IPsec zwischen Cisco 7301 und Cisco 1841

nimrod_ · 12. Januar 2009

ja, stimmt, die default route war noch ein relikt aus einem anderen aufbau, der zu dem thema gehört. ich habe die def-route nun auf den dialer gelegt.

transform-set habe ich auf 3des geändert.

No peer struct to get peer description

Jan 12 12:44:13.022: ISAKMP (0:0): received packet from 10.1.1.1 dport 500 sport 500 vpngreen (N) NEW SA
Jan 12 12:44:13.022: ISAKMP: Created a peer struct for 10.1.1.1, peer port 500
Jan 12 12:44:13.022: ISAKMP: New peer created peer = 0x66F88A38 peer_handle = 0x80000020
Jan 12 12:44:13.022: ISAKMP: Locking peer struct 0x66F88A38, refcount 1 for crypto_isakmp_process_block
Jan 12 12:44:13.022: ISAKMP: local port 500, remote port 500
Jan 12 12:44:13.022: insert sa successfully sa = 66F841E4
Jan 12 12:44:13.022: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
Jan 12 12:44:13.022: ISAKMP:(0):Old State = IKE_READY  New State = IKE_R_MM1 

Jan 12 12:44:13.022: ISAKMP:(0): processing SA payload. message ID = 0
Jan 12 12:44:13.022: ISAKMP:(0): processing vendor id payload
Jan 12 12:44:13.022: ISAKMP:(0): vendor ID seems Unity/DPD but major 245 mismatch
Jan 12 12:44:13.022: ISAKMP (0:0): vendor ID is NAT-T v7
Jan 12 12:44:13.022: ISAKMP:(0): processing vendor id payload
Jan 12 12:44:13.022: ISAKMP:(0): vendor ID seems Unity/DPD but major 157 mismatch
Jan 12 12:44:13.022: ISAKMP:(0): vendor ID is NAT-T v3
Jan 12 12:44:13.022: ISAKMP:(0): processing vendor id payload
Jan 12 12:44:13.022: ISAKMP:(0): vendor ID seems Unity/DPD but major 123 mismatch
Jan 12 12:44:13.022: ISAKMP:(0): vendor ID is NAT-T v2
Jan 12 12:44:13.022: ISAKMP:(0):No pre-shared key with 10.1.1.1!
Jan 12 12:44:13.022: ISAKMP : Scanning profiles for xauth ...
Jan 12 12:44:13.022: ISAKMP:(0):Checking ISAKMP transform 1 against priority 1 policy
Jan 12 12:44:13.022: ISAKMP:      encryption 3DES-CBC
Jan 12 12:44:13.022: ISAKMP:      hash SHA
Jan 12 12:44:13.022: ISAKMP:      default group 2
Jan 12 12:44:13.022: ISAKMP:      auth pre-share
Jan 12 12:44:13.022: ISAKMP:      life type in seconds
Jan 12 12:44:13.022: ISAKMP:      life duration (basic) of 500
Jan 12 12:44:13.022: ISAKMP:(0):Hash algorithm offered does not match policy!
Jan 12 12:44:13.022: ISAKMP:(0):atts are not acceptable. Next payload is 0
Jan 12 12:44:13.022: ISAKMP:(0):Checking ISAKMP transform 1 against priority 65535 policy
Jan 12 12:44:13.022: ISAKMP:      encryption 3DES-CBC
Jan 12 12:44:13.022: ISAKMP:      hash SHA
Jan 12 12:44:13.022: ISAKMP:      default group 2
Jan 12 12:44:13.022: ISAKMP:      auth pre-share
Jan 12 12:44:13.022: ISAKMP:      life type in seconds
Jan 12 12:44:13.022: ISAKMP:      life duration (basic) of 500
Jan 12 12:44:13.022: ISAKMP:(0):Encryption algorithm offered does not match policy!
Jan 12 12:44:13.022: ISAKMP:(0):atts are not acceptable. Next payload is 0
Jan 12 12:44:13.022: ISAKMP:(0):no offers accepted!
Jan 12 12:44:13.022: ISAKMP:(0): phase 1 SA policy not acceptable! (local 10.5.5.5 remote 10.1.1.1)
Jan 12 12:44:13.022: ISAKMP (0:0): incrementing error counter on sa, attempt 1 of 5: construct_fail_ag_init
Jan 12 12:44:13.022: ISAKMP:(0): sending packet to 10.1.1.1 my_port 500 peer_port 500 (R) MM_NO_STATE
Jan 12 12:44:13.022: ISAKMP:(0):Sending an IKE IPv4 Packet.
Jan 12 12:44:13.022: ISAKMP:(0):peer does not do paranoid keepalives.

nimrod_ · 12. Januar 2009

Jan 12 12:44:13.022: ISAKMP:(0):deleting SA reason "Phase1 SA policy proposal not accepted" state (R) MM_NO_STATE (peer 10.1.1.1)
Jan 12 12:44:13.022: ISAKMP:(0): processing vendor id payload
Jan 12 12:44:13.022: ISAKMP:(0): vendor ID seems Unity/DPD but major 245 mismatch
Jan 12 12:44:13.022: ISAKMP (0:0): vendor ID is NAT-T v7
Jan 12 12:44:13.022: ISAKMP:(0): processing vendor id payload
Jan 12 12:44:13.022: ISAKMP:(0): vendor ID seems Unity/DPD but major 157 mismatch
Jan 12 12:44:13.022: ISAKMP:(0): vendor ID is NAT-T v3
Jan 12 12:44:13.022: ISAKMP:(0): processing vendor id payload
Jan 12 12:44:13.022: ISAKMP:(0): vendor ID seems Unity/DPD but major 123 mismatch
Jan 12 12:44:13.022: ISAKMP:(0): vendor ID is NAT-T v2
Jan 12 12:44:13.022: ISAKMP (0:0): FSM action returned error: 2
Jan 12 12:44:13.022: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
Jan 12 12:44:13.022: ISAKMP:(0):Old State = IKE_R_MM1  New State = IKE_R_MM1 

Jan 12 12:44:13.022: ISAKMP:(0):deleting SA reason "Phase1 SA policy proposal not accepted" state (R) MM_NO_STATE (peer 10.1.1.1) 
Jan 12 12:44:13.022: ISAKMP: Unlocking peer struct 0x66F88A38 for isadb_mark_sa_deleted(), count 0
Jan 12 12:44:13.022: ISAKMP: Deleting peer node by peer_reap for 10.1.1.1: 66F88A38
Jan 12 12:44:13.022: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PHASE1_DEL
Jan 12 12:44:13.022: ISAKMP:(0):Old State = IKE_R_MM1  New State = IKE_DEST_SA 

Jan 12 12:44:13.022: IPSEC(key_engine): got a queue event with 1 KMI message(s)
Jan 12 12:44:13.022: ISAKMP:(0):deleting SA reason "No reason" state (R) MM_NO_STATE (peer 10.1.1.1) 
Jan 12 12:44:13.022: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_ERROR
Jan 12 12:44:13.022: ISAKMP:(0):Old State = IKE_DEST_SA  New State = IKE_DEST_SA

Wordo · 12. Januar 2009

Die 7300 kennt keinen Key fuer 10.1.1.1. Wie sieht denn jetzt der Debug auf dem 1841er aus?

nimrod_ · 12. Januar 2009

ping vom 1841

*Jan 12 14:10:06: IPSEC(sa_request): ,
 (key eng. msg.) OUTBOUND local= 10.1.1.1, remote= 10.5.5.5, 
   local_proxy= 192.168.1.0/255.255.255.0/0/0 (type=4), 
   remote_proxy= 0.0.0.0/0.0.0.0/0/0 (type=4),
   protocol= ESP, transform= NONE  (Tunnel), 
   lifedur= 3600s and 4608000kb, 
   spi= 0x29949A0E(697604622), conn_id= 0, keysize= 0, flags= 0x0
*Jan 12 14:10:06: ISAKMP: set new node 0 to QM_IDLE      
*Jan 12 14:10:06: ISAKMP:(0):SA is still budding. Attached new ipsec request to it. (local 10.1.1.1, remote 10.5.5.5)
*Jan 12 14:10:06: ISAKMP: Error while processing SA request: Failed to initialize SA
*Jan 12 14:10:06: ISAKMP: Error while processing KMI message 0, error 2......
Success rate is 0 percent (0/5)
c1841-eth#
*Jan 12 14:10:32: %CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd packet not an IPSEC packet.
       (ip) vrf/dest_addr= /192.168.1.1, src_addr= 10.5.5.5, prot= 1
*Jan 12 14:10:36: IPSEC(key_engine): request timer fired: count = 1,
 (identity) local= 10.1.1.1, remote= 10.5.5.5, 
   local_proxy= 192.168.1.0/255.255.255.0/0/0 (type=4), 
   remote_proxy= 0.0.0.0/0.0.0.0/0/0 (type=4)
*Jan 12 14:10:36: IPSEC(sa_request): ,
 (key eng. msg.) OUTBOUND local= 10.1.1.1, remote= 10.5.5.5, 
   local_proxy= 192.168.1.0/255.255.255.0/0/0 (type=4), 
   remote_proxy= 0.0.0.0/0.0.0.0/0/0 (type=4),
   protocol= ESP, transform= NONE  (Tunnel), 
   lifedur= 3600s and 4608000kb, 
   spi= 0xAAFD1B70(2868714352), conn_id= 0, keysize= 0, flags= 0x0
*Jan 12 14:10:36: ISAKMP: set new node 0 to QM_IDLE      
*Jan 12 14:10:36: ISAKMP:(0):SA is still budding. Attached new ipsec request to it. (local 10.1.1.1, remote 10.5.5.5)
*Jan 12 14:10:36: ISAKMP: Error while processing SA request: Failed to initialize SA
*Jan 12 14:10:36: ISAKMP: Error while processing KMI message 0, error 2.
*Jan 12 14:11:06: IPSEC(key_engine): request timer fired: count = 2,
 (identity) local= 10.1.1.1, remote= 10.5.5.5, 
   local_proxy= 192.168.1.0/255.255.255.0/0/0 (type=4), 
   remote_proxy= 0.0.0.0/0.0.0.0/0/0 (type=4)

ping vom 7301

*Jan 12 14:18:19: %CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd packet not an IPSEC packet.

(ip) vrf/dest_addr= /192.168.1.1, src_addr= 10.5.5.5, prot= 1

beides outputs vom 1841

Wordo · 12. Januar 2009

Was passiert denn wenn du am Portchannel HSRP deaktivierst und dem Ding ip unnumbered lo1 gibst?

nimrod_ · 12. Januar 2009

ich muss gestehen, dass ich nur die hälfte verstanden habe. der 7301 ist in einem cluster (deswegen bin ich mir über das deaktivieren von hsrp unsicher).

wenn du mir noch einen tipp gibts, was du mit ip unnumbered auf lo1 meinst, wär ich dir sehr dankbar

Wordo · 12. Januar 2009

interface Port-channel1.159

description VPNGREEN

encapsulation dot1Q 159

ip vrf forwarding vpngreen

ip address 10.0.0.2 255.255.255.0

standby version 2

standby 159 ip 10.0.0.1

standby 159 follow access

standby 159 priority 101 (die wird auf beiden nicht gleich sein, also anpassen)

Ist das produktiv? Wenn nein, auf beiden Geraeten:

no ip address 10.0.0.2 255.255.255.0

no standby version 2

no standby 159 ip 10.0.0.1

no standby 159 follow access

no standby 159 priority 101

und dann auf dem wo dus testest:

ip unnumbered Loopback1

nimrod_ · 12. Januar 2009

ist leider produktiv...

hab nochmal meine änderungen rückgängig gemacht und versuch die config neu reinzuschreiben...

ich bin nur verwirrt, warum das alles nicht so geht -.-

Wordo · 12. Januar 2009

Der 7300er erkennt den Key nicht, also stimmt entweder am VRF was nicht, oder es fehlt im crypto was, oder es ist ein IOS-Bug. Die Aenderung von mir machts halt erst mal nicht ganz so fehleranfaellig.

nimrod_ · 12. Januar 2009

ok, dann werd ich das mal versuchen... ich werds schon mirbekommen, wenn irgendjemand probleme hat... telefon ist ja nicht so weit weg^^ *g*

hier nochmal die einzelnen crypto config teile

!======HUB=======
crypto isakmp policy 1
encr 3des
hash md5
authentication pre-share
group 2
lifetime 500
authentication pre-share
crypto isakmp key cisco1841 address 10.1.1.1 
crypto isakmp key cisco878 address 10.1.1.4 
crypto ipsec transform-set ts_cisco_170 esp-3des esp-md5-hmac 
crypto ipsec transform-set ts_cisco_180 esp-3des esp-md5-hmac 
!
crypto map cm_L1 17 ipsec-isakmp 
set peer 10.1.1.1
set transform-set ts_cisco_170 
match address 170
!
crypto map cm_L1 18 ipsec-isakmp
set peer 10.1.1.4
set transform-set ts_cisco_180 
match address 180
!
interface Loopback1
crypto map cm_L1
!
access-list 170 permit ip any 192.168.1.0 0.0.0.255
access-list 180 permit ip any 192.168.100.0 0.0.0.255


!=====SPOKE 2 1841======
crypto isakmp policy 1
encr 3des
hash md5
authentication pre-share
group 2
lifetime 500
crypto isakmp key cisco1841 address 10.5.5.5 
crypto ipsec transform-set ts_cisco_170 esp-3des esp-md5-hmac
!
crypto map cm_D1 17 ipsec-isakmp 
set peer 10.5.5.5
set transform-set ts_cisco_170
match address 170
!
interface Dialer1
crypto map cm_D1
!
access-list 170 permit ip 192.168.1.0 0.0.0.255 any


!=====SPOKE 2 878======
crypto isakmp policy 1
encr 3des
hash md5
authentication pre-share
group 2
lifetime 500
crypto isakmp key cisco878 address 10.5.5.5 
crypto ipsec transform-set ts_cisco_180 esp-3des esp-md5-hmac 
!
crypto map cm_D1 18 ipsec-isakmp
set peer 10.5.5.5
set transform-set ts_cisco_180
match address 180
!
interface Dialer1
crypto map cm_D1
!
access-list 180 permit ip 192.168.100.0 0.0.0.255 any

–

mir ist da gerade noch etwas aufgefallen... es wird anscheinend nur eine der beiden crypto maps auf dem 7301 genutzt... das ist prinzipiell nicht so gewollt... realisiere ich das am besten mit einer dynamischen map?

Wordo · 12. Januar 2009

Probiers mal nach der Anleitung, macht schon wesentlich mehr Sinn warum er den Key nicht findet:

Cisco IOS Security Configuration Guide, Release 12.4T - VRF-Aware Ipsec [Cisco IOS Software Releases 12.4 T] - Cisco Systems

nimrod_ · 12. Januar 2009

ich hatte vorher schoneinmal folgendes versucht (ist noch die alte config und noch nicht entsprechend angepasst)

crypto keyring l2tp vrf vpngreen
 pre-shared-key address 0.0.0.0 0.0.0.0 key ewetel
!
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
crypto isakmp key ewetel address 10.5.5.5
crypto isakmp keepalive 45 3
!
!
crypto ipsec transform-set ESP-3DES-SHA1 esp-3des esp-sha-hmac 
crypto ipsec transform-set l2tp esp-3des esp-sha-hmac 
!
crypto dynamic-map vpn-dyn 10
set transform-set l2tp 
!
!
!
!
!
!
!
crypto map vpn 6000 ipsec-isakmp dynamic vpn-dyn

–

mist, da warst du schneller... werd ich mir mal anschauen *lad*

–

ok, hab das nun mal eingespielt... bringt keine veränderung. ich konnte es nicht ganz so machen, wie es in der anleitung steht. hier meine änderungen

[b]7301[/b]
crypto keyring l2tp vrf vpngreen
 pre-shared-key address 0.0.0.0 0.0.0.0 key ewetel
!
crypto isakmp policy 1
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key ewetel address 10.1.1.1
crypto isakmp key ewetel address 10.1.1.4
crypto isakmp keepalive 45 3
!
!
crypto ipsec transform-set l2tp esp-3des esp-sha-hmac 
!
crypto dynamic-map vpn-dyn 10
set transform-set l2tp 
!
!
!
!
!
!
!
crypto map vpn 6000 ipsec-isakmp dynamic vpn-dyn 
!
!
!
interface Loopback1
crypto map vpn
!
access-list 100 permit ip any 192.168.1.0 0.0.0.255
access-list 100 permit ip any 192.168.100.0 0.0.0.255

[b]1841[/b]
crypto isakmp policy 1
encr 3des
hash md5
authentication pre-share
group 2
lifetime 500
crypto isakmp key ewetel address 10.5.5.5 
crypto ipsec transform-set ts_cisco_170 esp-3des esp-sha-hmac
!
crypto map cm_D1 17 ipsec-isakmp 
set peer 10.5.5.5
set transform-set ts_cisco_170
match address 170
!
interface Dialer1
crypto map cm_D1
!
access-list 170 permit ip 192.168.1.0 0.0.0.255 any

Anmelden

IPsec zwischen Cisco 7301 und Cisco 1841

Empfohlene Beiträge

nimrod_ 11

Link zu diesem Kommentar

nimrod_ 11

Link zu diesem Kommentar

Wordo 11

Link zu diesem Kommentar

nimrod_ 11

Link zu diesem Kommentar

Wordo 11

Link zu diesem Kommentar

nimrod_ 11

Link zu diesem Kommentar

Wordo 11

Link zu diesem Kommentar

nimrod_ 11

Link zu diesem Kommentar

Wordo 11

Link zu diesem Kommentar

nimrod_ 11

Link zu diesem Kommentar

Wordo 11

Link zu diesem Kommentar

nimrod_ 11

Link zu diesem Kommentar

Schreibe einen Kommentar

Menu

Aktivitäten