VPN: вся информация в этой теме - [56] :: В помощь системному администратору

день добрый!!!
ПОМОГИТЕ разобраться - непашет VPN
Имеем Linux - OpenSWAN
Вот что лог пишет
Nov 21 15:35:35 gate pluto[3974]: "Ekaterinburg" #14: max number of retransmissions (2) reached STATE_QUICK_I1. No acceptable response to our first Quick Mode message: perhaps peer likes no proposal
Nov 21 15:35:35 gate pluto[3974]: "Ekaterinburg" #14: starting keying attempt 2 of an unlimited number
Nov 21 15:35:35 gate pluto[3974]: "Ekaterinburg" #15: initiating Main Mode
Nov 21 15:35:35 gate pluto[3974]: "Ekaterinburg" #15: ignoring Vendor ID payload [4048b7d56ebce88525e7de7f00d6c2d3c0000000]
Nov 21 15:35:35 gate pluto[3974]: "Ekaterinburg" #15: transition from state STATE_MAIN_I1 to state STATE_MAIN_I2
Nov 21 15:35:35 gate pluto[3974]: "Ekaterinburg" #15: ignoring Vendor ID payload [Cisco-Unity]
Nov 21 15:35:35 gate pluto[3974]: "Ekaterinburg" #15: ignoring Vendor ID payload [XAUTH]
Nov 21 15:35:35 gate pluto[3974]: "Ekaterinburg" #15: ignoring Vendor ID payload [4cccb4f576062f7c633edfd762db6f69]
Nov 21 15:35:35 gate pluto[3974]: "Ekaterinburg" #15: ignoring Vendor ID payload [1f07f70eaa6514d3b0fa96542a500100]
Nov 21 15:35:36 gate pluto[3974]: "Ekaterinburg" #15: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3
Nov 21 15:35:36 gate pluto[3974]: "Ekaterinburg" #15: received Vendor ID payload [Dead Peer Detection]
Nov 21 15:35:36 gate pluto[3974]: "Ekaterinburg" #15: Main mode peer ID is ID_FQDN: '@pixel.uralmash.ru'
Nov 21 15:35:36 gate pluto[3974]: "Ekaterinburg" #15: transition from state STATE_MAIN_I3 to state STATE_MAIN_I4
Nov 21 15:35:36 gate pluto[3974]: "Ekaterinburg" #15: ISAKMP SA established
Nov 21 15:35:36 gate pluto[3974]: "Ekaterinburg" #16: initiating Quick Mode PSK+ENCRYPT+TUNNEL+PFS
Nov 21 15:35:36 gate pluto[3974]: "Ekaterinburg" #15: ignoring informational payload, type NO_PROPOSAL_CHOSEN
Nov 21 15:35:36 gate pluto[3974]: "Ekaterinburg" #15: received and ignored informational message
Nov 21 15:35:36 gate pluto[3974]: "Ekaterinburg" #15: received Delete SA payload: deleting ISAKMP State #15
Nov 21 15:35:36 gate pluto[3974]: packet from 197.60.5.42:500: received and ignored informational message
И так по кругу

Настройки

netstat -nr
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
219.172.123.188 0.0.0.0 255.255.255.252 U 0 0 0 eth1
219.172.123.188 0.0.0.0 255.255.255.252 U 0 0 0 ipsec0
192.168.4.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
0.0.0.0 219.172.123.189 0.0.0.0 UG 0 0 0 eth1

cat /proc/net/ipsec_tncfg
ipsec0 -> eth1 mtu=16260(1500) -> 1500

ipsec auto --status
000 interface ipsec0/eth1 219.172.123.190

eth1 inet addr:219.172.123.190 Bcast:219.172.123.191 Mask:255.255.255.252

ipsec0 inet addr:219.172.123.190 Mask:255.255.255.252

кусок фаера
Chain IPSECPHYSICAL (1 references)
target prot opt in out source destination
ACCEPT 47 -- eth1 * 0.0.0.0/0 0.0.0.0/0
ACCEPT esp -- eth1 * 0.0.0.0/0 0.0.0.0/0
ACCEPT ah -- eth1 * 0.0.0.0/0 0.0.0.0/0
ACCEPT udp -- eth1 * 0.0.0.0/0 0.0.0.0/0 udp spt:500 dpt:500
ACCEPT udp -- eth1 * 0.0.0.0/0 0.0.0.0/0 udp dpt:4500

/etc/ipsec.conf
config setup
    interfaces="%defaultroute "
    klipsdebug="none"
    plutodebug="none"
    plutoload=%search
    plutostart=%search
    uniqueids=yes
    nat_traversal=yes
    virtual_private=%v4:10.0.0.0/8,%v4:172.16.0.0/12,%v4:192.168.0.0/16,%v4:!192.168.4.0/255.255.255.0,%v4:!10.11.0.0/255.255.0.0

conn %default
    keyingtries=0
    disablearrivalcheck=no

conn Ekaterinburg #RED
    left=219.172.123.190
    leftnexthop=%defaultroute
    leftsubnet=192.168.4.0/255.255.255.0
    right=197.60.5.42
    rightsubnet=10.11.0.0/255.255.0.0
    rightnexthop=%defaultroute
    leftid="@соответствующие DNS имя"
    rightid="@соответствующие DNS имя"
    ike=3des-md5-modp1536,3des-md5-modp1024
    esp=3des-md5
    ikelifetime=1h
    keylife=8h
    dpddelay=30
    dpdtimeout=120
    dpdaction=restart
    pfs=yes
    authby=secret
    auto=start
pre-shared-key 123456

на той стороне Cisco
С такими настройками
name 10.11.0.0 blabla-network
asdm location blabla-network 255.255.0.0 inside

access-list outside_cryptomap_40_1 extended permit ip blabla-network 255.255.0.0 192.168.4.0 255.255.255.0

crypto map outside_map 40 match address outside_cryptomap_40_1
crypto map outside_map 40 set peer 219.172.123.190
crypto map outside_map 40 set transform-set ESP-DES-MD5
crypto map outside_map 40 set nat-t-disable
crypto map outside_map interface outside

isakmp enable outside

tunnel-group 219.172.123.190 type ipsec-l2l
tunnel-group 219.172.123.190 ipsec-attributes
pre-shared-key 123456

Модерирует : lynx, Crash_Master, dg, emx, ShriEkeR
Версия для печати • Подписаться • Добавить в закладки
Страницы: 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160