Sécurité : Dispositifs de sécurité adaptatifs dédiés de la gamme Cisco ASA 5500

ASA IPsec et IKE met au point (mode IKEv1 principal) dépannage de TechNote

15 décembre 2015 - Traduction automatique
Autres versions: PDFpdf | Anglais (22 août 2015) | Commentaires

Introduction

Ce document décrit met au point sur l'appliance de sécurité adaptable (ASA) quand le mode principal et la clé pré-partagée (PSK) sont utilisés. La traduction de certaines lignes de débogage dans la configuration est également abordée.

Les thèmes non discutés dans ce document incluent passer le trafic après que le tunnel ait été établi et des concepts de base d'IPsec ou d'Échange de clés Internet (IKE).

Contribué par Atri Basu, Marcin Latosiewicz, et geai jeune Taylor, ingénieurs TAC Cisco.

Conditions préalables

Conditions requises

Les lecteurs de ce document devraient avoir la connaissance de ces thèmes.

  • PSK

  • IKE

Composants utilisés

Les informations contenues dans ce document sont basées sur les versions de matériel et de logiciel suivantes :

  • Cisco ASA 8.3.2

  • Routeur exécutant le Ý 12.4T IOS

Conventions

Pour plus d'informations sur les conventions utilisées dans ce document, reportez-vous aux Conventions relatives aux conseils techniques Cisco.

Principale question

L'IKE et l'IPsec met au point sont parfois cryptiques, mais vous pouvez les employer pour comprendre où un problème d'établissement de tunnel VPN d'IPsec se trouve.

Scénario

Le mode principal est typiquement utilisé entre les tunnels entre réseaux locaux ou, dans le cas de l'Accès à distance (EzVPN), quand des Certificats sont utilisés pour l'authentification.

Met au point sont de deux ASA qui exécutent la version de logiciel 8.3.2. Les deux périphériques formeront un tunnel entre réseaux locaux.

Deux scénarios principaux sont décrits :

  • ASA comme demandeur pour l'IKE
  • ASA en tant que responder pour l'IKE

commandes de débogage utilisées

Ce sont les commandes de débogage utilisées dans ce document :

  • debug crypto isakmp 127
  • debug crypto ipsec 127

Configuration ASA

Configuration d'IPsec

crypto ipsec transform-set TRANSFORM esp-aes esp-sha-hmac
crypto map MAP 10 match address VPN
crypto map MAP 10 set peer 10.0.0.2
crypto map MAP 10 set transform-set TRANSFORM
crypto map MAP 10 set reverse-route
crypto map MAP interface outside
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
tunnel-group 10.0.0.2 type ipsec-l2l
tunnel-group 10.0.0.2 ipsec-attributes
pre-shared-key cisco
access-list VPN extended permit tcp 192.168.1.0
255.255.255.0 192.168.2.0 255.255.255.0
access-list VPN extended permit icmp 192.168.1.0
255.255.255.0 192.168.2.0 255.255.255.0

Configuration IP :

 

ciscoasa# show ip

System IP Addresses:

Interface               Name     IP address     Subnet mask     Method

GigabitEthernet0/0       inside     192.168.1.1     255.255.255.0   manual
GigabitEthernet0/1       outside   10.0.0.1          255.255.255.0   manual

Current IP Addresses:

Interface               Name      IP address     Subnet mask     Method

GigabitEthernet0/0       inside    192.168.1.1     255.255.255.0   manual
GigabitEthernet0/1       outside   10.0.0.1         255.255.255.0   manual

Configuration NAT

object network INSIDE-RANGE
 subnet 192.168.1.0 255.255.255.0object network FOREIGN_NETWORK
 subnet 192.168.2.0 255.255.255
nat (inside,outside) source static INSIDE-RANGE INSIDE-RANGE
destination static FOREIGN_NETWORK FOREIGN_NETWORK

Débogage

Description de message de demandeur
Debugs
Description de message de responder
L'échange principal de mode commence ; aucune stratégie n'a été partagée, et les pairs sont toujours dans MM_NO_STATE. Comme demandeur, les débuts ASA pour construire la charge utile.
[IKEv1 DEBUG]: Pitcher: received a key acquire 
message, spi 0x0 IPSEC(crypto_map_check)-3: Looking
for crypto map matching 5-tuple: Prot=1,
saddr=192.168.1.2, sport=2816, daddr=192.168.2.1
dport=2816 IPSEC(crypto_map_check)-3:
Checking crypto map MAP 10: matched.
[IKEv1]: IP = 10.0.0.2, IKE Initiator: New Phase 1,
Intf inside, IKE Peer 10.0.0.2 local Proxy Address
192.168.1.0, remote Proxy Address 192.168.2.0,
Crypto map (MAP)
 
Élaboration MM1. Ce processus inclut la proposition initiale pour l'IKE et les constructeurs pris en charge NAT-T.
[IKEv1 DEBUG]: IP = 10.0.0.2, 
constructing ISAKMP SA payload
[IKEv1 DEBUG]: IP = 10.0.0.2,
constructing NAT-Traversal VID ver 02 payload
[IKEv1 DEBUG]: IP = 10.0.0.2,
constructing NAT-Traversal VID ver 03 payload
[IKEv1 DEBUG]: IP = 10.0.0.2,
constructing NAT-Traversal VID ver RFC payload
[IKEv1 DEBUG]: IP = 10.0.0.2,
constructing Fragmentation VID
+ extended capabilities payload
Envoyez MM1.
[IKEv1]: IP = 10.0.0.2, IKE_DECODE SENDING 
Message (msgid=0) with payloads : HDR
+ SA (1) + VENDOR (13) + VENDOR (13)
+ VENDOR (13) + VENDOR (13)
+ NONE (0) total length : 168
 
=====================MM1========================>
 
 
[IKEv1]: IP = 10.0.0.2, IKE_DECODE RECEIVED 
Message (msgid=0) with payloads : HDR
+ SA (1) + VENDOR (13) + VENDOR (13)
+ VENDOR (13) + VENDOR (13)
+ NONE (0) total length : 164
MM1 reçu du demandeur.
[IKEv1 DEBUG]: IP = 10.0.0.2, 
processing SA payload
[IKEv1 DEBUG]: IP = 10.0.0.2,
Oakley proposal is acceptable
[IKEv1 DEBUG]: IP = 10.0.0.2,
processing VID payload
[IKEv1 DEBUG]: IP = 10.0.0.2,
Received NAT-Traversal RFC VID
[IKEv1 DEBUG]: IP = 10.0.0.2,
processing VID payload
[IKEv1 DEBUG]: IP = 10.0.0.2,
processing VID payload
[IKEv1 DEBUG]: IP = 10.0.0.2,
Received NAT-Traversal ver 03 VID
[IKEv1 DEBUG]: IP = 10.0.0.2,
processing VID payload
[IKEv1 DEBUG]: IP = 10.0.0.2,
Received NAT-Traversal ver 02 VID
[IKEv1 DEBUG]: IP = 10.0.0.2,
processing IKE SA payload
[IKEv1 DEBUG]: IP = 10.0.0.2,
IKE SA Proposal # 1, Transform # 1
acceptable Matches global IKE entry # 2
Processus MM1. La comparaison des stratégies ISAKMP/IKE commence. Le pair distant annonce qu'il peut utiliser NAT-T. Configuration relative : crypto isakmp policy 10 vie 86400 du groupe 2 de SHA d'informations parasites du cryptage 3des d'authentication pre-share.
[IKEv1 DEBUG]: IP = 10.0.0.2, 
constructing ISAKMP SA payload
[IKEv1 DEBUG]: IP = 10.0.0.2,
constructing NAT-Traversal VID ver 02 payload
[IKEv1 DEBUG]: IP = 10.0.0.2,
constructing Fragmentation VID
+ extended capabilities payload
Élaboration MM2. Dans ce message le responder sélectionne qui des paramètres de la stratégie d'ISAKMP aux utiliser. Il annonce également les versions NAT-T qu'il peut l'utiliser.
[IKEv1]: IP = 10.0.0.2, IKE_DECODE SENDING 
Message (msgid=0) with payloads : HDR + SA (1)
+ VENDOR (13) + VENDOR (13)
+ NONE(0) total length : 128
Envoyez MM2.
 
<===================MM2=========================
 
MM2 reçu du responder.
[IKEv1]: IP = 10.0.0.2, IKE_DECODE RECEIVED 
Message (msgid=0) with payloads : HDR + SA (1)
+ VENDOR (13) + NONE (0) total length : 104
 
Processus MM2.
[IKEv1 DEBUG]: IP = 10.0.0.2, 
processing SA payload
[IKEv1 DEBUG]: IP = 10.0.0.2,
Oakley proposal is acceptable
[IKEv1 DEBUG]: IP = 10.0.0.2,
processing VID payload
[IKEv1 DEBUG]: IP = 10.0.0.2,
Received NAT-Traversal RFC VID
 
Élaboration MM3. Ce processus inclut les charges utiles NAT de détection, les charges utiles du Key Exchange de Protocole DH (Diffie-Hellman) (KE) (l'initator inclut g, p, et A au responder), et le support DPD.
Nov 30 10:38:29 [IKEv1 DEBUG]: IP = 10.0.0.2, 
constructing ke payload
Nov 30 10:38:29 [IKEv1 DEBUG]: IP = 10.0.0.2,
constructing nonce payload
Nov 30 10:38:29 [IKEv1 DEBUG]: IP = 10.0.0.2,
constructing Cisco Unity VID payload
Nov 30 10:38:29 [IKEv1 DEBUG]: IP = 10.0.0.2,
constructing xauth V6 VID payload
Nov 30 10:38:29 [IKEv1 DEBUG]: IP = 10.0.0.2,
Send IOS VID
Nov 30 10:38:29 [IKEv1 DEBUG]: IP = 10.0.0.2,
Constructing ASA spoofing IOS Vendor ID payload
(version: 1.0.0, capabilities: 20000001)
Nov 30 10:38:29 [IKEv1 DEBUG]: IP = 10.0.0.2,
constructing VID payload
Nov 30 10:38:29 [IKEv1 DEBUG]: IP = 10.0.0.2,
Send Altiga/Cisco VPN3000/Cisco ASA GW VID
Nov 30 10:38:29 [IKEv1 DEBUG]: IP = 10.0.0.2,
constructing NAT-Discovery payload
Nov 30 10:38:29 [IKEv1 DEBUG]: IP = 10.0.0.2,
computing NAT Discovery hash
Nov 30 10:38:29 [IKEv1 DEBUG]: IP = 10.0.0.2,
constructing NAT-Discovery payload
Nov 30 10:38:29 [IKEv1 DEBUG]: IP = 10.0.0.2,
computing NAT Discovery hash
 
Envoyez MM3.
[IKEv1]: IP = 10.0.0.2, IKE_DECODE SENDING 
Message (msgid=0) with payloads : HDR + KE (4)
+ NONCE (10) + VENDOR (13) + VENDOR (13)
+ VENDOR (13) + VENDOR (13) + NAT-D (20)
+ NAT-D (20) + NONE (0) total length : 304
 
 
=========================MM3===================>
 
 
[IKEv1]: IP = 10.0.0.2, IKE_DECODE RECEIVED 
Message (msgid=0) with payloads : HDR + KE (4)
+ NONCE (10) + VENDOR (13) + VENDOR (13)
+ VENDOR (13) + NAT-D (130) + NAT-D (130)
+ NONE (0) total length : 284
MM3 reçu du demandeur.
 
[IKEv1 DEBUG]: IP = 10.0.0.2, 
processing ke payload
[IKEv1 DEBUG]: IP = 10.0.0.2,
processing ISA_KE payload
[IKEv1 DEBUG]: IP = 10.0.0.2,
processing nonce payload
[IKEv1 DEBUG]: IP = 10.0.0.2,
processing VID payload
[IKEv1 DEBUG]: IP = 10.0.0.2,
Received DPD VID
[IKEv1 DEBUG]: IP = 10.0.0.2,
processing VID payload
[IKEv1 DEBUG]: IP = 10.0.0.2,
Processing IOS/PIX Vendor ID payload
(version: 1.0.0, capabilities: 00000f6f)
[IKEv1 DEBUG]: IP = 10.0.0.2,
processing VID payload
[IKEv1 DEBUG]: IP = 10.0.0.2,
Received xauth V6 VID
[IKEv1 DEBUG]: IP = 10.0.0.2,
processing NAT-Discovery payload
[IKEv1 DEBUG]: IP = 10.0.0.2,
computing NAT Discovery hash
[IKEv1 DEBUG]: IP = 10.0.0.2,
processing NAT-Discovery payload
Processus MM3. Des charges utiles NAT-D le responder peut déterminer si l'initator est derrière NAT et si le responder est derrière NAT. Du CAD KE, le responder de charge utile obtient des valeurs de p, de g et de R.
 
 [IKEv1 DEBUG]: IP = 10.0.0.2, 
computing NAT Discovery hash
[IKEv1 DEBUG]: IP = 10.0.0.2,
constructing ke payload
[IKEv1 DEBUG]: IP = 10.0.0.2,
constructing nonce payload
[IKEv1 DEBUG]: IP = 10.0.0.2,
constructing Cisco Unity VID payload
[IKEv1 DEBUG]: IP = 10.0.0.2,
constructing xauth V6 VID payload
[IKEv1 DEBUG]: IP = 10.0.0.2,
Send IOS VID
[IKEv1 DEBUG]: IP = 10.0.0.2,
Constructing ASA spoofing IOS Vendor ID payload
(version: 1.0.0, capabilities: 20000001)
[IKEv1 DEBUG]: IP = 10.0.0.2,
constructing VID payload
[IKEv1 DEBUG]: IP = 10.0.0.2,
Send Altiga/Cisco VPN3000/Cisco ASA GW VID
[IKEv1 DEBUG]: IP = 10.0.0.2,
constructing NAT-Discovery payload
[IKEv1 DEBUG]: IP = 10.0.0.2,
computing NAT Discovery hash
[IKEv1 DEBUG]: IP = 10.0.0.2,
constructing NAT-Discovery payload
[IKEv1 DEBUG]: IP = 10.0.0.2,
computing NAT Discovery hash
Élaboration MM4. Ce processus inclut la charge utile NAT de détection, le responder CAD KE génère « B » et « s » (renvoie « B » à l'initator), et DPD VID.
 
[IKEv1]: IP = 10.0.0.2, 
Connection landed on tunnel_group 10.0.0.2
[IKEv1 DEBUG]: Group = 10.0.0.2,
IP = 10.0.0.2, Generating keys for ResponderÝ
Le pair est associé avec le groupe de tunnel de 10.0.0.2 L2L, et le cryptage et les clés d'informations parasites sont générés du « s » ci-dessus et du pre-shared-key.
 
 [IKEv1]: IP = 10.0.0.2, IKE_DECODE SENDING 
Message (msgid=0) with payloads : HDR + KE (4)
+ NONCE (10) + VENDOR (13) + VENDOR (13)
+ VENDOR (13) + VENDOR (13) + NAT-D (130)
+ NAT-D (130) + NONE (0) total length : 304
Envoyez MM4.
 
<======================MM4======================
 
MM4 reçu du responder.
IKEv1]: IP = 10.0.0.2, IKE_DECODE RECEIVED 
Message (msgid=0) with payloads : HDR + KE (4)
+ NONCE (10) + VENDOR (13) + VENDOR (13)
+ VENDOR (13) + VENDOR (13) + NAT-D (20)
+ NAT-D (20) + NONE (0) total length : 304
 
Processus MM4. Des charges utiles NAT-D, l'initator peut maintenant déterminer si l'iniator est derrière NAT et si le responder est derrière NAT. Du CAD KE, le demandeur reçoit « B » et peut maintenant générer le « S. »
[IKEv1 DEBUG]: IP = 10.0.0.2, 
processing ike payload
[IKEv1 DEBUG]: IP = 10.0.0.2,
processing ISA_KE payload
[IKEv1 DEBUG]: IP = 10.0.0.2,
processing nonce payload
[IKEv1 DEBUG]: IP = 10.0.0.2,
processing VID payload
[IKEv1 DEBUG]: IP = 10.0.0.2,
Received Cisco Unity client VID
[IKEv1 DEBUG]: IP = 10.0.0.2,
processing VID payload
[IKEv1 DEBUG]: IP = 10.0.0.2,
Received DPD VID
[IKEv1 DEBUG]: IP = 10.0.0.2,
processing VID payload
[IKEv1 DEBUG]: IP = 10.0.0.2,
Processing IOS/PIX Vendor ID payload
(version: 1.0.0, capabilities: 00000f7f)
[IKEv1 DEBUG]: IP = 10.0.0.2,
processing VID payload
[IKEv1 DEBUG]: IP = 10.0.0.2,
Received xauth V6 VID
[IKEv1 DEBUG]: IP = 10.0.0.2,
processing NAT-Discovery payload
[IKEv1 DEBUG]: IP = 10.0.0.2,
computing NAT Discovery hash
[IKEv1 DEBUG]: IP = 10.0.0.2,
processing NAT-Discovery payload
[IKEv1 DEBUG]: IP = 10.0.0.2,
computing NAT Discovery hash
Le pair est associé avec le groupe de tunnel de 10.0.0.2 L2L, et l'initator génère des clés de cryptage et d'informations parasites utilisant « s » en haut et le pre-shared-key.
[IKEv1]: IP = 10.0.0.2, 
Connection landed on tunnel_group 10.0.0.2
[IKEv1 DEBUG]: Group = 10.0.0.2,
IP = 10.0.0.2, Generating keys for Initiator...
Élaboration MM5. Configuration relative : automatique de crypto isakmp identity
[IKEv1 DEBUG]: Group = 10.0.0.2, 
IP = 10.0.0.2, constructing ID payload
[IKEv1 DEBUG]: Group = 10.0.0.2,
IP = 10.0.0.2, constructing hash payload
[IKEv1 DEBUG]: Group = 10.0.0.2,
IP = 10.0.0.2, Computing hash for ISAKMP
[IKEv1 DEBUG]: IP = 10.0.0.2,
Constructing IOS keep alive payload:
proposal=32767/32767 sec.
[IKEv1 DEBUG]: Group = 10.0.0.2,
IP = 10.0.0.2, constructing dpd vid payload
Envoyez MM5.
[IKEv1]: IP = 10.0.0.2, 
IKE_DECODE SENDING Message (msgid=0)
with payloads : HDR + ID (5) + HASH (8)
+ IOS KEEPALIVE (128) +VENDOR (13)
+ NONE (0) total length : 96
 
======================MM5======================>
 
Le responder n'est pas derrière NAT. Aucun NAT-T requis.
[IKEv1]: 
Group = 10.0.0.2,
IP = 10.0.0.2,
Automatic NAT Detection
Status: Remote end
is NOT behind a NAT
device This end is NOT
behind a NAT device
[IKEv1]: 
IP = 10.0.0.2,
IKE_DECODE RECEIVED
Message (msgid=0)
with payloads : HDR
+ ID (5) + HASH (8)
+ NONE (0) total
length : 64
MM5 reçu du demandeur. Ce processus inclut l'identité distante de pair (ID) et le renvoi de connexion sur un groupe particulier de tunnel.
 
[IKEv1 DEBUG]: Group = 10.0.0.2, 
IP = 10.0.0.2, processing ID payload
[IKEv1 DECODE]: Group = 10.0.0.2,
IP = 10.0.0.2, ID_IPV4_ADDR ID received 10.0.0.2
[IKEv1 DEBUG]: Group = 10.0.0.2,
IP = 10.0.0.2, processing hash payload
[IKEv1 DEBUG]: Group = 10.0.0.2,
IP = 10.0.0.2, Computing hash for ISAKMP
[IKEv1 DEBUG]: Group = 10.0.0.2,
IP = 10.0.0.2, processing notify payload
[IKEv1]: Group = 10.0.0.2,
IP = 10.0.0.2,Automatic NAT
[IKEv1]: IP = 10.0.0.2,
Connection landed on tunnel_group 10.0.0.2
Processus MM5. L'authentification avec des clés pré-partagées commence maintenant. L'authentification se produit sur les deux pairs ; donc, vous verrez deux ensembles de procédures d'authentification correspondantes. Configuration relative : type ipsec-l2l de 10.0.0.2 de groupe de tunnel
 
Detection Status: Remote end is NOT 
behind a NAT device This end is NOT behind
a NAT device
Aucun NAT-T requis dans ce cas.
 
[IKEv1 DEBUG]: Group = 10.0.0.2, 
IP = 10.0.0.2, constructing ID payload
[IKEv1 DEBUG]: Group = 10.0.0.2,
IP = 10.0.0.2, constructing hash payload
[IKEv1 DEBUG]: Group = 10.0.0.2,
IP = 10.0.0.2, Computing hash for ISAKMP
[IKEv1 DEBUG]: IP = 10.0.0.2,
Constructing IOS keep alive payload:
proposal=32767/32767 sec.
[IKEv1 DEBUG]: Group = 10.0.0.2,
IP = 10.0.0.2, constructing dpd vid payload
Élaboration MM6. Envoyez l'identité inclut des temps de rekey commencés et l'identité envoyée au pair distant.
 
[IKEv1]: IP = 10.0.0.2, IKE_DECODE SENDING 
Message (msgid=0) with payloads : HDR + ID (5)
+ HASH (8) + IOS KEEPALIVE (128) +VENDOR (13)
+ NONE (0) total length : 96
Envoyez MM6.
 
<======================MM6======================
 
MM6 reçu du responder.
[IKEv1]: 
IP = 10.0.0.2,
IKE_DECODE RECEIVED
Message (msgid=0)
with payloads : HDR
+ ID (5) + HASH (8)
+ NONE (0) total
length : 64
[IKEv1]: 
Group = 10.0.0.2,
IP = 10.0.0.2,
PHASE 1 COMPLETED
[IKEv1]: IP = 10.0.0.2,
Keep-alive
type for this
connection: DPD
[IKEv1 DEBUG]:
Group = 10.0.0.2,
IP = 10.0.0.2,
Starting P1
rekey timer:
64800 seconds.
Phase 1 complet. Temporisateur de rekey d'ISAKMP de début. Configuration relative : le crypto isakmp policy 10 ciscoasa# de la vie 86400 du groupe 2 de SHA d'informations parasites du cryptage 3des d'authentication pre-share SH exécutent tout l'automatique de crypto isakmp identity de crypto isakmp
Processus MM6. Ce processus inclut l'identité distante envoyée du pair et de la décision finale concernant le groupe de tunnel de sélectionner
 [IKEv1 DEBUG]: Group = 10.0.0.2, 
IP = 10.0.0.2, processing ID payload
[IKEv1 DECODE]: Group = 10.0.0.2,
IP = 10.0.0.2, ID_IPV4_ADDR ID received
10.0.0.2
[IKEv1 DEBUG]: Group = 10.0.0.2,
IP = 10.0.0.2, processing hash payload
[IKEv1 DEBUG]: Group = 10.0.0.2,
IP = 10.0.0.2, Computing hash for ISAKMP
[IKEv1]: IP = 10.0.0.2,
Connection landed on tunnel_group 10.0.0.2
[IKEv1 DEBUG]: Group = 10.0.0.2,
IP = 10.0.0.2, Oakley begin quick mode
[IKEv1 DECODE]: Group = 10.0.0.2,
IP = 10.0.0.2, IKE Initiator starting
QM: msg id = 7b80c2b0
 
Phase 1 complet. Temporisateur de rekey d'ISAKMP de début. Configuration relative : pre-shared-key Cisco d'ipsec-attributs de 10.0.0.2 de groupe de tunnel du type ipsec-l2l de 10.0.0.2 de groupe de tunnel
[IKEv1]: Group = 10.0.0.2,
IP = 10.0.0.2, PHASE 1 COMPLETED
[IKEv1]: IP = 10.0.0.2,
Keep-alive type for this connection:
DPD DPD has bee negotiated and
Phase 1 is now complete.
[IKEv1 DEBUG]: Group = 10.0.0.2,
IP = 10.0.0.2, Starting P1
rekey timer: 82080 seconds.
 
Le Phase 2 (mode rapide) commence.
IPSEC: New embryonic SA 
created @ 0x53FC3C00,
SCB: 0x53F90A00,
Direction: inbound
SPI : 0xFD2D851F
Session ID: 0x00006000
VPIF num : 0x00000003
Tunnel type: l2l
Protocol : esp
Lifetime : 240 seconds
 
Élaboration QM1. Ce processus inclut des stratégies d'id et d'IPsec de proxy. Configuration relative : le crypto ipsec transform-set TRANSFORMENT l'ICMP 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0 d'autorisation étendu par VPN de liste d'accès d'ESP-SHA-hmac du l'ESP-aes
[IKEv1 DEBUG]: Group = 10.0.0.2, 
IP = 10.0.0.2, IKE got SPI from key engine:
SPI = 0xfd2d851f
[IKEv1 DEBUG]: Group = 10.0.0.2,
IP = 10.0.0.2, oakley constucting quick mode
[IKEv1 DEBUG]: Group = 10.0.0.2,
IP = 10.0.0.2, constructing blank hash payload
[IKEv1 DEBUG]: Group = 10.0.0.2,
IP = 10.0.0.2, constructing IPSec SA payload
[IKEv1 DEBUG]: Group = 10.0.0.2,
IP = 10.0.0.2, constructing IPSec nonce payload
[IKEv1 DEBUG]: Group = 10.0.0.2,
IP = 10.0.0.2, constructing proxy ID
[IKEv1 DEBUG]: Group = 10.0.0.2,
IP = 10.0.0.2, Transmitting Proxy Id:
Local subnet: 192.168.1.0 mask 255.255.255.0
Protocol 1 Port 0
Remote subnet: 192.168.2.0 Mask 255.255.255.0
Protocol 1 Port 0
The local subnet (192.168.1.0/24) and expcted remote
subnet (192.168.2.0/24) are being sent
[IKEv1 DECODE]: Group = 10.0.0.2,
IP = 10.0.0.2, IKE Initiator sending Initial Contact
[IKEv1 DEBUG]: Group = 10.0.0.2,
IP = 10.0.0.2, constructing qm hash payload
[IKEv1 DECODE]: Group = 10.0.0.2,
IP = 10.0.0.2, IKE Initiator sending 1st QM pkt:
msg id = 7b80c2b0
 
Envoyez QM1.
 [IKEv1]: IP = 10.0.0.2, IKE_DECODE SENDING   
Message (msgid=7b80c2b0) with payloads : HDR
+ HASH (8) + SA (1) + NONCE (10) + ID (5)
+ ID (5) + NOTIFY (11) + NONE (0) total length : 200
 
 
==========================QM1===================>
 
 
[IKEv1 DECODE]: IP = 10.0.0.2, 
IKE Responder starting QM: msg id = 52481cf5
[IKEv1]: IP = 10.0.0.2, IKE_DECODE RECEIVED
Message (msgid=52481cf5) with payloads :
HDR + HASH (8) + SA (1) + NONCE (10)
+ ID (5) + ID (5) + NONE (0) total length : 172
QM1 reçu du demandeur. Le responder commence la phase 2 (QM).
 
[IKEv1 DEBUG]: Group = 10.0.0.2, 
IP = 10.0.0.2,
processing hash payload
[IKEv1 DEBUG]: Group = 10.0.0.2, IP = 10.0.0.2,
processing SA payload
[IKEv1 DEBUG]: Group = 10.0.0.2, IP = 10.0.0.2,
processing nonce payload
[IKEv1 DEBUG]: Group = 10.0.0.2, IP = 10.0.0.2,
processing ID payload
Processus QM1. Ce processus compare des proxys distants aux gens du pays et sélectionne la stratégie acceptable d'IPsec. Configuration relative : le crypto ipsec transform-set TRANSFORMENT l'adresse VPN de correspondance de la MAP 10 de crypto map de 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0 d'ICMP d'autorisation étendue par VPN de liste d'accès d'ESP-SHA-hmac du l'ESP-aes
 
[IKEv1 DECODE]: Group = 10.0.0.2, IP = 10.0.0.2, 
ID_IPV4_ADDR_SUBNET ID
received--192.168.2.0--255.255.255.0
[IKEv1]: Group = 10.0.0.2, IP = 10.0.0.2,
Received remote IP Proxy Subnet data in ID Payload:
Address 192.168.2.0, Mask 255.255.255.0,
Protocol 1, Port 0
[IKEv1 DEBUG]: Group = 10.0.0.2, IP = 10.0.0.2,
processing ID payload
[IKEv1 DECODE]: Group = 10.0.0.2, IP = 10.0.0.2,
ID_IPV4_ADDR_SUBNET ID
received--192.168.1.0--255.255.255.0
[IKEv1]: Group = 10.0.0.2, IP = 10.0.0.2,
Received local IP Proxy Subnet data in ID Payload:
Address 192.168.1.0, Mask 255.255.255.0,
Protocol 1, Port 0
Les sous-réseaux distants et locaux (192.168.2.0/24 et 192.168.1.0/24) sont reçus.
 
[IKEv1]: Group = 10.0.0.2, IP = 10.0.0.2,   
QM IsRekeyed old sa not found by addr
[IKEv1]: Group = 10.0.0.2, IP = 10.0.0.2,
Static Crypto Map check, checking map = MAP,
seq = 10...
[IKEv1]: Group = 10.0.0.2, IP = 10.0.0.2,
Static Crypto Map check, map MAP,
seq = 10 is a successful match
[IKEv1]: Group = 10.0.0.2, IP = 10.0.0.2,
IKE Remote Peer configured for crypto map: MAP
[IKEv1 DEBUG]: Group = 10.0.0.2, IP = 10.0.0.2,
processing IPSec SA payload
[IKEv1 DEBUG]: Group = 10.0.0.2, IP = 10.0.0.2,
IPSec SA Proposal # 1, Transform # 1 acceptable
Matches global IPSec SA entry # 10
Une crypto entrée statique assortie est recherchée et trouvée.
 
[IKEv1]: Group = 10.0.0.2, IP = 10.0.0.2,  
IKE: requesting SPI!
IPSEC: New embryonic SA created @ 0x53FC3698,
SCB: 0x53FC2998,
Direction: inbound
SPI : 0x1698CAC7
Session ID: 0x00004000
VPIF num : 0x00000003
Tunnel type: l2l
Protocol : esp
Lifetime : 240 seconds
[IKEv1 DEBUG]: Group = 10.0.0.2, IP = 10.0.0.2,
IKE got SPI from key engine: SPI = 0x1698cac7
[IKEv1 DEBUG]: Group = 10.0.0.2, IP = 10.0.0.2,
oakley constructing quick mode
[IKEv1 DEBUG]: Group = 10.0.0.2, IP = 10.0.0.2,
constructing blank hash payload
[IKEv1 DEBUG]: Group = 10.0.0.2, IP = 10.0.0.2,
constructing IPSec SA payload
[IKEv1 DEBUG]: Group = 10.0.0.2, IP = 10.0.0.2,
constructing IPSec nonce payload
[IKEv1 DEBUG]: Group = 10.0.0.2, IP = 10.0.0.2,
constructing proxy ID
[IKEv1 DEBUG]: Group = 10.0.0.2, IP = 10.0.0.2,
Transmitting Proxy Id:
Remote subnet: 192.168.2.0 Mask 255.255.255.0
Protocol 1 Port 0
Local subnet: 192.168.1.0 mask 255.255.255.0
Protocol 1 Port 0
[IKEv1 DEBUG]: Group = 10.0.0.2, IP = 10.0.0.2,
constructing qm hash payload
[IKEv1 DECODE]: Group = 10.0.0.2, IP = 10.0.0.2,
IKE Responder sending 2nd QM pkt: msg id = 52481cf5
Élaboration QM2. Ce processus inclut la confirmation des identités de proxy, type de tunnel, et un contrôle est exécuté pour crypto ACLs reflété.
 
 [IKEv1]: IP = 10.0.0.2, IKE_DECODE SENDING 
Message (msgid=52481cf5) with payloads :
HDR + HASH (8) + SA (1) + NONCE (10) + ID (5)
+ ID (5) + NONE (0) total length : 172
Envoyez QM2.
 
<=======================QM2======================
 
QM2 reçu du responder.
IKEv1]: IP = 10.0.0.2, IKE_DECODE RECEIVED  
Message (msgid=7b80c2b0) with payloads :
HDR + HASH (8) + SA (1) + NONCE (10)
+ ID (5) + ID (5) + NOTIFY (11)
+ NONE (0) total length : 200
 
Processus QM2. Dans ce processus, l'extrémité distante envoie des paramètres et les vies de la phase proposées les plus courtes 2 est sélectionnées.
 [IKEv1 DEBUG]: Group = 10.0.0.2, 
IP = 10.0.0.2, processing hash payload
[IKEv1 DEBUG]: Group = 10.0.0.2,
IP = 10.0.0.2, processing SA payload
[IKEv1 DEBUG]: Group = 10.0.0.2,
IP = 10.0.0.2, processing nonce payload
[IKEv1 DEBUG]: Group = 10.0.0.2,
IP = 10.0.0.2, processing ID payload
[IKEv1 DECODE]: Group = 10.0.0.2,
IP = 10.0.0.2, ID_IPV4_ADDR_SUBNET ID
received--192.168.1.0--255.255.255.0
[IKEv1 DEBUG]: Group = 10.0.0.2,
IP = 10.0.0.2, processing ID payload
[IKEv1 DECODE]: Group = 10.0.0.2,
IP = 10.0.0.2, ID_IPV4_ADDR_SUBNET ID
received--192.168.2.0--255.255.255.0
[IKEv1 DEBUG]: Group = 10.0.0.2,
IP = 10.0.0.2, processing notify payload
[IKEv1 DECODE]: Responder Lifetime
decode follows (outb SPI[4]|attributes):
[IKEv1 DECODE]: 0000: DDE50931 80010001
00020004 00000E10 ...1............
[IKEv1]: Group = 10.0.0.2, IP = 10.0.0.2,
Responder forcing change of IPSec rekeying
duration from 28800 to 3600 seconds
based on response from peer, the ASA is
changing certain IPSEC attributes.
In this case the rekey interval
[IKEv1 DEBUG]: Group = 10.0.0.2,
IP = 10.0.0.2, loading all IPSEC SAs
[IKEv1 DEBUG]: Group = 10.0.0.2,
IP = 10.0.0.2, Generating Quick Mode Key!
Crypto map assorti trouvé « MAP » et entrée 10 et apparié lui contre la liste d'accès « VPN. »
[IKEv1 DEBUG]: Group = 10.0.0.2, IP = 10.0.0.2,    
NP encrypt rule look up for crypto map MAP 10
matching ACL VPN: returned cs_id=53f11198;
rule=53f11a90
L'appliance a généré le trafic en entrée et en sortie 0xfd2d851f et 0xdde50931for SPI respectivement.
 [IKEv1 DEBUG]: Group = 10.0.0.2, IP = 10.0.0.2, 
Generating Quick Mode Key!
IPSEC: New embryonic SA created @ 0x53FC3698,
SCB: 0x53F910F0,
Direction: outbound
SPI : 0xDDE50931
Session ID: 0x00006000
VPIF num : 0x00000003
Tunnel type: l2l
Protocol : esp
Lifetime : 240 seconds
IPSEC: Completed host OBSA update,
SPI 0xDDE50931
IPSEC: Creating outbound VPN context,
SPI 0xDDE50931
Flags: 0x00000005
SA : 0x53FC3698
SPI : 0xDDE50931
MTU : 1500 bytes
VCID : 0x00000000
Peer : 0x00000000
SCB : 0x01CF218F
Channel: 0x4C69CB80
IPSEC: Completed outbound VPN context,
SPI 0xDDE50931
VPN handle: 0x000161A4
IPSEC: New outbound encrypt rule,
SPI 0xDDE50931
Src addr: 192.168.1.0
Src mask: 255.255.255.0
Dst addr: 192.168.2.0
Dst mask: 255.255.255.0
Src ports
Upper: 0
Lower: 0
Op : ignore
Dst ports
Upper: 0
Lower: 0
Op : ignore
Protocol: 1
Use protocol: true
SPI: 0x00000000
Use SPI: false
IPSEC: Completed outbound encrypt rule,
SPI 0xDDE50931
Rule ID: 0x53FC3AD8
IPSEC: New outbound permit rule,
SPI 0xDDE50931
Src addr: 10.0.0.1
Src mask: 255.255.255.255
Dst addr: 10.0.0.2
Dst mask: 255.255.255.255
Src ports
Upper: 0
Lower: 0
Op : ignore
Dst ports
Upper: 0
Lower: 0
Op : ignore
Protocol: 50
Use protocol: true
SPI: 0xDDE50931
Use SPI: true
IPSEC: Completed outbound permit rule,
SPI 0xDDE50931
Rule ID: 0x53F91538
[IKEv1 DEBUG]: Group = 10.0.0.2,
IP = 10.0.0.2,
NP encrypt rule look up for crypto map MAP 10
matching ACL VPN: returned cs_id=53f11198;
rule=53f11a90
[IKEv1]: Group = 10.0.0.2, IP = 10.0.0.2,
Security negotiation complete for LAN-to-LAN
Group (10.0.0.2) Initiator,
Inbound SPI = 0xfd2d851f,
Outbound SPI = 0xdde50931
Élaboration QM3. Confirmez tous les SPI créés au pair distant.
Confirm all SPIs created to remote peer.
IPSEC: Completed host IBSA update,
SPI 0xFD2D851F
IPSEC: Creating inbound VPN context,
SPI 0xFD2D851F
Flags: 0x00000006
SA : 0x53FC3C00
SPI : 0xFD2D851F
MTU : 0 bytes
VCID : 0x00000000
Peer : 0x000161A4
SCB : 0x01CEA8EF
Channel: 0x4C69CB80
IPSEC: Completed inbound VPN context,
SPI 0xFD2D851F
VPN handle: 0x00018BBC
IPSEC: Updating outbound VPN context 0x000161A4,
SPI 0xDDE50931
Flags: 0x00000005
SA : 0x53FC3698
SPI : 0xDDE50931
MTU : 1500 bytes
VCID : 0x00000000
Peer : 0x00018BBC
SCB : 0x01CF218F
Channel: 0x4C69CB80
IPSEC: Completed outbound VPN context,
SPI 0xDDE50931
VPN handle: 0x000161A4
IPSEC: Completed outbound inner rule,
SPI 0xDDE50931
Rule ID: 0x53FC3AD8
IPSEC: Completed outbound outer SPD rule,
SPI 0xDDE50931
Rule ID: 0x53F91538
IPSEC: New inbound tunnel flow rule,
SPI 0xFD2D851F
Src addr: 192.168.2.0
Src mask: 255.255.255.0
Dst addr: 192.168.1.0
Dst mask: 255.255.255.0
Src ports
Upper: 0
Lower: 0
Op : ignore
Dst ports
Upper: 0
Lower: 0
Op : ignore
Protocol: 1
Use protocol: true
SPI: 0x00000000
Use SPI: false
IPSEC: Completed inbound tunnel flow rule,
SPI 0xFD2D851F
Rule ID: 0x53F91970
IPSEC: New inbound decrypt rule,
SPI 0xFD2D851F
Src addr: 10.0.0.2
Src mask: 255.255.255.255
Dst addr: 10.0.0.1
Dst mask: 255.255.255.255
Src ports
Upper: 0
Lower: 0
Op : ignore
Dst ports
Upper: 0
Lower: 0
Op : ignore
Protocol: 50
Use protocol: true
SPI: 0xFD2D851F
Use SPI: true
IPSEC: Completed inbound decrypt rule,
SPI 0xFD2D851F
Rule ID: 0x53F91A08
IPSEC: New inbound permit rule,
SPI 0xFD2D851F
Src addr: 10.0.0.2
Src mask: 255.255.255.255
Dst addr: 10.0.0.1
Dst mask: 255.255.255.255
Src ports
Upper: 0
Lower: 0
Op : ignore
Dst ports
Upper: 0
Lower: 0
Op : ignore
Protocol: 50
Use protocol: true
SPI: 0xFD2D851F
Use SPI: true
IPSEC: Completed inbound permit rule,
SPI 0xFD2D851F
Rule ID: 0x53F91AA0
Envoyez QM3.
[IKEv1 DECODE]: Group = 10.0.0.2, 
IP = 10.0.0.2, IKE Initiator sending 3rd
QM pkt: msg id = 7b80c2b0
 
========================QM3=====================>
 
Phase 2 complet. Le demandeur est maintenant prêt à chiffrer et déchiffrer des paquets utilisant ces valeurs SPI.
[IKEv1]: IP = 10.0.0.2, 
IKE_DECODE SENDING
Message (msgid=7b80c2b0
with payloads : HDR
+ HASH (8)
+ NONE (0)
total length :76
[IKEv1 DEBUG]: Group = 10.0.0.2,
IP = 10.0.0.2,
IKE got a KEY_ADD msg for SA:
SPI = 0xdde50931
[IKEv1 DEBUG]: Group = 10.0.0.2,
IP = 10.0.0.2,
Pitcher: received KEY_UPDATE,
spi 0xfd2d851f
[IKEv1 DEBUG]: Group = 10.0.0.2,
IP = 10.0.0.2,
Starting P2 rekey timer:
3060 seconds.
[IKEv1]: Group = 10.0.0.2,
IP = 10.0.0.2,
PHASE 2 COMPLETED
(msgid=7b80c2b0)
[IKEv1]: IP = 10.0.0.2,    
IKE_DECODE RECEIVED
Message (msgid=52481cf5)
with payloads : HDR
+ HASH (8)
+ NONE (0)
total length : 52
Demandeur de fom du receivd QM3.
 
[IKEv1 DEBUG]: Group = 10.0.0.2, 
IP = 10.0.0.2, processing hash payload
[IKEv1 DEBUG]: Group = 10.0.0.2,
IP = 10.0.0.2, loading all IPSEC SAs
[IKEv1 DEBUG]: Group = 10.0.0.2,
IP = 10.0.0.2, Generating Quick Mode Key!
[IKEv1 DEBUG]: Group = 10.0.0.2,
IP = 10.0.0.2, NP encrypt rule look up for
crypto map MAP 10 matching ACL VPN:
returned cs_id=53f11198; rule=53f11a90
[IKEv1 DEBUG]: Group = 10.0.0.2,
IP = 10.0.0.2, Generating Quick Mode Key!
IPSEC: New embryonic SA created @ 0x53F18B00,
SCB: 0x53F8A1C0,
Direction: outbound
SPI : 0xDB680406
Session ID: 0x00004000
VPIF num : 0x00000003
Tunnel type: l2l
Protocol : esp
Lifetime : 240 seconds
IPSEC: Completed host OBSA update,
SPI 0xDB680406
IPSEC: Creating outbound VPN context,
SPI 0xDB680406
Flags: 0x00000005
SA : 0x53F18B00
SPI : 0xDB680406
MTU : 1500 bytes
VCID : 0x00000000
Peer : 0x00000000
SCB : 0x005E4849
Channel: 0x4C69CB80
IPSEC: Completed outbound VPN context,
SPI 0xDB680406
VPN handle: 0x0000E9B4
IPSEC: New outbound encrypt rule,
SPI 0xDB680406
Src addr: 192.168.1.0
Src mask: 255.255.255.0
Dst addr: 192.168.2.0
Dst mask: 255.255.255.0
Src ports
Upper: 0
Lower: 0
Op : ignore
Dst ports
Upper: 0
Lower: 0
Op : ignore
Protocol: 1
Use protocol: true
SPI: 0x00000000
Use SPI: false
IPSEC: Completed outbound encrypt rule,
SPI 0xDB680406
Rule ID: 0x53F89160
IPSEC: New outbound permit rule,
SPI 0xDB680406
Src addr: 10.0.0.1
Src mask: 255.255.255.255
Dst addr: 10.0.0.2
Dst mask: 255.255.255.255
Src ports
Upper: 0
Lower: 0
Op : ignore
Dst ports
Upper: 0
Lower: 0
Op : ignore
Protocol: 50
Use protocol: true
SPI: 0xDB680406
Use SPI: true
IPSEC: Completed outbound permit rule,
SPI 0xDB680406
Rule ID: 0x53E47E88
[IKEv1 DEBUG]: Group = 10.0.0.2,
IP = 10.0.0.2, NP encrypt rule look up
for crypto map MAP 10 matching ACL VPN:
returned cs_id=53f11198; rule=53f11a90
Processus QM3. Des clés de chiffrement sont générées pour les données SAS. Pendant ce processus, des SPI sont placés afin de passer le trafic.
[IKEv1]: Group = 10.0.0.2, IP = 10.0.0.2,   
Security negotiation complete for
LAN-to-LAN Group (10.0.0.2) Responder,
Inbound SPI = 0x1698cac7,
Outbound SPI = 0xdb680406
[IKEv1 DEBUG]: Group = 10.0.0.2,
IP = 10.0.0.2, IKE got a
KEY_ADD msg for SA: SPI = 0xdb680406
IPSEC: Completed host IBSA update,
SPI 0x1698CAC7
IPSEC: Creating inbound VPN context,
SPI 0x1698CAC7
Flags: 0x00000006
SA : 0x53FC3698
SPI : 0x1698CAC7
MTU : 0 bytes
VCID : 0x00000000
Peer : 0x0000E9B4
SCB : 0x005DAE51
Channel: 0x4C69CB80
IPSEC: Completed inbound VPN context,
SPI 0x1698CAC7
VPN handle: 0x00011A8C
IPSEC: Updating outbound VPN context 0x0000E9B4,
SPI 0xDB680406
Flags: 0x00000005
SA : 0x53F18B00
SPI : 0xDB680406
MTU : 1500 bytes
VCID : 0x00000000
Peer : 0x00011A8C
SCB : 0x005E4849
Channel: 0x4C69CB80
IPSEC: Completed outbound VPN context,
SPI 0xDB680406
VPN handle: 0x0000E9B4
IPSEC: Completed outbound inner rule,
SPI 0xDB680406
Rule ID: 0x53F89160
IPSEC: Completed outbound outer SPD rule,
SPI 0xDB680406
Rule ID: 0x53E47E88
IPSEC: New inbound tunnel flow rule,
SPI 0x1698CAC7
Src addr: 192.168.2.0
Src mask: 255.255.255.0
Dst addr: 192.168.1.0
Dst mask: 255.255.255.0
Src ports
Upper: 0
Lower: 0
Op : ignore
Dst ports
Upper: 0
Lower: 0
Op : ignore
Protocol: 1
Use protocol: true
SPI: 0x00000000
Use SPI: false
IPSEC: Completed inbound tunnel flow rule,
SPI 0x1698CAC7
Rule ID: 0x53FC3E80
IPSEC: New inbound decrypt rule,
SPI 0x1698CAC7
Src addr: 10.0.0.2
Src mask: 255.255.255.255
Dst addr: 10.0.0.1
Dst mask: 255.255.255.255
Src ports
Upper: 0
Lower: 0
Op : ignore
Dst ports
Upper: 0
Lower: 0
Op : ignore
Protocol: 50
Use protocol: true
SPI: 0x1698CAC7
Use SPI: true
IPSEC: Completed inbound decrypt rule,
SPI 0x1698CAC7
Rule ID: 0x53FC3F18
IPSEC: New inbound permit rule,
SPI 0x1698CAC7
Src addr: 10.0.0.2
Src mask: 255.255.255.255
Dst addr: 10.0.0.1
Dst mask: 255.255.255.255
Src ports
Upper: 0
Lower: 0
Op : ignore
Dst ports
Upper: 0
Lower: 0
Op : ignore
Protocol: 50
Use protocol: true
SPI: 0x1698CAC7
Use SPI: true
IPSEC: Completed inbound permit rule,
SPI 0x1698CAC7
Rule ID: 0x53F8AEA8
[IKEv1 DEBUG]: Group = 10.0.0.2,
IP = 10.0.0.2, Pitcher:
received KEY_UPDATE, spi 0x1698cac7
Des SPI sont assignés aux données SAS.
[IKEv1 DEBUG]: Group = 10.0.0.2,    
IP = 10.0.0.2, Starting P2
rekey timer: 3060 seconds.
Temps de rekey d'IPsec de début.
[IKEv1]: Group = 10.0.0.2,  
IP = 10.0.0.2, PHASE 2
COMPLETED (msgid=52481cf5)
Phase 2 complet. Le responder et le demandeur sont le trafic capable de to encrypt/decrypt.

Vérification de tunnel


Remarque: Puisque l'ICMP est utilisé pour déclencher le tunnel, seulement un IPSec SA est. Protocol 1 = ICMP.

show crypto ipsec sa
interface: outside
    Crypto map tag: MAP, seq num: 10, local addr: 10.0.0.1
      access-list VPN extended permit icmp 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
      local ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/1/0)
      remote ident (addr/mask/prot/port): (192.168.2.0/255.255.255.0/1/0)
      current_peer: 10.0.0.2
      #pkts encaps: 4, #pkts encrypt: 4, #pkts digest: 4
      #pkts decaps: 4, #pkts decrypt: 4, #pkts verify: 4
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 4, #pkts comp failed: 0, #pkts decomp failed: 0
      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      #send errors: 0, #recv errors: 0
      local crypto endpt.: 10.0.0.1/0, remote crypto endpt.: 10.0.0.2/0
      path mtu 1500, ipsec overhead 74, media mtu 1500
      current outbound spi: DB680406
      current inbound spi : 1698CAC7
    inbound esp sas:
      spi: 0x1698CAC7 (379112135)
         transform: esp-aes esp-sha-hmac no compression
         in use settings ={L2L, Tunnel, }
         slot: 0, conn_id: 16384, crypto-map: MAP
         sa timing: remaining key lifetime (kB/sec): (3914999/3326)
         IV size: 16 bytes
         replay detection support: Y
         Anti replay bitmap:
          0x00000000 0x0000001F
    outbound esp sas:
      spi: 0xDB680406 (3681027078)
         transform: esp-aes esp-sha-hmac no compression
         in use settings ={L2L, Tunnel, }
         slot: 0, conn_id: 16384, crypto-map: MAP
         sa timing: remaining key lifetime (kB/sec): (3914999/3326)
         IV size: 16 bytes
         replay detection support: Y
         Anti replay bitmap:
          0x00000000 0x00000001

 

show crypto isakmp sa

   Active SA: 1
   Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
Total IKE SA: 1

1   IKE Peer: 10.0.0.2
    Type    : L2L             Role    : responder
    Rekey   : no              State   : MM_ACTIVE

Informations connexes


Conversations connexes de la communauté de soutien de Cisco

Le site Cisco Support Community est un forum où vous pouvez poser des questions, répondre à des questions, faire part de suggestions et collaborer avec vos pairs.


Document ID: 113574