WebEx : Dispositivos de seguridad Cisco PIX de la serie 500

PIX/ASA 7.x: Parte de la interfaz DMZ el ejemplo de configuración del tráfico interesante del túnel IPsec

17 Octubre 2016 - Traducción Automática
Otras Versiones: PDFpdf | Inglés (22 Agosto 2015) | Comentarios


Contenido


Introducción

Esta configuración permite que dos Cisco Secure PIX Firewalls con PIX 7.x funcionen con un túnel VPN simple desde el interior y las interfaces de Zona Desmilitarizada (DMZ) de un PIX al otro PIX a través de Internet o cualquier red pública que utilice IPSec.

El IPSec es una combinación de estándares abiertos que proporciona la confidencialidad de los datos, la integridad de los datos y la autenticación del origen de los datos entre los peeres IPSec.

prerrequisitos

Requisitos

Asegúrese de cumplir estos requisitos antes de intentar esta configuración:

Componentes Utilizados

La información en este documento se basa en el Firewall del Secure PIX de Cisco 515E con la versión de software del dispositivo de seguridad del Cisco PIX 7.2(1) con las interfaces DMZ.

La información que contiene este documento se creó a partir de los dispositivos en un ambiente de laboratorio específico. Todos los dispositivos que se utilizan en este documento se pusieron en funcionamiento con una configuración verificada (predeterminada). Si la red está funcionando, asegúrese de haber comprendido el impacto que puede tener cualquier comando.

Convenciones

Consulte Convenciones de Consejos Técnicos de Cisco para obtener más información sobre las convenciones sobre documentos.

Antecedentes

El IPSec Negotiation se puede analizar en cinco pasos e incluye dos fases del Internet Key Exchange (IKE).

  1. Un túnel IPsec es iniciado por el tráfico interesante. El tráfico se considera interesante cuando viaja entre los peeres IPSec.

  2. En la fase 1 IKE, los peeres IPSec negocian la directiva establecida de la asociación de seguridad IKE (SA). Una vez que autentican a los pares, un túnel seguro se crea usando el ISAKMP.

  3. En la fase 2 IKE, los peeres IPSec utilizan el túnel seguro y autenticado para negociar IPSec SA transforman. La negociación de la política compartida determina cómo se establece el túnel IPsec.

  4. Se crea el túnel IPsec y los datos se transfieren entre los peeres IPSec basados en los parámetros de IPSec configurados en el IPSec transforman los conjuntos.

  5. El túnel IPsec termina cuando se borra el SA de IPSec o cuando expira su curso de la vida.

    Nota: El IPSec Negotiation entre los dos PIXes falla si los SA en ambas fases IKE no hacen juego en los pares.

Configurar

En esta sección, le presentan con la información para configurar el túnel IPsec entre la interfaz interior y la interfaz DMZ en un PIX al otro PIX.

Esta configuración asume que la configuración de ruteo básica es ya en el lugar y que los dispositivos son de punta a punta accesible. En este documento, usted puede verificar la configuración con estos comandos show.

  • muestre el isakmp

  • muestre la política isakmp

  • muestre la lista de acceso

  • muestre el transforme el conjunto crypto del IPSec

  • show crypto isakmp sa

  • show crypto ipsec sa

Refiera a las Referencias de Comandos de Secure PIX firewall para más información sobre estos comandos show.

La formación de un túnel IPsec seguro sucede en la fase 1 IKE y la fase 2. IKE.

Nota: Utilice la herramienta Command Lookup Tool (clientes registrados solamente) para obtener más información sobre los comandos utilizados en esta sección.

Diagrama de la red

En este documento, se utiliza esta configuración de red:

/image/gif/paws/69385/pix-asa-7x-dmz-ipsec-tunnel-1.gif

Configuraciones

En este documento, se utilizan estas configuraciones:

IKE para la configuración de las claves del preshared

Permiso IKE en las interfaces de terminación de IPSec usando el comando isakmp enable. En este escenario, la interfaz exterior es la interfaz de terminación de IPSec en ambo PIXes. El IKE se configura en ambo PIXes. Utilice el isakmp enable fuera del comando en ambo PIXes.

Utilice el comando isakmp policy de definir las políticas IKE que se utilizan durante las negociaciones IKE. Cuando usted utiliza este comando, usted debe asignar un nivel de prioridad para identificar las directivas únicamente. En este caso, la prioridad de 10 se asigna a la directiva.

PIX1(config)#isakmp policy 10 authentication pre-share
PIX1(config)#isakmp policy 10 encryption des
PIX1(config)#isakmp policy 10 hash md5
PIX1(config)#isakmp policy 10 group 1
PIX1(config)#isakmp policy 10 lifetime 1000

Esta directiva también se fija a:

  • Utilice una clave del preshared

  • Utilice el algoritmo de troceo MD5 para la autenticación de datos

  • Utilice el DES para el Encapsulating Security Payload (ESP)

  • Utilice el group1 de Diffie Hellman

  • Fije el curso de la vida SA

Utilice el comando show isakmp policy de verificar si la directiva se configura realmente con todos los parámetros de su opción.

Para crear y manejar la base de datos de los expedientes conexión-específicos para los túneles IPsec, utilice el comando del grupo de túnel en el modo de configuración global. El nombre del grupo de túnel debe ser la dirección IP del par. El tipo debe ser LAN a LAN del IPSec. Bajo modo de configuración del túnel IPsec, publique el comando <password> de la clave previamente compartida como se muestra:

PIX1(config)#tunnel-group 172.16.2.5 type ipsec-l2l
PIX1(config)#tunnel-group 172.16.2.5 ipsec-attributes
PIX1(config-tunnel-ipsec)#pre-shared-key cisco

Configuración del Network Address Translation (NAT)

Esta configuración utiliza la exención de NAT para que el tráfico sea tunneled. Esto significa que va el tráfico interesante O.N.U-NATed. El resto del tráfico utiliza el Port Address Translation (PAT) para cambiar la dirección IP de origen del paquete a la dirección IP de la interfaz exterior.

PIX1(config)#access-list NoNAT extended permit ip 10.2.2.0 255.255.255.0 10.6.6.0 255.255.255.0
PIX1(config)#access-list NoNAT extended permit ip 10.3.3.0 255.255.255.0 10.6.6.0 255.255.255.0
PIX1(config)#access-list PAT permit ip 10.2.2.0 255.255.255.0 any
PIX1(config)#access-list PAT permit ip 10.3.3.0 255.255.255.0 any
PIX1(config)#nat (inside) 0 access-list NoNAT
PIX1(config)#nat (inside) 1 access-list PAT
PIX1(config)#nat (DMZ) 0 access-list NoNAT
PIX1(config)#nat (DMZ) 1 access-list PAT 
PIX1(config)#global (outside) 1 interface

Semejantemente, en el PIX2, la identidad NAT se configura para que el tráfico sea tunneled y el resto del tráfico se envía usando el patente.

PIX2(config)#access-list NoNAT extended permit ip 10.6.6.0 255.255.255.0 10.2.2.0 255.255.255.0
PIX2(config)#access-list NoNAT extended permit ip 10.6.6.0 255.255.255.0 10.3.3.0 255.255.255.0
PIX2(config)#nat (inside) 0 access-list NoNAT
PIX2(config)#nat (inside) 1 10.6.6.0 255.255.255.0
PIX2(config)#global (outside) 1 interface

Configuración IPSec

Se inicia el IPSec cuando uno del PIXes recibe el tráfico que es destinado para la red interna del otro PIX. Este tráfico es el tráfico interesante juzgado que necesita ser protegido por el IPSec. Una lista de acceso se utiliza para determinar qué tráfico inicia el IKE y los IPSec Negotiations. La lista de acceso nombrada INTERESTING permite que el tráfico sea enviado de las redes de 10.2.2.0 y de 10.3.3.0 en el Firewall del PIX1 a la red de 10.6.6.0 en el Firewall del PIX2.

PIX1(config)#access-list INTERESTING extended permit ip 10.2.2.0 255.255.255.0 10.6.6.0 255.255.255.0
PIX1(config)#access-list INTERESTING extended permit ip 10.3.3.0 255.255.255.0 10.6.6.0 255.255.255.0

El IPSec transforma el conjunto define la política de seguridad que los pares utilizan para proteger el flujo de datos. El IPSec transforma se define usando el comando crypto ipsec transform-set. Un nombre único se debe elegir para la transformación fijada y hasta tres transforma se pueden seleccionar para definir seguridad IPSec los protocolos. Esta configuración utiliza solamente dos transforma:

  • esp-md5-hmac

  • ESP-DES

PIX1(config)#crypto ipsec transform-set my-set esp-des esp-md5-hmac

SA de IPSec de la configuración de las correspondencias de criptografía para el tráfico encriptado. Usted debe asignar un nombre de asignación y un número de secuencia, y define los parámetros de la correspondencia de criptografía para crear una correspondencia de criptografía. La correspondencia de criptografía “mymap” utiliza el IKE para establecer el SA de IPSec, cifra cualquier cosa que hace juego la lista de acceso INTERESANTE, tiene un par del conjunto, y utiliza el transforme el conjunto del mi-conjunto para decretar su política de seguridad para el tráfico.

PIX1(config)#crypto map mymap 20 match address INTERESTING
PIX1(config)#crypto map mymap 20 set peer 172.16.2.5
PIX1(config)#crypto map mymap 20 set transform-set my-set

Después de que usted defina la correspondencia de criptografía, utilice la interfaz del mymap de la correspondencia de criptografía fuera del comando de aplicar la correspondencia de criptografía a una interfaz. La interfaz que usted elige debe ser la interfaz de terminación de IPSec.

PIX1(config)#crypto map mymap interface outside

Configuración del PIX1

PIX1

!--- Output is suppressed.


interface Ethernet0
 nameif outside
 security-level 0
 ip address 172.16.1.2 255.255.255.0
!
interface Ethernet1
 nameif inside
 security-level 100
 ip address 10.2.2.2 255.255.255.0
!
interface Ethernet2
 nameif DMZ1
 security-level 50
 ip address 10.3.3.2 255.255.255.0


!--- Output is suppressed.



!--- This access control list (ACL) is for NAT 0.

access-list NoNAT extended permit ip 10.2.2.0 255.255.255.0 10.6.6.0 255.255.255.0
access-list NoNAT extended permit ip 10.3.3.0 255.255.255.0 10.6.6.0 255.255.255.0


!--- This ACL defines the interesting traffic.

access-list INTERESTING extended permit ip 10.2.2.0 255.255.255.0 10.6.6.0 255.255.255.0
access-list INTERESTING extended permit ip 10.3.3.0 255.255.255.0 10.6.6.0 255.255.255.0


!--- This ACL is for PAT.

access-list PAT permit ip 10.2.2.0 255.255.255.0 any
access-list PAT permit ip 10.3.3.0 255.255.255.0 any


!--- Output is suppressed.



!--- NAT control requires NAT for inside or DMZ hosts 
!--- when they access the outside.

nat-control




!--- This is the global statement for PAT.

global (outside) 1 interface


!--- This command is for the NAT 0 entry on the inside interface.

nat (inside) 0 access-list NoNAT


!--- This command is for the PAT entry on the inside interface.

nat (inside) 1 access-list PAT 


!--- This command is for the NAT 0 entry on the DMZ interface.

nat (DMZ) 0 access-list NoNAT


!--- This command is for the PAT entry on the DMZ interface.

nat (DMZ) 1 access-list PAT


route outside 0.0.0.0 0.0.0.0 172.16.1.4 1



!--- Output is suppressed.




!--- This command defines the IPsec transform set with the 
!--- security policy that the peers use to protect the data flow.

crypto ipsec transform-set my-set esp-des esp-md5-hmac


!--- These commands allow crypto map to set up IPsec SAs
!--- for the encrypted traffic.

crypto map mymap 20 match address INTERESTING
crypto map mymap 20 set peer 172.16.2.5
crypto map mymap 20 set transform-set my-set


!--- This command applies the crypto map to the outside interface.

crypto map mymap interface outside


!--- This command applies the crypto map to the outside interface.

isakmp enable outside


!--- These commands apply the crypto map to the outside interface.

isakmp policy 10 authentication pre-share
isakmp policy 10 encryption des
isakmp policy 10 hash md5
isakmp policy 10 group 1
isakmp policy 10 lifetime 1000


!--- Output is suppressed.




!--- These commands create and manage the database of connection-specific 
!--- records for IPsec tunnels. Issue a preshared key, which should be the same as 
!--- that on the peer.

tunnel-group 172.16.2.5 type ipsec-l2l
tunnel-group 172.16.2.5 ipsec-attributes
 pre-shared-key *


!--- Output is suppressed.

Configuración del PIX2

Configuración en el PIX2

!--- Output is suppressed.


interface Ethernet0
 nameif outside
 security-level 0
 ip address 172.16.2.5 255.255.255.0
!
interface Ethernet1
 nameif inside
 security-level 100
 ip address 10.6.6.5 255.255.255.0


!--- Output is suppressed.


access-list NoNAT extended permit ip 10.6.6.0 255.255.255.0 10.2.2.0 255.255.255.0
access-list NoNAT extended permit ip 10.6.6.0 255.255.255.0 10.3.3.0 255.255.255.0
access-list INTERESTING extended permit ip 10.6.6.0 255.255.255.0 10.2.2.0 255.255.255.0
access-list INTERESTING extended permit ip 10.6.6.0 255.255.255.0 10.3.3.0 255.255.255.0


!--- Output is suppressed.



global (outside) 1 interface
nat (inside) 0 access-list NoNAT
nat (inside) 1 10.6.6.0 255.255.255.0
route outside 0.0.0.0 0.0.0.0 172.16.2.4 1


!--- Output is suppressed.


crypto ipsec transform-set my-set esp-des esp-md5-hmac
crypto map mymap 20 match address INTERESTING
crypto map mymap 20 set peer 172.16.1.2
crypto map mymap 20 set transform-set my-set
crypto map mymap interface outside
isakmp enable outside
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption des
isakmp policy 10 hash md5
isakmp policy 10 group 1
isakmp policy 10 lifetime 1000


!--- Output is suppressed.


tunnel-group 172.16.1.2 type ipsec-l2l
tunnel-group 172.16.1.2 ipsec-attributes
 pre-shared-key *
telnet timeout 5


!--- Output is suppressed.

Verificación

Use esta sección para confirmar que su configuración funciona correctamente.

La herramienta Output Interpreter Tool (clientes registrados solamente) (OIT) soporta ciertos comandos show. Utilice la OIT para ver un análisis del resultado del comando show.

  • muestre isakmp crypto sa — Visualiza IKE actual SA.

    PIX1#show crypto isakmp sa
    
       Active SA: 1
        Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
    Total IKE SA: 1
    
    1   IKE Peer: 172.16.2.5
        Type    : L2L             Role    : initiator
        Rekey   : no              State   : MM_ACTIVE
  • show crypto ipsec sa — Muestra la configuración actual utilizada por las SA actuales

    Una vez que usted envía el tráfico entre las redes definidas como tráfico interesante, se acciona el túnel IPsec. Un ping entre dos host se puede utilizar para probar la formación del túnel.


!--- This is show crypto ipsec sa command output on PIX1.

PIX1#show crypto ipsec sa
interface: outside
    Crypto map tag: mymap, seq num: 20, local addr: 172.16.1.2

      access-list INTERESTING permit ip 10.2.2.0 255.255.255.0 10.6.6.0 255.255.255.0
      local ident (addr/mask/prot/port): (10.2.2.0/255.255.255.0/0/0)
      remote ident (addr/mask/prot/port): (10.6.6.0/255.255.255.0/0/0)
      current_peer: 172.16.2.5


!--- This verifies that encrypted packets are 
!--- sent and recede without any errors.


      #pkts encaps: 199, #pkts encrypt: 199, #pkts digest: 199
      #pkts decaps: 199, #pkts decrypt: 199, #pkts verify: 199
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 199, #pkts comp failed: 0, #pkts decomp failed: 0
      #send errors: 0, #recv errors: 0

      local crypto endpt.: 172.16.1.2, remote crypto endpt.: 172.16.2.5

      path mtu 1500, ipsec overhead 60, media mtu 1500
      current outbound spi: 80A00578

    inbound esp sas:
      spi: 0xD92F129E (3643740830)
         transform: esp-des esp-md5-hmac
         in use settings ={L2L, Tunnel, }
         slot: 0, conn_id: 1, crypto-map: mymap
         sa timing: remaining key lifetime (kB/sec): (3824980/28593)
         IV size: 8 bytes
         replay detection support: Y
    outbound esp sas:
      spi: 0x80A00578 (2157970808)
         transform: esp-des esp-md5-hmac
         in use settings ={L2L, Tunnel, }
         slot: 0, conn_id: 1, crypto-map: mymap
         sa timing: remaining key lifetime (kB/sec): (3824980/28591)
         IV size: 8 bytes
         replay detection support: Y

    Crypto map tag: mymap, seq num: 20, local addr: 172.16.1.2

      access-list INTERESTING permit ip 10.3.3.0 255.255.255.0 10.6.6.0 255.255.255.0
      local ident (addr/mask/prot/port): (10.3.3.0/255.255.255.0/0/0)
      remote ident (addr/mask/prot/port): (10.6.6.0/255.255.255.0/0/0)
      current_peer: 172.16.2.5

      #pkts encaps: 199, #pkts encrypt: 199, #pkts digest: 199
      #pkts decaps: 199, #pkts decrypt: 199, #pkts verify: 199
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 199, #pkts comp failed: 0, #pkts decomp failed: 0
      #send errors: 0, #recv errors: 0

      local crypto endpt.: 172.16.1.2, remote crypto endpt.: 172.16.2.5

      path mtu 1500, ipsec overhead 60, media mtu 1500
      current outbound spi: 3D0C2074

    inbound esp sas:
      spi: 0x5B64B9D6 (1533327830)
         transform: esp-des esp-md5-hmac
         in use settings ={L2L, Tunnel, }
         slot: 0, conn_id: 1, crypto-map: mymap
         sa timing: remaining key lifetime (kB/sec): (3824980/28658)
         IV size: 8 bytes
         replay detection support: Y
    outbound esp sas:
      spi: 0x3D0C2074 (1024204916)
         transform: esp-des esp-md5-hmac
         in use settings ={L2L, Tunnel, }
         slot: 0, conn_id: 1, crypto-map: mymap
         sa timing: remaining key lifetime (kB/sec): (3824980/28658)
         IV size: 8 bytes
         replay detection support: Y




!--- This is show crypto ipsec sa command output on PIX2.


PIX2#show crypto ipsec sa
interface: outside
    Crypto map tag: mymap, seq num: 20, local addr: 172.16.2.5

      access-list INTERESTING permit ip 10.6.6.0 255.255.255.0 10.3.3.0 255.255.255.0
      local ident (addr/mask/prot/port): (10.6.6.0/255.255.255.0/0/0)
      remote ident (addr/mask/prot/port): (10.3.3.0/255.255.255.0/0/0)
      current_peer: 172.16.1.2

      #pkts encaps: 199, #pkts encrypt: 199, #pkts digest: 199
      #pkts decaps: 199, #pkts decrypt: 199, #pkts verify: 199
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 199, #pkts comp failed: 0, #pkts decomp failed: 0
      #send errors: 0, #recv errors: 0

      local crypto endpt.: 172.16.2.5, remote crypto endpt.: 172.16.1.2

      path mtu 1500, ipsec overhead 60, media mtu 1500
      current outbound spi: 5B64B9D6

    inbound esp sas:
      spi: 0x3D0C2074 (1024204916)
         transform: esp-des esp-md5-hmac
         in use settings ={L2L, Tunnel, }
         slot: 0, conn_id: 1, crypto-map: mymap
         sa timing: remaining key lifetime (kB/sec): (4274980/28465)
         IV size: 8 bytes
         replay detection support: Y
    outbound esp sas:
      spi: 0x5B64B9D6 (1533327830)
         transform: esp-des esp-md5-hmac
         in use settings ={L2L, Tunnel, }
         slot: 0, conn_id: 1, crypto-map: mymap
         sa timing: remaining key lifetime (kB/sec): (4274980/28463)
         IV size: 8 bytes
         replay detection support: Y

    Crypto map tag: mymap, seq num: 20, local addr: 172.16.2.5

      access-list INTERESTING permit ip 10.6.6.0 255.255.255.0 10.2.2.0 255.255.255.0
      local ident (addr/mask/prot/port): (10.6.6.0/255.255.255.0/0/0)
      remote ident (addr/mask/prot/port): (10.2.2.0/255.255.255.0/0/0)
      current_peer: 172.16.1.2

      #pkts encaps: 199, #pkts encrypt: 199, #pkts digest: 199
      #pkts decaps: 199, #pkts decrypt: 199, #pkts verify: 199
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 199, #pkts comp failed: 0, #pkts decomp failed: 0
      #send errors: 0, #recv errors: 0

      local crypto endpt.: 172.16.2.5, remote crypto endpt.: 172.16.1.2

      path mtu 1500, ipsec overhead 60, media mtu 1500
      current outbound spi: D92F129E

    inbound esp sas:
      spi: 0x80A00578 (2157970808)
         transform: esp-des esp-md5-hmac
         in use settings ={L2L, Tunnel, }
         slot: 0, conn_id: 1, crypto-map: mymap
         sa timing: remaining key lifetime (kB/sec): (4274980/28393)
         IV size: 8 bytes
         replay detection support: Y
    outbound esp sas:
      spi: 0xD92F129E (3643740830)
         transform: esp-des esp-md5-hmac
         in use settings ={L2L, Tunnel, }
         slot: 0, conn_id: 1, crypto-map: mymap
         sa timing: remaining key lifetime (kB/sec): (4274980/28393)
         IV size: 8 bytes
         replay detection support: Y

Troubleshooting

En esta sección encontrará información que puede utilizar para solucionar problemas de configuración.

La herramienta Output Interpreter (sólo para clientes registrados) permite utilizar algunos comandos “show” y ver un análisis del resultado de estos comandos.

Nota: Consulte información importante en los comandos debug antes de ejecutar los comandos debug.

isakmp del debug crypto — Información del debug de las visualizaciones sobre las conexiones del IPSec.

debug crypto isakmp
pix3#debug crypto isakmp 7

Jan 01 04:34:49 [IKEv1 DEBUG]: IP = 172.16.2.5, Oakley proposal is acceptable
Jan 01 04:34:49 [IKEv1 DEBUG]: IP = 172.16.2.5, processing VID payload
Jan 01 04:34:49 [IKEv1 DEBUG]: IP = 172.16.2.5, Received Fragmentation VID
Jan 01 04:34:49 [IKEv1 DEBUG]: IP = 172.16.2.5, IKE Peer included 
IKE fragmentation capability flags:  Main Mode:        True  Aggressive Mode:  True
Jan 01 04:34:49 [IKEv1 DEBUG]: IP = 172.16.2.5, constructing ke payload
Jan 01 04:34:49 [IKEv1 DEBUG]: IP = 172.16.2.5, constructing nonce payload
Jan 01 04:34:49 [IKEv1 DEBUG]: IP = 172.16.2.5, constructing Cisco Unity VID payload
Jan 01 04:34:49 [IKEv1 DEBUG]: IP = 172.16.2.5, constructing xauth V6 VID payload
Jan 01 04:34:49 [IKEv1 DEBUG]: IP = 172.16.2.5, Send IOS VID
Jan 01 04:34:49 [IKEv1 DEBUG]: IP = 172.16.2.5, Constructing ASA spoofing 
IOS Vendor ID payload (version: 1.0.0, capabilities: 20000001)
Jan 01 04:34:49 [IKEv1 DEBUG]: IP = 172.16.2.5, constructing VID payload
Jan 01 04:34:49 [IKEv1 DEBUG]: IP = 172.16.2.5, Send Altiga/Cisco VPN3000/Cisco ASA GW VID
Jan 01 04:34:49 [IKEv1]: IP = 172.16.2.5, IKE_DECODE SENDING Message 
(msgid=0) with payloads : HDR + KE (4) + NONCE (10) + VENDOR (13) + 
VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 224
Jan 01 04:34:49 [IKEv1]: IP = 172.16.2.5, IKE_DECODE RECEIVED Message 
(msgid=0) with payloads : HDR + KE (4) + NONCE (10) + VENDOR (13) + 
VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 224
Jan 01 04:34:49 [IKEv1 DEBUG]: IP = 172.16.2.5, processing ke payload
Jan 01 04:34:49 [IKEv1 DEBUG]: IP = 172.16.2.5, processing ISA_KE payload
Jan 01 04:34:49 [IKEv1 DEBUG]: IP = 172.16.2.5, processing nonce payload
Jan 01 04:34:49 [IKEv1 DEBUG]: IP = 172.16.2.5, processing VID payload
Jan 01 04:34:49 [IKEv1 DEBUG]: IP = 172.16.2.5, Received Cisco Unity client VID
Jan 01 04:34:49 [IKEv1 DEBUG]: IP = 172.16.2.5, processing VID payload
Jan 01 04:34:49 [IKEv1 DEBUG]: IP = 172.16.2.5, Received xauth V6 VID
Jan 01 04:34:49 [IKEv1 DEBUG]: IP = 172.16.2.5, processing VID payload
Jan 01 04:34:49 [IKEv1 DEBUG]: IP = 172.16.2.5, Processing VPN3000/ASA 
spoofing IOS Vendor ID payload (version: 1.0.0, capabilities: 20000001)
Jan 01 04:34:49 [IKEv1 DEBUG]: IP = 172.16.2.5, processing VID payload
Jan 01 04:34:49 [IKEv1 DEBUG]: IP = 172.16.2.5, Received Altiga/Cisco 
VPN3000/Cisco ASA GW VID
Jan 01 04:34:49 [IKEv1]: IP = 172.16.2.5, Connection landed on tunnel_group 172.16.2.5
Jan 01 04:34:49 [IKEv1 DEBUG]: Group = 172.16.2.5, IP = 172.16.2.5, 
Generating keys for Initiator...
Jan 01 04:34:49 [IKEv1 DEBUG]: Group = 172.16.2.5, IP = 172.16.2.5, 
constructing ID payload
Jan 01 04:34:49 [IKEv1 DEBUG]: Group = 172.16.2.5, IP = 172.16.2.5, 
constructing hash payload
Jan 01 04:34:49 [IKEv1 DEBUG]: Group = 172.16.2.5, IP = 172.16.2.5, 
Computing hash for ISAKMP
Jan 01 04:34:49 [IKEv1 DEBUG]: IP = 172.16.2.5, Constructing IOS keep 
alive payload: proposal=32767/32767 sec.
Jan 01 04:34:49 [IKEv1 DEBUG]: Group = 172.16.2.5, IP = 172.16.2.5, 
constructing dpd vid payload
Jan 01 04:34:49 [IKEv1]: IP = 172.16.2.5, IKE_DECODE SENDING Message (msgid=0) 
with payloads : HDR + ID (5) + HASH (8) + IOS KEEPALIVE (128) + VENDOR (13)
 + NONE (0) total length : 92
Jan 01 04:34:50 [IKEv1]: IP = 172.16.2.5, IKE_DECODE RECEIVED Message 
(msgid=0) with payloads : HDR + ID (5) + HASH (8) + IOS KEEPALIVE (128) 
+ VENDOR (13) + NONE (0) total length : 92
Jan 01 04:34:50 [IKEv1 DEBUG]: Group = 172.16.2.5, IP = 172.16.2.5, 
processing ID payload
Jan 01 04:34:50 [IKEv1 DEBUG]: Group = 172.16.2.5, IP = 172.16.2.5, 
processing hash payload
Jan 01 04:34:50 [IKEv1 DEBUG]: Group = 172.16.2.5, IP = 172.16.2.5, 
Computing hash for ISAKMP
Jan 01 04:34:50 [IKEv1 DEBUG]: IP = 172.16.2.5, Processing IOS keep 
alive payload: proposal=32767/32767 sec.
Jan 01 04:34:50 [IKEv1 DEBUG]: Group = 172.16.2.5, IP = 172.16.2.5, 
processing VID payload
Jan 01 04:34:50 [IKEv1 DEBUG]: Group = 172.16.2.5, IP = 172.16.2.5, 
Received DPD VID
Jan 01 04:34:50 [IKEv1]: IP = 172.16.2.5, Connection landed on tunnel_group 172.16.2.5
Jan 01 04:34:50 [IKEv1]: Group = 172.16.2.5, IP = 172.16.2.5, Freeing 
previously allocated memory for authorization-dn-attributes
Jan 01 04:34:50 [IKEv1 DEBUG]: Group = 172.16.2.5, IP = 172.16.2.5, 
Oakley begin quick mode
Jan 01 04:34:50 [IKEv1]: Group = 172.16.2.5, IP = 172.16.2.5, PHASE 1 COMPLETED
Jan 01 04:34:50 [IKEv1]: IP = 172.16.2.5, Keep-alive type for this connection: DPD
Jan 01 04:34:50 [IKEv1 DEBUG]: Group = 172.16.2.5, IP = 172.16.2.5, 
Starting P1 rekey timer: 850 seconds.
Jan 01 04:34:50 [IKEv1 DEBUG]: Group = 172.16.2.5, IP = 172.16.2.5, 
IKE got SPI from key engine: SPI = 0x1cd9ec0c
Jan 01 04:34:50 [IKEv1 DEBUG]: Group = 172.16.2.5, IP = 172.16.2.5, 
oakley constucting quick mode
Jan 01 04:34:50 [IKEv1 DEBUG]: Group = 172.16.2.5, IP = 172.16.2.5, 
constructing blank hash payload
Jan 01 04:34:50 [IKEv1 DEBUG]: Group = 172.16.2.5, IP = 172.16.2.5, 
constructing IPSec SA payload
Jan 01 04:34:50 [IKEv1 DEBUG]: Group = 172.16.2.5, IP = 172.16.2.5, 
constructing IPSec nonce payload
Jan 01 04:34:50 [IKEv1 DEBUG]: Group = 172.16.2.5, IP = 172.16.2.5, 
constructing proxy ID
Jan 01 04:34:50 [IKEv1 DEBUG]: Group = 172.16.2.5, IP = 172.16.2.5, 
Transmitting Proxy Id:
  Local subnet:  10.2.2.0  mask 255.255.255.0 Protocol 0  Port 0
  Remote subnet: 10.6.6.0  Mask 255.255.255.0 Protocol 0  Port 0
Jan 01 04:34:50 [IKEv1 DEBUG]: Group = 172.16.2.5, IP = 172.16.2.5, 
constructing qm hash payload
Jan 01 04:34:50 [IKEv1]: IP = 172.16.2.5, IKE_DECODE SENDING Message 
(msgid=75aa2cf6) with payloads: HDR + HASH (8) + SA (1) + NONCE (10) + ID (5) + 
ID (5) + NOTIFY (11) + NONE (0) total length : 192
Jan 01 04:34:50 [IKEv1]: IP = 172.16.2.5, IKE_DECODE RECEIVED Message 
(msgid=75aa2cf6) with payloads : HDR + HASH (8) + SA (1) + NONCE (10) + 
ID (5) + ID (5) + NONE (0) total length : 164
Jan 01 04:34:50 [IKEv1 DEBUG]: Group = 172.16.2.5, IP = 172.16.2.5, 
processing hash payload
Jan 01 04:34:50 [IKEv1 DEBUG]: Group = 172.16.2.5, IP = 172.16.2.5, 
processing SA payload
Jan 01 04:34:50 [IKEv1 DEBUG]: Group = 172.16.2.5, IP = 172.16.2.5, 
processing nonce payload
Jan 01 04:34:50 [IKEv1 DEBUG]: Group = 172.16.2.5, IP = 172.16.2.5, 
processing ID payload
Jan 01 04:34:50 [IKEv1 DEBUG]: Group = 172.16.2.5, IP = 172.16.2.5, 
processing ID payload
Jan 01 04:34:50 [IKEv1 DEBUG]: Group = 172.16.2.5, IP = 172.16.2.5, 
loading all IPSEC SAs
Jan 01 04:34:50 [IKEv1 DEBUG]: Group = 172.16.2.5, IP = 172.16.2.5, 
Generating Quick Mode Key!
Jan 01 04:34:50 [IKEv1 DEBUG]: Group = 172.16.2.5, IP = 172.16.2.5, 
Generating Quick Mode Key!
Jan 01 04:34:50 [IKEv1]: Group = 172.16.2.5, IP = 172.16.2.5, Security negotiation 
complete for LAN-to-LAN Group (172.16.2.5)  Initiator, Inbound SPI = 0x1cd9ec0c, 
Outbound SPI = 0x489fb7ca
Jan 01 04:34:50 [IKEv1 DEBUG]: Group = 172.16.2.5, IP = 172.16.2.5, 
oakley constructing final quickmode
Jan 01 04:34:50 [IKEv1]: IP = 172.16.2.5, IKE_DECODE SENDING Message 
(msgid=75aa2cf6) with payloads: HDR + HASH (8) + NONE (0) total length : 72
Jan 01 04:34:50 [IKEv1 DEBUG]: Group = 172.16.2.5, IP = 172.16.2.5, IKE got 
a KEY_ADD msg for SA: SPI = 0x489fb7ca
Jan 01 04:34:50 [IKEv1 DEBUG]: Group = 172.16.2.5, IP = 172.16.2.5, 
Pitcher: received KEY_UPDATE, spi 0x1cd9ec0c
Jan 01 04:34:50 [IKEv1 DEBUG]: Group = 172.16.2.5, IP = 172.16.2.5, 
Starting P2 rekey timer: 24480 seconds.
Jan 01 04:34:50 [IKEv1]: Group = 172.16.2.5, IP = 172.16.2.5, PHASE 2 COMPLETED 
(msgid=75aa2cf6)
Jan 01 04:35:05 [IKEv1 DEBUG]: Group = 172.16.2.5, IP = 172.16.2.5, 
Sending keep-alive of type DPD R-U-THERE (seq number 0x52fec0b7)
Jan 01 04:35:05 [IKEv1 DEBUG]: Group = 172.16.2.5, IP = 172.16.2.5, 
constructing blank hash payload
Jan 01 04:35:05 [IKEv1 DEBUG]: Group = 172.16.2.5, IP = 172.16.2.5, 
constructing qm hash payload
Jan 01 04:35:05 [IKEv1]: IP = 172.16.2.5, IKE_DECODE SENDING Message 
(msgid=e3dd9a55) with payloads: HDR + HASH (8) + NOTIFY (11) 
+ NONE (0) total length : 80
Jan 01 04:35:05 [IKEv1]: IP = 172.16.2.5, IKE_DECODE RECEIVED 
Message (msgid=1f40840c) with payloads : HDR + HASH (8) + NOTIFY (11) + 
NONE (0) total length : 80
Jan 01 04:35:05 [IKEv1 DEBUG]: Group = 172.16.2.5, IP = 172.16.2.5, 
processing hash payload
Jan 01 04:35:05 [IKEv1 DEBUG]: Group = 172.16.2.5, IP = 172.16.2.5, 
processing notify payload
Jan 01 04:35:05 [IKEv1 DEBUG]: Group = 172.16.2.5, IP = 172.16.2.5, 
Received keep-alive of type DPD
R-U-THERE-ACK (seq number 0x52fec0b7)
Jan 01 04:35:15 [IKEv1 DEBUG]: Group = 172.16.2.5, IP = 172.16.2.5, 
Sending keep-alive of type DPD R-U-THERE (seq number 0x52fec0b8)
Jan 01 04:35:15 [IKEv1 DEBUG]: Group = 172.16.2.5, IP = 172.16.2.5, 
constructing blank hash payload
Jan 01 04:35:15 [IKEv1 DEBUG]: Group = 172.16.2.5, IP = 172.16.2.5, 
constructing qm hash payload
Jan 01 04:35:15 [IKEv1]: IP = 172.16.2.5, IKE_DECODE SENDING Message 
(msgid=928bbc7f) with payloads: HDR + HASH (8) + NOTIFY (11) + NONE (0) 
total length : 80
Jan 01 04:35:15 [IKEv1]: IP = 172.16.2.5, IKE_DECODE RECEIVED Message 
(msgid=b4745eeb) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) 
total length : 80
Jan 01 04:35:15 [IKEv1 DEBUG]: Group = 172.16.2.5, IP = 172.16.2.5, 
processing hash payload
Jan 01 04:35:15 [IKEv1 DEBUG]: Group = 172.16.2.5, IP = 172.16.2.5, 
processing notify payload
Jan 01 04:35:15 [IKEv1 DEBUG]: Group = 172.16.2.5, IP = 172.16.2.5, 
Received keep-alive of type DPD
R-U-THERE-ACK (seq number 0x52fec0b8)

IPSec del debug crypto — Información del debug de las visualizaciones sobre las conexiones del IPSec.

debug crypto ipsec
pix1#debug crypto ipsec 7

IPSEC: New embryonic SA created @ 0x01AEAB40,
    SCB: 0x028CF0C8,
    Direction: inbound
    SPI      : 0xEFFE8E91
    Session ID: 0x00000009
    VPIF num  : 0x00000002
    Tunnel type: l2l
    Protocol   : esp
    Lifetime   : 240 seconds
IPSEC: New embryonic SA created @ 0x028F27E0,
    SCB: 0x02842188,
    Direction: outbound
    SPI      : 0xEB62E7B0
    Session ID: 0x00000009
    VPIF num  : 0x00000002
    Tunnel type: l2l
    Protocol   : esp
    Lifetime   : 240 seconds
IPSEC: Completed host OBSA update, SPI 0xEB62E7B0
IPSEC: Updating outbound VPN context 0x00076B84, SPI 0xEB62E7B0
    Flags: 0x00000005
    SA   : 0x028F27E0
    SPI  : 0xEB62E7B0
    MTU  : 1500 bytes
    VCID : 0x00000000
    Peer : 0x00000000
    SCB  : 0x02842188
    Channel: 0x01693DE8
IPSEC: Completed outbound VPN context, SPI 0xEB62E7B0
    VPN handle: 0x00076B84
IPSEC: Completed outbound inner rule, SPI 0xEB62E7B0
    Rule ID: 0x026AAAF0
IPSEC: New outbound permit rule, SPI 0xEB62E7B0

!--- Tunnel endpoints

    Src addr: 172.16.1.2
    Src mask: 255.255.255.255
    Dst addr: 172.16.2.5
    Dst mask: 255.255.255.255
    Src ports
      Upper: 0
      Lower: 0
      Op   : ignore
    Dst ports
      Upper: 0
      Lower: 0
      Op   : ignore
    Protocol: 50
    Use protocol: true
    SPI: 0xEB62E7B0
    Use SPI: true
IPSEC: Completed outbound permit rule, SPI 0xEB62E7B0
    Rule ID: 0x028A45F8
IPSEC: Completed host IBSA update, SPI 0xEFFE8E91
IPSEC: Creating inbound VPN context, SPI 0xEFFE8E91
    Flags: 0x00000006
    SA   : 0x01AEAB40
    SPI  : 0xEFFE8E91
    MTU  : 0 bytes
    VCID : 0x00000000
    Peer : 0x00076B84
    SCB  : 0x028CF0C8
    Channel: 0x01693DE8
IPSEC: Completed inbound VPN context, SPI 0xEFFE8E91
    VPN handle: 0x0007801C
IPSEC: Updating outbound VPN context 0x00076B84, SPI 0xEB62E7B0
    Flags: 0x00000005
    SA   : 0x028F27E0
    SPI  : 0xEB62E7B0
    MTU  : 1500 bytes
    VCID : 0x00000000
    Peer : 0x0007801C
    SCB  : 0x02842188
    Channel: 0x01693DE8
IPSEC: Completed outbound VPN context, SPI 0xEB62E7B0
    VPN handle: 0x00076B84
IPSEC: Completed outbound inner rule, SPI 0xEB62E7B0
    Rule ID: 0x026AAAF0
IPSEC: Completed outbound outer SPD rule, SPI 0xEB62E7B0
    Rule ID: 0x028A45F8
IPSEC: New inbound tunnel flow rule, SPI 0xEFFE8E91

!--- IPsec session by inside interface

    Src addr: 10.6.6.0
    Src mask: 255.255.255.0
    Dst addr: 10.2.2.0
    Dst mask: 255.255.255.0
    Src ports
      Upper: 0
      Lower: 0
      Op   : ignore
    Dst ports
      Upper: 0
      Lower: 0
      Op   : ignore
    Protocol: 0
    Use protocol: false
    SPI: 0x00000000
    Use SPI: false
IPSEC: Completed inbound tunnel flow rule, SPI 0xEFFE8E91
    Rule ID: 0x01A88838
IPSEC: New inbound decrypt rule, SPI 0xEFFE8E91
    Src addr: 172.16.2.5
    Src mask: 255.255.255.255
    Dst addr: 172.16.1.2
    Dst mask: 255.255.255.255
    Src ports
      Upper: 0
      Lower: 0
      Op   : ignore
    Dst ports
      Upper: 0
      Lower: 0
      Op   : ignore
    Protocol: 50
    Use protocol: true
    SPI: 0xEFFE8E91
    Use SPI: true
IPSEC: Completed inbound decrypt rule, SPI 0xEFFE8E91
    Rule ID: 0x028F2710
IPSEC: New inbound permit rule, SPI 0xEFFE8E91
    Src addr: 172.16.2.5
    Src mask: 255.255.255.255
    Dst addr: 172.16.1.2
    Dst mask: 255.255.255.255
    Src ports
      Upper: 0
      Lower: 0
      Op   : ignore
    Dst ports
      Upper: 0
      Lower: 0
      Op   : ignore
    Protocol: 50
    Use protocol: true
    SPI: 0xEFFE8E91
    Use SPI: true
IPSEC: Completed inbound permit rule, SPI 0xEFFE8E91
    Rule ID: 0x028F3F70
IPSEC: New embryonic SA created @ 0x01AFA2E8,
    SCB: 0x028F4318,
    Direction: inbound
    SPI      : 0x9E53EEA4
    Session ID: 0x00000009
    VPIF num  : 0x00000002
    Tunnel type: l2l
    Protocol   : esp
    Lifetime   : 240 seconds
IPSEC: New embryonic SA created @ 0x0281FEA8,
    SCB: 0x01AFA6C0,
    Direction: outbound
    SPI      : 0x430107DD
    Session ID: 0x00000009
    VPIF num  : 0x00000002
    Tunnel type: l2l
    Protocol   : esp
    Lifetime   : 240 seconds
IPSEC: Completed host OBSA update, SPI 0x430107DD
IPSEC: Updating outbound VPN context 0x0007DB1C, SPI 0x430107DD
    Flags: 0x00000005
    SA   : 0x0281FEA8
    SPI  : 0x430107DD
    MTU  : 1500 bytes
    VCID : 0x00000000
    Peer : 0x00000000
    SCB  : 0x01AFA6C0
    Channel: 0x01693DE8
IPSEC: Completed outbound VPN context, SPI 0x430107DD
    VPN handle: 0x0007DB1C
IPSEC: Completed outbound inner rule, SPI 0x430107DD
    Rule ID: 0x028FA880
IPSEC: New outbound permit rule, SPI 0x430107DD
    Src addr: 172.16.1.2
    Src mask: 255.255.255.255
    Dst addr: 172.16.2.5
    Dst mask: 255.255.255.255
    Src ports
      Upper: 0
      Lower: 0
      Op   : ignore
    Dst ports
      Upper: 0
      Lower: 0
      Op   : ignore
    Protocol: 50
    Use protocol: true
    SPI: 0x430107DD
    Use SPI: true
IPSEC: Completed outbound permit rule, SPI 0x430107DD
    Rule ID: 0x028055B0
IPSEC: Completed host IBSA update, SPI 0x9E53EEA4
IPSEC: Creating inbound VPN context, SPI 0x9E53EEA4
    Flags: 0x00000006
    SA   : 0x01AFA2E8
    SPI  : 0x9E53EEA4
    MTU  : 0 bytes
    VCID : 0x00000000
    Peer : 0x0007DB1C
    SCB  : 0x028F4318
    Channel: 0x01693DE8
IPSEC: Completed inbound VPN context, SPI 0x9E53EEA4
    VPN handle: 0x000813D4
IPSEC: Updating outbound VPN context 0x0007DB1C, SPI 0x430107DD
    Flags: 0x00000005
    SA   : 0x0281FEA8
    SPI  : 0x430107DD
    MTU  : 1500 bytes
    VCID : 0x00000000
    Peer : 0x000813D4
    SCB  : 0x01AFA6C0
    Channel: 0x01693DE8
IPSEC: Completed outbound VPN context, SPI 0x430107DD
    VPN handle: 0x0007DB1C
IPSEC: Completed outbound inner rule, SPI 0x430107DD
    Rule ID: 0x028FA880
IPSEC: Completed outbound outer SPD rule, SPI 0x430107DD
    Rule ID: 0x028055B0
IPSEC: New inbound tunnel flow rule, SPI 0x9E53EEA4

!--- IPsec session by DMZ interface

    Src addr: 10.6.6.0
    Src mask: 255.255.255.0
    Dst addr: 10.3.3.0
    Dst mask: 255.255.255.0
    Src ports
      Upper: 0
      Lower: 0
      Op   : ignore
    Dst ports
      Upper: 0
      Lower: 0
      Op   : ignore
    Protocol: 0
    Use protocol: false
    SPI: 0x00000000
    Use SPI: false
IPSEC: Completed inbound tunnel flow rule, SPI 0x9E53EEA4
    Rule ID: 0x02850040
IPSEC: New inbound decrypt rule, SPI 0x9E53EEA4
    Src addr: 172.16.2.5
    Src mask: 255.255.255.255
    Dst addr: 172.16.1.2
    Dst mask: 255.255.255.255
    Src ports
      Upper: 0
      Lower: 0
      Op   : ignore
    Dst ports
      Upper: 0
      Lower: 0
      Op   : ignore
    Protocol: 50
    Use protocol: true
    SPI: 0x9E53EEA4
    Use SPI: true
IPSEC: Completed inbound decrypt rule, SPI 0x9E53EEA4
    Rule ID: 0x0284ACF8
IPSEC: New inbound permit rule, SPI 0x9E53EEA4
    Src addr: 172.16.2.5
    Src mask: 255.255.255.255
    Dst addr: 172.16.1.2
    Dst mask: 255.255.255.255
    Src ports
      Upper: 0
      Lower: 0
      Op   : ignore
    Dst ports
      Upper: 0
      Lower: 0
      Op   : ignore
    Protocol: 50
    Use protocol: true
    SPI: 0x9E53EEA4
    Use SPI: true
IPSEC: Completed inbound permit rule, SPI 0x9E53EEA4
    Rule ID: 0x0281FDA8

Borre las asociaciones de seguridad (los SA)

par 10.6.6.6 del clear crypto ipsec sa — Borra todo el SA de IPSec a un par según lo identificado por el nombre del host específicado o la dirección IP.

borre isakmp sa — Quita todas las bases de datos tiempo de ejecución SA IKE.


Información Relacionada


Document ID: 69385