:53:18.601: ISAKMP:(2004): Quick Mode is being processed. Ignoring retransmission
cisco-gw#
*Oct 10 07:53:27.521: ISAKMP:(2004):purging node -328894163
cisco-gw#
*Oct 10 07:53:28.537: ISAKMP:(2004):purging node -1813039523
*Oct 10 07:53:28.977: ISAKMP (2004): received packet from x.x.54.66 dport 500 sport 500 Global (R) QM_IDLE
*Oct 10 07:53:28.977: ISAKMP: set new node -1813039523 to QM_IDLE
*Oct 10 07:53:28.977: ISAKMP:(2004): processing HASH payload. message ID = 2481927773
*Oct 10 07:53:28.977: ISAKMP:(2004): processing SA payload. message ID = 2481927773
*Oct 10 07:53:28.977: ISAKMP:(2004):Checking IPSec proposal 1
*Oct 10 07:53:28.977: ISAKMP: transform 1, ESP_DES
*Oct 10 07:53:28.977: ISAKMP:   attributes in transform:
*Oct 10 07:53:28.977: ISAKMP:      SA life type in seconds
*Oct 10 07:53:28.977: ISAKMP:      SA life duration (basic) of 3600
*Oct 10 07:53:28.977: ISAKMP:      encaps is 1 (Tunnel)
*Oct 10 07:53:28.977: ISAKMP:      authenticator is HMAC-SHA
*Oct 10 07:53:28.977: ISAKMP:(2004):atts are acceptable.
*Oct 10 07:53:28.977: IPSEC(validate_proposal_request): proposal part #1
*Oct 10 07:53:28.977: IPSEC(initialize_sas): invalid IPv4 proxy IDs
*Oct 10 07:53:28.977: ISAKMP:(2004): IPSec policy invalidated proposal with error 32
*Oct 10 07:53:28.977: ISAKMP:(2004): phase 2 SA policy not acceptable! (local x.x.30.214 remote x.x.54.66)
*Oct 10 07:53:28.977: ISAKMP: set new node 23007779 to QM_IDLE
cisco-gw#
*Oct 10 07:53:28.977: ISAKMP:(2004):Sending NOTIFY PROPOSAL_NOT_CHOSEN protocol 3
        spi 2371042928, message ID = 23007779
*Oct 10 07:53:28.977: ISAKMP:(2004): sending packet to x.x.54.66 my_port 500 peer_port 500 (R) QM_IDLE
*Oct 10 07:53:28.977: ISAKMP:(2004):Sending an IKE IPv4 Packet.
*Oct 10 07:53:28.977: ISAKMP:(2004):purging node 23007779
*Oct 10 07:53:28.977: ISAKMP:(2004):deleting node -1813039523 error TRUE reason "QM rejected"
*Oct 10 07:53:28.977: ISAKMP:(2004):Node 2481927773, Input = IKE_MESG_FROM_PEER, IKE_QM_EXCH
*Oct 10 07:53:28.977: ISAKMP:(2004):Old State = IKE_QM_READY  New State = IKE_QM_READY
cisco-gw#
*Oct 10 07:53:37.997: ISAKMP (2004): received packet from x.x.54.66 dport 500 sport 500 Global (R) QM_IDLE
*Oct 10 07:53:37.997: ISAKMP:(2004): phase 2 packet is a duplicate of a previous packet.
*Oct 10 07:53:37.997: ISAKMP:(2004): retransmitting due to retransmit phase 2
*Oct 10 07:53:37.997: ISAKMP:(2004): Quick Mode is being processed. Ignoring retransmission


вот лог с длинка

Mon Oct 10 08:19:11 2016 (GMT +0000): [DSR-1000] [IKE] INFO: accept a request to establish IKE-SA: x.x.30.214
Mon Oct 10 08:19:11 2016 (GMT +0000): [DSR-1000] [IKE] INFO: Beginning Identity Protection mode.
Mon Oct 10 08:19:11 2016 (GMT +0000): [DSR-1000] [IKE] INFO: Configuration found for x.x.30.214.
Mon Oct 10 08:19:11 2016 (GMT +0000): [DSR-1000] [IKE] INFO: Configuration found for x.x.30.214.
Mon Oct 10 08:19:11 2016 (GMT +0000): [DSR-1000] [IKE] INFO: Initiating new phase 1 negotiation: x.x.54.66[500]<=>x.x.30.214[500]
Mon Oct 10 08:19:11 2016 (GMT +0000): [DSR-1000] [IKE] INFO: Received unknown Vendor ID
Mon Oct 10 08:19:11 2016 (GMT +0000): [DSR-1000] [IKE] INFO: Received Vendor ID: CISCO-UNITY
Mon Oct 10 08:19:11 2016 (GMT +0000): [DSR-1000] [IKE] INFO: Received Vendor ID: DPD
Mon Oct 10 08:19:11 2016 (GMT +0000): [DSR-1000] [IKE] INFO: Received Vendor ID: draft-ietf-ipsra-isakmp-xauth-06.txt
Mon Oct 10 08:19:12 2016 (GMT +0000): [DSR-1000] [IKE] INFO: ISAKMP-SA established for x.x.54.66[500]-x.x.30.214[500] with spi:7a71f16e02d182e4:c7b75d7981d40948
Mon Oct 10 08:19:12 2016 (GMT +0000): [DSR-1000] [IKE] INFO: Sending Informational Exchange: notify payload[INITIAL-CONTACT]
Mon Oct 10 08:19:13 2016 (GMT +0000): [DSR-1000] [IKE] ERROR: Unknown notify message from x.x.30.214[500].No phase2 handle found.
Mon Oct 10 08:19:13 2016 (GMT +0000): [DSR-1000] [IKE] INFO: Initiating new phase 2 negotiation: x.x.54.66[500]<=>x.x.30.214[0]
Mon Oct 10 08:20:04 2016 (GMT +0000): [DSR-1000] [IKE] ERROR: Unknown notify message from x.x.30.214[500].No phase2 handle found.
Mon Oct 10 08:21:03 2016 (GMT +0000): [DSR-1000] [IKE] ERROR: Phase 2 negotiation failed due to time up. 7a71f16e02d182e4:c7b75d7981d40948:93ef365d
Mon Oct 10 08:21:03 2016 (GMT +0000): [DSR-1000] [IKE] INFO: an undead schedule has been deleted: 'quick_i1prep'.

Ответить | Правка | ^ к родителю #7 | Наверх | Cообщить модератору

9. "CISCO 891 ipsec DLINK dsr-1000"  +/
Сообщение от Aleksey (??) on 14-Ноя-16, 16:53 
У меня такая же проблема, удалось решить.
Ответить | Правка | ^ к родителю #8 | Наверх | Cообщить модератору

10. "CISCO 891 ipsec DLINK dsr-1000"  +/
Сообщение от Aleksey (??) on 17-Ноя-16, 11:27 
Проблема в настройке local и remote subnet на dlink.
При поднятии второй фазы IPSec туннеля происходит сравнение
crypto ACL со стороны cisco и параметров local remote subnets на dlink.
т.к. со стороны dlink эти сети описаны в поле start address как x.x.x.1/24
они не совпадают с subnet которые описаны на cisco как x.x.x.0/24 и туннель не
поднимается.
В dlink некоторые прошивки не позволяют ставить x.x.x.0 в поле
start address (можно попробовать маску меньше чем /24, например x.x.x.128/25)
если получиться прописать тогда туннель должен подняться, если нет экспериментировать с прошивкой.


Ответить | Правка | ^ к родителю #9 | Наверх | Cообщить модератору

11. "CISCO 891 ipsec DLINK dsr-1000"  +/
Сообщение от Serb on 22-Ноя-16, 18:50 
>[оверквотинг удален]
> message from x.x.30.214[500].No phase2 handle found.
> Mon Oct 10 08:19:13 2016 (GMT +0000): [DSR-1000] [IKE] INFO: Initiating new
> phase 2 negotiation: x.x.54.66[500]<=>x.x.30.214[0]
> Mon Oct 10 08:20:04 2016 (GMT +0000): [DSR-1000] [IKE] ERROR: Unknown notify
> message from x.x.30.214[500].No phase2 handle found.
> Mon Oct 10 08:21:03 2016 (GMT +0000): [DSR-1000] [IKE] ERROR: Phase 2
> negotiation failed due to time up. 7a71f16e02d182e4:c7b75d7981d40948:93ef365d
> Mon Oct 10 08:21:03 2016 (GMT +0000): [DSR-1000] [IKE] INFO: an undead
> schedule has been deleted: 'quick_i1prep'.
>

here is your problem :
*Oct 10 07:52:38.537: IPSEC(initialize_sas): invalid IPv4 proxy IDs
*Oct 10 07:52:38.537: ISAKMP:(2004): IPSec policy invalidated proposal with error 32
*Oct 10 07:52:38.537: ISAKMP:(2004): phase 2 SA policy not acceptable! (local x.x.30.214 remote x.x.54.66)


which means ACL for interesting traffic does not match on both ends

Ответить | Правка | ^ к родителю #8 | Наверх | Cообщить модератору

Архив | Удалить

Рекомендовать для помещения в FAQ | Индекс форумов | Темы | Пред. тема | След. тема




Партнёры:
PostgresPro
Inferno Solutions
Hosting by Hoster.ru
Хостинг:

Закладки на сайте
Проследить за страницей
Created 1996-2024 by Maxim Chirkov
Добавить, Поддержать, Вебмастеру