Столкнулся с проблемой в настройке remote access vpn на PIX. Нужно чтобы работал через стандартный MS VPN client, в дальнейшем android,IOS. Через cisco клиент все прекрасно работает. Настраивать пробовал и через визард АСДМ и через консоль. Проблема как я понял не новая, но решения что то никак не найду. Есть подобная тема http://www.opennet.ru/openforum/vsluhforumID6/11711.html. - вот только товарищ умалчивает как он решил проблему. Делал по анологии с http://www.cisco.com/en/US/products/ps6120/products_configur...
Выкладываю свой конфиг:access-list NONAT extended permit ip object-group NET(внутренняя сеть) 172.21.15.0 255.255.255.0
nat(innet1) 0 access-list NONAT
ip local pool iphone-pool 172.21.15.10 - 172.21.15.20 mask 255.255.255.0
nat (Asnet) 1 172.21.15.0 255.255.255.224
group-policy DefaultRAGroup internal
group-policy DefaultRAGroup attributes
vpn-tunnel-protocol IPSec l2tp-ipsec
username test pass test
crypto ipsec transform-set TRANS_ESP_3DES_MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set TRANS_ESP_3DES_MD5 mode transport
crypto dynamic-map outside_dyn_map 20 set transform-set TRANS_ESP_3DES_MD5
crypto map office 33 ipsec-isakmp dynamic outside_dyn_map
crypto map office interface ASnet
crypto isakmp enable ASnet
crypto isakmp nat-traversal 20
crypto isakmp policy 40
authentication pre-share
encryption 3des
hash md5
group 2
lifetime 86400
tunnel-group DefaultRAGroup general-attributes
address-pool NET1
default-group-policy DefaultRAGroup
tunnel-group DefaultRAGroup ipsec-attributes
pre-shared-key *
tunnel-group DefaultRAGroup ppp-attributes
no authentication chap
authentication ms-chap-v2
Настройки MS Vpn клиента как в примере.Выдает ошибку 789.
Вот что debug crypto isakmp 7 выдает:
Jan 23 13:59:56 [IKEv1]: IP = 95.24.254.251, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 384
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing SA payload
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, Oakley proposal is acceptable
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing VID payload
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing VID payload
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, Received NAT-Traversal RFC VID
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing VID payload
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, Received NAT-Traversal ver 02 VID
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing VID payload
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, Received Fragmentation VID
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing VID payload
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing VID payload
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing VID payload
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing IKE SA payload
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, IKE SA Proposal # 1, Transform # 5 acceptable Matches global IKE entry # 7
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, constructing ISAKMP SA payload
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, constructing NAT-Traversal VID ver 02 payload
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, constructing Fragmentation VID + extended capabilities payload
Jan 23 13:59:56 [IKEv1]: IP = 95.24.254.251, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 124
Jan 23 13:59:56 [IKEv1]: IP = 95.24.254.251, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + KE (4) + NONCE (10) + NAT-D (130) + NAT-D (130) + NONE (0) total length : 260
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing ke payload
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing ISA_KE payload
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing nonce payload
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing NAT-Discovery payload
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, computing NAT Discovery hash
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing NAT-Discovery payload
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, computing NAT Discovery hash
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, constructing ke payload
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, constructing nonce payload
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, constructing Cisco Unity VID payload
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, constructing xauth V6 VID payload
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, Send IOS VID
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, Constructing ASA spoofing IOS Vendor ID payload (version: 1.0.0, capabilities: 20000001)
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, constructing VID payload
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, Send Altiga/Cisco VPN3000/Cisco ASA GW VID
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, constructing NAT-Discovery payload
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, computing NAT Discovery hash
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, constructing NAT-Discovery payload
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, computing NAT Discovery hash
Jan 23 13:59:56 [IKEv1]: IP = 95.24.254.251, Connection landed on tunnel_group DefaultRAGroup
Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, Generating keys for Responder...
Jan 23 13:59:56 [IKEv1]: IP = 95.24.254.251, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + KE (4) + NONCE (10) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NAT-D (130) + NAT-D (130) + NONE (0) total length : 304
%PIX-3-713119: Group = DefaultRAGroup, IP = 95.24.254.251, PHASE 1 COMPLETED
%PIX-3-713122: IP = 95.24.254.251, Keep-alives configured on but peer does not support keep-alives (type = None)
: IP = 95.24.254.251, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + ID (5) + HASH (8) + NONE (0) total length : 64
Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, processing ID payload
Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, processing hash payload
Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, Computing hash for ISAKMP
Jan 23 13:59:56 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, Automatic NAT Detection Status: Remote end IS behind a NAT device This end is NOT behind a NAT device
Jan 23 13:59:56 [IKEv1]: IP = 95.24.254.251, Connection landed on tunnel_group DefaultRAGroup
Jan 23 13:59:56 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, Freeing previously allocated memory for authorization-dn-attributes
Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, constructing ID payload
Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, constructing hash payload
Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, Computing hash for ISAKMP
Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, constructing dpd vid payload
Jan 23 13:59:56 [IKEv1]: IP = 95.24.254.251, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + ID (5) + HASH (8) + VENDOR (13) + NONE (0) total length : 84
Jan 23 13:59:56 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, PHASE 1 COMPLETED
Jan 23 13:59:56 [IKEv1]: IP = 95.24.254.251, Keep-alive type for this connection: None
Jan 23 13:59:56 [IKEv1]: IP = 95.24.254.251, Keep-alives configured on but peer does not support keep-alives (type = None)
Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, Starting P1 rekey timer: 21600 seconds.
%PIX-3-713902: Group = DefaultRAGroup, IP = 95.24.254.251, QM FSM error (P2 struct &0x2c44938, mess id 0x1)!
%PIX-3-713902: Group = DefaultRAGroup, IP = 95.24.254.251, Removing peer from correlator table failed, no match!
Jan 23 13:59:56 [IKEv1]: IP = 95.24.254.251, IKE_DECODE RECEIVED Message (msgid=1) with payloads : HDR + HASH (8) + SA (1) + NONCE (10) + ID (5) + ID (5) + NAT-OA (131) + NONE (0) total length : 312
Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, processing hash payload
Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, processing SA payload
Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, processing nonce payload
Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, processing ID payload
Jan 23 13:59:56 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, Received remote Proxy Host data in ID Payload: Address 192.168.1.134, Protocol 17, Port 1701
Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, processing ID payload
Jan 23 13:59:56 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, Received local Proxy Host data in ID Payload: Address 193.106.72.5, Protocol 17, Port 1701
Jan 23 13:59:56 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, L2TP/IPSec session detected.
Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, processing NAT-Original-Address payload
Jan 23 13:59:56 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, QM IsRekeyed old sa not found by addr
Jan 23 13:59:56 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, Static Crypto Map check, checking map = office, seq = 30...
Jan 23 13:59:56 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, Static Crypto Map check, map = office, seq = 30, no ACL configured
Jan 23 13:59:56 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, Static Crypto Map check, checking map = office, seq = 31...
Jan 23 13:59:56 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, Static Crypto Map check, map = office, seq = 31, ACL does not match proxy IDs src:95.24.254.251 dst:193.106.72.5
Jan 23 13:59:56 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, Static Crypto Map check, checking map = office, seq = 32...
Jan 23 13:59:56 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, Static Crypto Map check, map = office, seq = 32, no ACL configured
Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, Selecting only UDP-Encapsulated-Tunnel and UDP-Encapsulated-Transport modes defined by NAT-Traversal
Jan 23 13:59:56 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, IKE Remote Peer configured for crypto map: DYNMAP
Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, processing IPSec SA payload
Jan 23 13:59:56 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, All IPSec SA proposals found unacceptable!
Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, sending notify message
Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, constructing blank hash payload
Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, constructing ipsec notify payload for msg id 1
Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, constructing qm hash payload
Jan 23 13:59:56 [IKEv1]: IP = 95.24.254.251, IKE_DECODE SENDING Message (msgid=fdf24661) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 84
Jan 23 13:59:56 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, QM FSM error (P2 struct &0x2c44938, mess id 0x1)!
Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, IKE QM Responder FSM error history (struct &0x2c44938) <state>, <event>: QM_DONE, EV_ERROR-->QM_BLD_MSG2, EV_NEGO_SA-->QM_BLD_MSG2, EV_IS_REKEY-->QM_BLD_MSG2, EV_CONFIRM_SA-->QM_BLD_MSG2, EV_PROC_MSG-->QM_BLD_MSG2, EV_HASH_OK-->QM_BLD_MSG2, NullEvent-->QM_BLD_MSG2, EV_COMP_HASH
Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, sending delete/delete with reason message
Jan 23 13:59:56 [IKEv1]: Group = DefaultRAGroup, IP = 95.24.254.251, Removing peer from correlator table failed, no match!
Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, IKE SA MM:a6345da0 rcv'd Terminate: state MM_ACTIVE flags 0x00000042, refcnt 1, tuncnt 0
Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, IKE SA MM:a6345da0 terminating: flags 0x01000002, refcnt 0, tuncnt 0
Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, sending delete/delete with reason message
Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, constructing blank hash payload
Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, constructing IKE delete payload
Jan 23 13:59:56 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 95.24.254.251, constructing qm hash payload
Jan 23 13:59:56 [IKEv1]: IP = 95.24.254.251, IKE_DECODE SENDING Message (msgid=4eee6bc6) with payloads : HDR + HASH (8) + DELETE (12) + NONE (0) total length : 80
Jan 23 13:59:56 [IKEv1]: IP = 95.24.254.251, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 384
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing SA payload
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, Oakley proposal is acceptable
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing VID payload
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing VID payload
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, Received NAT-Traversal RFC VID
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing VID payload
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, Received NAT-Traversal ver 02 VID
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing VID payload
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, Received Fragmentation VID
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing VID payload
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing VID payload
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing VID payload
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, processing IKE SA payload
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, IKE SA Proposal # 1, Transform # 5 acceptable Matches global IKE entry # 7
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, constructing ISAKMP SA payload
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, constructing NAT-Traversal VID ver 02 payload
Jan 23 13:59:56 [IKEv1 DEBUG]: IP = 95.24.254.251, constructing Fragmentation VID + extended capabilities payload
Jan 23 13:59:56 [IKEv1]: IP = 95.24.254.251, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 124
Jan 23 14:00:04 [IKEv1]: IP = 95.24.254.251, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 124
Jan 23 14:00:12 [IKEv1]: IP = 95.24.254.251, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 124
Debug crypto ipsec 7:
%PIX-3-713119: Group = DefaultRAGroup, IP = 95.24.254.251, PHASE 1 COMPLETED
%PIX-3-713122: IP = 95.24.254.251, Keep-alives configured on but peer does not support keep-alives (type = None)
%PIX-3-713902: Group = DefaultRAGroup, IP = 95.24.254.251, QM FSM error (P2 struct &0x32bc3b0, mess id 0x1)!
%PIX-3-713902: Group = DefaultRAGroup, IP = 95.24.254.251, Removing peer from correlator table failed, no match!
Проблема как я понимаю во второй фазе.
Также не понятно почему PIX ругается на команду:
PIX525(config)# crypto map office 33 ipsec-isakmp dynamic outside_dyn_map
WARNING: dynamic map has incomplete entries
Заранее спасибо, кто не поленился прочитать))
