Привет, я пытаюсь настроить ipsec-туннель между нашим Mikrotik и Cisco (модель неизвестна) клиента. По какой-то причине мы не можем пройти этап 1. У кого-нибудь есть какие-нибудь подсказки или примеры настройки этого соединения?
Конфигурация:
policy:
0
src-address=10.36.0.0/16:any
dst-address=172.16.54.147/32:any
protocol=all
action=encrypt
level=require
ipsec-protocols=esp
tunnel=yes
sa-src-address=62.x.y.z
sa-dst-address=217.x.y.z
proposal=BT
manual-sa=none
dont-fragment=clear
peer:
0
address=217.x.y.z/32:500
secret=“*****”
generate-policy=no
exchange-mode=main
send-initial-contact=no
proposal-check=claim
hash-algorithm=sha1
enc-algorithm=3des
dh-group=modp1024
lifetime=1d
lifebytes=0
proposal:
1
name=“BT”
auth-algorithms=sha1
enc-algorithms=3des
lifetime=1d
lifebytes=0
pfs-group=none
log:
10:21:51 ipsec,ike,info queuing SA request, phase 1 with peer 217.x.y.z will be established first
10:21:51 ipsec,ike,info initiating phase 1, starting mode Identity Protection (local 62.x.y.z:500) (remote unknown)
10:21:51 ipsec,info ipsec packet discarded: src=10.36.1.200 dst=172.16.54.147
10:21:51 ipsec,ike,info received ISAKMP packet from 217.x.y.z:500, phase 1, Identity Protection
10:21:52 ipsec,ike,info received ISAKMP packet from 217.x.y.z:500, phase 1, Identity Protection
10:21:52 ipsec,ike,info received ISAKMP packet from 217.x.y.z:500, phase 1, Identity Protection
10:21:52 ipsec,ike,info packet has invalid ID payload (remote unknown)
10:21:52 ipsec,info ipsec packet discarded: src=10.36.1.200 dst=172.16.54.147
10:21:53 ipsec,info ipsec packet discarded: src=10.36.1.200 dst=172.16.54.147
10:21:54 ipsec,info ipsec packet discarded: src=10.36.1.200 dst=172.16.54.147
10:21:55 ipsec,info ipsec packet discarded: src=10.36.1.200 dst=172.16.54.147
10:22:02 ipsec,ike,info received ISAKMP packet from 217.x.y.z:500, phase 1, Identity Protection
10:22:09 system,info,account user admin logged out from 10.36.0.27 via telnet
10:22:12 ipsec,ike,info received ISAKMP packet from 217.x.y.z:500, phase 1, Identity Protection
10:22:22 ipsec,ike,info received ISAKMP packet from 217.x.y.z:500, phase 1, Identity Protection
10:22:22 ipsec,ike,info dequeuing SA request to 217.x.y.z, phase 1 wait timed out
10:22:32 ipsec,ike,info received ISAKMP packet from 217.x.y.z:500, phase 2, Informational
10:22:33 ipsec,ike,info phase 1 deleted (local 62.x.y.z:500) (remote 217.x.y.z:500)
Привет, Рекс
Конфигурация:
policy:
0
src-address=10.36.0.0/16:any
dst-address=172.16.54.147/32:any
protocol=all
action=encrypt
level=require
ipsec-protocols=esp
tunnel=yes
sa-src-address=62.x.y.z
sa-dst-address=217.x.y.z
proposal=BT
manual-sa=none
dont-fragment=clear
peer:
0
address=217.x.y.z/32:500
secret=“*****”
generate-policy=no
exchange-mode=main
send-initial-contact=no
proposal-check=claim
hash-algorithm=sha1
enc-algorithm=3des
dh-group=modp1024
lifetime=1d
lifebytes=0
proposal:
1
name=“BT”
auth-algorithms=sha1
enc-algorithms=3des
lifetime=1d
lifebytes=0
pfs-group=none
log:
10:21:51 ipsec,ike,info queuing SA request, phase 1 with peer 217.x.y.z will be established first
10:21:51 ipsec,ike,info initiating phase 1, starting mode Identity Protection (local 62.x.y.z:500) (remote unknown)
10:21:51 ipsec,info ipsec packet discarded: src=10.36.1.200 dst=172.16.54.147
10:21:51 ipsec,ike,info received ISAKMP packet from 217.x.y.z:500, phase 1, Identity Protection
10:21:52 ipsec,ike,info received ISAKMP packet from 217.x.y.z:500, phase 1, Identity Protection
10:21:52 ipsec,ike,info received ISAKMP packet from 217.x.y.z:500, phase 1, Identity Protection
10:21:52 ipsec,ike,info packet has invalid ID payload (remote unknown)
10:21:52 ipsec,info ipsec packet discarded: src=10.36.1.200 dst=172.16.54.147
10:21:53 ipsec,info ipsec packet discarded: src=10.36.1.200 dst=172.16.54.147
10:21:54 ipsec,info ipsec packet discarded: src=10.36.1.200 dst=172.16.54.147
10:21:55 ipsec,info ipsec packet discarded: src=10.36.1.200 dst=172.16.54.147
10:22:02 ipsec,ike,info received ISAKMP packet from 217.x.y.z:500, phase 1, Identity Protection
10:22:09 system,info,account user admin logged out from 10.36.0.27 via telnet
10:22:12 ipsec,ike,info received ISAKMP packet from 217.x.y.z:500, phase 1, Identity Protection
10:22:22 ipsec,ike,info received ISAKMP packet from 217.x.y.z:500, phase 1, Identity Protection
10:22:22 ipsec,ike,info dequeuing SA request to 217.x.y.z, phase 1 wait timed out
10:22:32 ipsec,ike,info received ISAKMP packet from 217.x.y.z:500, phase 2, Informational
10:22:33 ipsec,ike,info phase 1 deleted (local 62.x.y.z:500) (remote 217.x.y.z:500)
Привет, Рекс
