Всем привет!
Я пытаюсь настроить ipsec site-to-site vpn между TMG 2010 и Cisco 2800 series.
И у меня не выходит ничего. Я нарыл в интернете кучу мануалов, сделал по ним, потом переделал, а оно НЕ работает. Отчаяние!
Ниже в посте куски конфиги из Циско и ТМГ. В логах windows – ничего.
Буду очень благодарен за любой совет!!
TMG site-to-site summary
[code]Local Tunnel Endpoint: 39.59.89.91
Remote Tunnel Endpoint: 78.71.74.8
To allow HTTP proxy or NAT traffic to the remote site,
the remote site configuration must contain the local
site tunnel end-point IP address.
IKE Phase I Parameters:
Mode: Main mode
Encryption: 3DES
Integrity: SHA1
Diffie-Hellman group: Group 2 (1024 bit)
Authentication Method: Pre-shared secret (Remotekeyagent)
Security Association Lifetime: 28800 seconds
IKE Phase II Parameters:
Mode: ESP tunnel mode
Encryption: 3DES
Integrity: SHA1
Perfect Forward Secrecy: ON
Diffie-Hellman group: Group 2 (1024 bit)
Time Rekeying: ON
Security Association Lifetime: 3600 seconds
Kbyte Rekeying: OFF
Remote Network 'contoso' IP Subnets:
Subnet: 78.71.74.8/255.255.255.255
Subnet: 192.168.7.0/255.255.255.0
Local Network 'Internal' IP Subnets:
Subnet: 10.10.99.0/255.255.255.0
Subnet: 10.11.99.0/255.255.255.0
VPN Static Pool on Server 'Fabrikam_GW' IP Subnets:
Subnet: 10.10.199.1/255.255.255.255
Subnet: 10.10.199.150/255.255.255.255
Subnet: 10.10.199.2/255.255.255.254
Subnet: 10.10.199.148/255.255.255.254
Subnet: 10.10.199.4/255.255.255.252
Subnet: 10.10.199.144/255.255.255.252
Subnet: 10.10.199.8/255.255.255.248
Subnet: 10.10.199.16/255.255.255.240
Subnet: 10.10.199.128/255.255.255.240
Subnet: 10.10.199.32/255.255.255.224
Subnet: 10.10.199.64/255.255.255.192
Routable Local IP Addresses:
Subnet: 10.10.99.0/255.255.255.0
Subnet: 10.11.99.0/255.255.255.0
[/code]
Cisco debug log:
[code]
cisco2800#
Aug 27 11:56:22: IPSEC(key_engine): request timer fired: count = 1,
(identity) local= 78.71.74.8, remote= 39.59.89.91,
local_proxy= 78.71.74.8/255.255.255.255/0/0 (type=1),
remote_proxy= 10.10.99.0/255.255.255.0/0/0 (type=4)
Aug 27 11:56:22: IPSEC(sa_request): ,
(key eng. msg.) OUTBOUND local= 78.71.74.8, remote= 39.59.89.91,
local_proxy= 78.71.74.8/255.255.255.255/0/0 (type=1),
remote_proxy= 10.10.99.0/255.255.255.0/0/0 (type=4),
protocol= ESP, transform= NONE (Tunnel),
lifedur= 3600s and 4608000kb,
spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x0
Aug 27 11:56:22: ISAKMP: set new node 0 to QM_IDLE
cisco2800#
Aug 27 11:56:22: ISAKMP:(0):SA is still budding. Attached new ipsec request to it. (local 78.71.74.8, remote 39.59.89.91)
Aug 27 11:56:22: ISAKMP: Error while processing SA request: Failed to initialize SA
Aug 27 11:56:22: ISAKMP: Error while processing KMI message 0, error 2.
cisco2800#
Aug 27 11:56:25: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE...
Aug 27 11:56:25: ISAKMP (0:0): incrementing error counter on sa, attempt 5 of 5: retransmit phase 1
Aug 27 11:56:25: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE
Aug 27 11:56:25: ISAKMP:(0): sending packet to 39.59.89.91 my_port 500 peer_port 500 (I) MM_NO_STATE
cisco2800#
Aug 27 11:56:35: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE...
Aug 27 11:56:35: ISAKMP:(0):peer does not do paranoid keepalives.
Aug 27 11:56:35: ISAKMP:(0):deleting SA reason "Death by retransmission P1" state (I) MM_NO_STATE (peer 39.59.89.91)
Aug 27 11:56:35: ISAKMP:(0):deleting SA reason "Death by retransmission P1" state (I) MM_NO_STATE (peer 39.59.89.91)
Aug 27 11:56:35: ISAKMP: Unlocking peer struct 0x4505C97C for isadb_mark_sa_deleted(), count 0
Aug 27 11:56:35: ISAKMP: Deleting peer node by peer_reap for 39.59.89.91: 4505C97C
Aug 27 11:56:35: ISAKMP:(0):deleting node 1402385507 error FALSE reason "IKE deleted"
Aug 27 11:56:35: ISAKMP:(0):deleting node 201550686 error FALSE reason "IKE deleted"
Aug 27 11:56:35: ISAKMP:(0):deleting node 1605433843 error FALSE reason "IKE deleted"
Aug 27 11:56:35: ISAKMP:(0):deleting node -1482853090 error FALSE reason "IKE deleted"
Aug 27 11:56:35: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PHASE1_DEL
Aug 27 11:56:35: ISAKMP:(0):Old State = IKE_I_MM1 New State = IKE_DEST_SA
Aug 27 11:56:35: IPSEC(key_engine): got a queue event with 1 KMI message(s)
Aug 27 11:56:36: IPSEC(key_engine): request timer fired: count = 1,
(identity) local= 78.71.74.8, remote= 39.59.89.91,
local_proxy= 192.168.7.0/255.255.255.0/0/0 (type=4),
remote_proxy= 10.10.99.0/255.255.255.0/0/0 (type=4)
Aug 27 11:56:36: IPSEC(sa_request): ,
(key eng. msg.) OUTBOUND local= 78.71.74.8, remote= 39.59.89.91,
local_proxy= 192.168.7.0/255.255.255.0/0/0 (type=4),
remote_proxy= 10.10.99.0/255.255.255.0/0/0 (type=4),
protocol= ESP, transform= NONE (Tunnel),
lifedur= 3600s and 4608000kb,
spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x0
Aug 27 11:56:36: ISAKMP:(0): SA request profile is (NULL)
Aug 27 11:56:36: ISAKMP: Created a peer struct for 39.59.89.91, peer port 500
Aug 27 11:56:36: ISAKMP: New peer created peer = 0x4505C97C peer_handle = 0x8000060D
Aug 27 11:56:36: ISAKMP: Locking peer struct 0x4505C97C, refcount 1 for isakmp_initiator
Aug 27 11:56:36: ISAKMP: local port 500, remote port 500
Aug 27 11:56:36: ISAKMP: set new node 0 to QM_IDLE
Aug 27 11:56:36: ISAKMP: Find a dup sa in the avl tree during calling isadb_insert sa = 45D78850
Aug 27 11:56:36: ISAKMP:(0):Can not start Aggressive mode, trying Main mode.
Aug 27 11:56:36: ISAKMP:(0):found peer pre-shared key matching 39.59.89.91
Aug 27 11:56:36: ISAKMP:(0):Input = IKE_MESG_FROM_IPSEC, IKE_SA_REQ_MM
cisco2800#
Aug 27 11:56:36: ISAKMP:(0):Old State = IKE_READY New State = IKE_I_MM1
Aug 27 11:56:36: ISAKMP:(0): beginning Main Mode exchange
Aug 27 11:56:36: ISAKMP:(0): sending packet to 39.59.89.91 my_port 500 peer_port 500 (I) MM_NO_STATE
Aug 27 11:56:36: ISAKMP (0:0): received packet from 39.59.89.91 dport 500 sport 500 Global (I) MM_NO_STATE
Aug 27 11:56:36: ISAKMP:(0):Couldn't find node: message_id 604531173
Aug 27 11:56:36: ISAKMP (0:0): Unknown Input IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY: state = IKE_I_MM1
Aug 27 11:56:36: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY
Aug 27 11:56:36: ISAKMP:(0):Old State = IKE_I_MM1 New State = IKE_I_MM1
cisco2800#
Aug 27 11:56:46: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE...
Aug 27 11:56:46: ISAKMP (0:0): incrementing error counter on sa, attempt 1 of 5: retransmit phase 1
Aug 27 11:56:46: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE
Aug 27 11:56:46: ISAKMP:(0): sending packet to 39.59.89.91 my_port 500 peer_port 500 (I) MM_NO_STATE
Aug 27 11:56:46: ISAKMP (0:0): received packet from 39.59.89.91 dport 500 sport 500 Global (I) MM_NO_STATE
Aug 27 11:56:46: ISAKMP:(0):Couldn't find node: message_id 475017874
Aug 27 11:56:46: ISAKMP (0:0): Unknown Input IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY: state = IKE_I_MM1
Aug 27 11:56:46: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY
Aug 27 11:56:46: ISAKMP:(0):Old State = IKE_I_MM1 New State = IKE_I_MM1
cisco2800#
Aug 27 11:56:46: %CRYPTO-6-IKMP_MODE_FAILURE: Processing of Informational mode failed with peer at 39.59.89.91
[/code]
sh crypto isakmp po
[code]
Global IKE policy
Protection suite of priority 1
encryption algorithm: AES - Advanced Encryption Standard (128 bit keys).
hash algorithm: Secure Hash Standard
authentication method: Pre-Shared Key
Diffie-Hellman group: #2 (1024 bit)
lifetime: 86400 seconds, no volume limit
Protection suite of priority 10
encryption algorithm: Three key triple DES
hash algorithm: Message Digest 5
authentication method: Pre-Shared Key
Diffie-Hellman group: #2 (1024 bit)
lifetime: 7200 seconds, no volume limit
Protection suite of priority 20
encryption algorithm: Three key triple DES
hash algorithm: Secure Hash Standard
authentication method: Pre-Shared Key
Diffie-Hellman group: #2 (1024 bit)
lifetime: 28800 seconds, no volume limit
Protection suite of priority 21
encryption algorithm: Three key triple DES
hash algorithm: Secure Hash Standard
authentication method: Pre-Shared Key
Diffie-Hellman group: #2 (1024 bit)
lifetime: 3600 seconds, no volume limit
Default protection suite
encryption algorithm: DES - Data Encryption Standard (56 bit keys).
hash algorithm: Secure Hash Standard
authentication method: Rivest-Shamir-Adleman Signature
Diffie-Hellman group: #1 (768 bit)
lifetime: 86400 seconds, no volume limit[/code]
sh crypto map int fa0/0 (outside int)
[code]
Crypto Map "MTDcryptoMap" 10 ipsec-isakmp
Peer = 91.85.63.1
Extended IP access list mtd_tunnel
access-list mtd_tunnel permit ip 192.168.7.0 0.0.0.255 192.168.2.0 0.0.0.255
Current peer: 91.85.63.52
Security association lifetime: 4608000 kilobytes/3600 seconds
PFS (Y/N): Y
DH group: group2
Transform sets={
AES-LZW,
}
Crypto Map "MTDcryptoMap" 20 ipsec-isakmp
Peer = 39.59.89.91
Extended IP access list fabrikam
access-list itmain permit ip 192.168.7.0 0.0.0.255 10.10.99.0 0.0.0.255
access-list itmain permit ip 192.168.7.0 0.0.0.255 host 39.59.89.91
access-list itmain permit ip host 78.71.74.8 10.10.99.0 0.0.0.255
Current peer: 39.59.89.91
Security association lifetime: 4608000 kilobytes/3600 seconds
PFS (Y/N): Y
DH group: group2
Transform sets={
fabrikam,
}
Interfaces using crypto map MTDcryptoMap:
FastEthernet0/0
[/code]
Parts of Cisco config
[code]
crypto isakmp policy 1
encr aes
authentication pre-share
group 2
!
crypto isakmp policy 10
encr 3des
hash md5
authentication pre-share
group 2
lifetime 7200
!
crypto isakmp policy 20
encr 3des
authentication pre-share
group 2
lifetime 28800
!
crypto isakmp policy 21
encr 3des
authentication pre-share
group 2
lifetime 3600
crypto isakmp key Remotekeyagent address 39.59.89.91
crypto isakmp invalid-spi-recovery
!
!
crypto ipsec transform-set AES-LZW esp-3des esp-md5-hmac
crypto ipsec transform-set fabrikam esp-3des esp-sha-hmac
no crypto ipsec nat-transparency udp-encaps
!
crypto ipsec profile MTD
set transform-set AES-LZW
!
crypto ipsec profile itmain
set transform-set itmain
!
!
crypto map MTDcryptoMap 10 ipsec-isakmp
set peer 91.85.63.52
set peer 91.85.63.1
set transform-set AES-LZW
set pfs group2
match address mtd_tunnel
crypto map MTDcryptoMap 20 ipsec-isakmp
set peer 39.59.89.91
set transform-set fabrikam
set pfs group2
match address fabrikam
!
ip access-list extended fabrikam
permit ip 192.168.7.0 0.0.0.255 10.10.99.0 0.0.0.255
permit ip 192.168.7.0 0.0.0.255 host 39.59.89.91
permit ip host 78.71.74.8 10.10.99.0 0.0.0.255
[/code]
BTW
Может можно как-то иначе получить доступ к удалённым сетям?
Я уже вспотел изрядно!
