로컬 확장 인증을 사용하여 Windows용 Cisco VPN Client 3.x를 IOS로 구성

다운로드 옵션

PDF (370.6 KB)
다양한 디바이스에서 Adobe Reader로 보기
ePub (296.4 KB)
iPhone, iPad, Android, Sony Reader 또는 Windows Phone의 다양한 앱에서 보기
Mobi (Kindle) (672.9 KB)
Kindle 디바이스에서 보기 또는 다양한 디바이스의 Kindle 앱에서 보기

업데이트:2004년 5월 3일

문서 ID:20621

편견 없는 언어

본 제품에 대한 문서 세트는 편견 없는 언어를 사용하기 위해 노력합니다. 본 설명서 세트의 목적상, 편견 없는 언어는 나이, 장애, 성별, 인종 정체성, 민족 정체성, 성적 지향성, 사회 경제적 지위 및 교차성에 기초한 차별을 의미하지 않는 언어로 정의됩니다. 제품 소프트웨어의 사용자 인터페이스에서 하드코딩된 언어, RFP 설명서에 기초한 언어 또는 참조된 서드파티 제품에서 사용하는 언어로 인해 설명서에 예외가 있을 수 있습니다. 시스코에서 어떤 방식으로 포용적인 언어를 사용하고 있는지 자세히 알아보세요.

이 번역에 관하여

Cisco는 전 세계 사용자에게 다양한 언어로 지원 콘텐츠를 제공하기 위해 기계 번역 기술과 수작업 번역을 병행하여 이 문서를 번역했습니다. 아무리 품질이 높은 기계 번역이라도 전문 번역가의 번역 결과물만큼 정확하지는 않습니다. Cisco Systems, Inc.는 이 같은 번역에 대해 어떠한 책임도 지지 않으며 항상 원본 영문 문서(링크 제공됨)를 참조할 것을 권장합니다.

소개

이 문서에서는 로컬 확장 인증을 사용하는 라우터와 Cisco VPN 클라이언트 간의 연결을 구성하는 방법을 보여 줍니다. Cisco IOS^® Software 릴리스 12.2(15)T2 및 Cisco VPN Client 3.x에서 더 많은 지원 연결 VPN Client 3.x는 DH(Diffie Hellman) 그룹 2 정책을 사용합니다. isakmp policy # group 2 명령을 사용하면 3.x 클라이언트가 연결할 수 있습니다.

Cisco Secure VPN Client 1.1을 사용하여 이러한 디바이스를 구성하는 방법에 대한 자세한 내용은 로컬 확장 인증을 사용하여 Windows용 Cisco Secure VPN Client 1.1 구성을 참조하십시오.

TACACS+ 프로토콜을 사용하여 사용자 인증이 외부에서 발생하는 시나리오에 대한 자세한 내용은 IOS 라우터 간과 Cisco VPN Client 4.x for Windows의 TACACS+ 사용자 인증 컨피그레이션 예를 참조하십시오.

사용자 인증이 RADIUS 프로토콜에서 외부에서 발생하는 시나리오에 대한 자세한 내용은 Cisco IOS 라우터와 Windows용 Cisco VPN 클라이언트 4.x 간 IPSec 구성 사용자 인증을 참조하십시오.

시작하기 전에

표기 규칙

문서 규칙에 대한 자세한 내용은 Cisco 기술 팁 표기 규칙을 참조하십시오.

사전 요구 사항

이 컨피그레이션을 시도하기 전에 다음 전제 조건을 충족하는지 확인하십시오.

IPSec(IP Security)에 할당할 주소 풀
IOS 라우터의 로컬 사용자(cisco는 이름으로, cisco는 비밀번호로)
3000clients라는 그룹과 비밀번호 cisco123

사용되는 구성 요소

이 문서의 정보는 아래 소프트웨어 및 하드웨어 버전을 기반으로 합니다.

12.2(15)T2를 실행하는 3640 라우터
Windows 버전 3.5용 Cisco VPN Client(모든 VPN 클라이언트 3.x가 작동해야 함)

라우터의 show version 명령의 출력은 아래와 같습니다.

3640#show version
Cisco Internetwork Operating System Software 
IOS (tm) 3600 Software (C3640-JK9O3S-M), Version 12.2(15)T2, 
   RELEASE SOFTWARE (fc2)
TAC Support: http://www.cisco.com/tac
Copyright (c) 1986-2003 by cisco Systems, Inc.
Compiled Wed 30-Apr-03 05:42 by nmasa
Image text-base: 0x60008950, data-base: 0x6202E000

ROM: System Bootstrap, Version 11.1(20)AA2, 
   EARLY DEPLOYMENT RELEASE SOFTWARE (fc1)

3640 uptime is 21 hours, 29 minutes
System returned to ROM by reload
System image file is "flash:c3640-jk9o3s-mz.122-15.T2.bin"


This product contains cryptographic features and is 
subject to United States and local country laws governing 
import, export, transfer and use. Delivery of Cisco cryptographic 
products does not imply third-party authority to import, export, 
distribute or use encryption. Importers, exporters, distributors 
and users are responsible for compliance with U.S. and local 
country laws. By using this product you agree to comply with 
applicable laws and regulations. If you are unable to comply 
with U.S. and local laws, return this product immediately.

A summary of U.S. laws governing 
Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

If you require further assistance please contact us 
by sending email to export@cisco.com.

cisco 3640 (R4700) processor (revision 0x00) 
   with 126976K/4096K bytes of memory.
Processor board ID 22789386
R4700 CPU at 100Mhz, Implementation 33, Rev 1.0
Bridging software.
X.25 software, Version 3.0.0.
SuperLAT software (copyright 1990 by Meridian Technology Corp).
TN3270 Emulation software.
2 Ethernet/IEEE 802.3 interface(s)
4 Serial network interface(s)
DRAM configuration is 64 bits wide with parity disabled.
125K bytes of non-volatile configuration memory.
32768K bytes of processor board System flash (Read/Write)
16384K bytes of processor board PCMCIA Slot0 flash (Read/Write)

Configuration register is 0x102

3640#

이 문서의 정보는 특정 랩 환경의 디바이스를 토대로 작성되었습니다. 이 문서에 사용된 모든 디바이스는 초기화된(기본) 컨피그레이션으로 시작되었습니다. 라이브 네트워크에서 작업하는 경우, 사용하기 전에 모든 명령의 잠재적인 영향을 이해해야 합니다.

구성

이 섹션에는 이 문서에서 설명하는 기능을 구성하기 위한 정보가 표시됩니다.

참고: 이 문서에 사용된 명령에 대한 추가 정보를 찾으려면 명령 조회 도구(등록된 고객만 해당)를 사용합니다.

네트워크 다이어그램

이 문서에서는 아래 다이어그램에 표시된 네트워크 설정을 사용합니다.

구성

이 문서에서는 아래 표시된 구성을 사용합니다.

3640 라우터 구성
VPN 클라이언트 3.x 구성

3640 라우터 구성

3640 라우터
3640#show run Building configuration... Current configuration : 1884 bytes ! version 12.2 service timestamps debug uptime service timestamps log uptime no service password-encryption ! hostname 3640 ! !--- Enable Authentication, Authorizing and Accounting (AAA) !--- for user authentication and group authorization. aaa new-model ! !--- To enable X-Auth for user authentication, !--- enable the aaa authentication* commands.* aaa authentication login userauthen local !--- To enable group authorization, !--- enable the aaa authorization* commands.* aaa authorization network groupauthor local ! !--- For local authentication of the IPSec user, !--- create the user with password. username cisco password 0 cisco ! ip subnet-zero ! ! ! ip audit notify log ip audit po max-events 100 ! !--- Create an Internet Security Association and !--- Key Management Protocol (ISAKMP) policy for Phase 1 negotiations. crypto isakmp policy 3 encr 3des authentication pre-share group 2 ! !--- Create a group that will be used to specify the !--- Windows Internet Naming Service (WINS) and !--- Domain Naming Service (DNS) server addresses to the client, !--- along with the pre-shared key for authentication. crypto isakmp client configuration group 3000client key cisco123 dns 14.1.1.10 wins 14.1.1.20 domain cisco.com pool ippool ! !--- Create the Phase 2 Policy for actual data encryption. crypto ipsec transform-set myset esp-3des esp-sha-hmac ! !--- Create a dynamic map and !--- apply the transform set that was created above. crypto dynamic-map dynmap 10 set transform-set myset ! !--- Create the actual crypto map, !--- and apply the aaa lists that were created earlier. crypto map clientmap client authentication list userauthen crypto map clientmap isakmp authorization list groupauthor crypto map clientmap client configuration address respond crypto map clientmap 10 ipsec-isakmp dynamic dynmap ! ! fax interface-type fax-mail mta receive maximum-recipients 0 ! ! ! !--- Apply the crypto map on the outside interface. interface Ethernet0/0 ip address 172.18.124.159 255.255.255.0 half-duplex crypto map clientmap ! interface Serial0/0 no ip address shutdown ! interface Ethernet0/1 ip address 14.38.100.201 255.255.0.0 no keepalive half-duplex ! interface Serial1/0 no ip address shutdown ! interface Serial1/1 no ip address shutdown ! interface Serial1/2 no ip address shutdown ! interface Serial1/3 no ip address shutdown ! interface Serial1/4 no ip address shutdown ! interface Serial1/5 no ip address shutdown ! interface Serial1/6 no ip address shutdown ! interface Serial1/7 no ip address shutdown ! !--- Create a pool of addresses to be assigned to the VPN Clients. ip local pool ippool 14.1.1.100 14.1.1.200 ip classless ip route 0.0.0.0 0.0.0.0 172.18.124.1 ip http server ip pim bidir-enable ! ! ! ! call rsvp-sync ! ! mgcp profile default ! dial-peer cor custom ! ! ! ! ! line con 0 exec-timeout 0 0 line aux 0 line vty 0 4 ! ! end 3640#

3640 라우터

3640#show run
Building configuration...

Current configuration : 1884 bytes
!
version 12.2
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname 3640
!

!--- Enable Authentication, Authorizing and Accounting (AAA) !--- for user authentication and group authorization.

aaa new-model
!

!--- To enable X-Auth for user authentication, !--- enable the aaa authentication commands.

aaa authentication login userauthen local


!--- To enable group authorization, !--- enable the aaa authorization commands.

aaa authorization network groupauthor local
!

!--- For local authentication of the IPSec user, !--- create the user with password.

username cisco password 0 cisco
!
ip subnet-zero
!
!
!
ip audit notify log
ip audit po max-events 100
!

!--- Create an Internet Security Association and !--- Key Management Protocol (ISAKMP) policy for Phase 1 negotiations.

crypto isakmp policy 3
encr 3des
authentication pre-share
group 2
!

!--- Create a group that will be used to specify the !--- Windows Internet Naming Service (WINS) and !--- Domain Naming Service (DNS) server addresses to the client, !--- along with the pre-shared key for authentication.

crypto isakmp client configuration group 3000client
key cisco123
dns 14.1.1.10
wins 14.1.1.20
domain cisco.com
pool ippool
!

!--- Create the Phase 2 Policy for actual data encryption.

crypto ipsec transform-set myset esp-3des esp-sha-hmac
!

!--- Create a dynamic map and !--- apply the transform set that was created above.

crypto dynamic-map dynmap 10
set transform-set myset
!

!--- Create the actual crypto map, !--- and apply the aaa lists that were created earlier.

crypto map clientmap client authentication list userauthen
crypto map clientmap isakmp authorization list groupauthor
crypto map clientmap client configuration address respond
crypto map clientmap 10 ipsec-isakmp dynamic dynmap
!
!
fax interface-type fax-mail
mta receive maximum-recipients 0
!
!
!

!--- Apply the crypto map on the outside interface.

interface Ethernet0/0
 ip address 172.18.124.159 255.255.255.0
 half-duplex
 crypto map clientmap
!
interface Serial0/0
 no ip address
 shutdown
!
interface Ethernet0/1
 ip address 14.38.100.201 255.255.0.0
 no keepalive
 half-duplex
!
interface Serial1/0
 no ip address
 shutdown
!
interface Serial1/1
 no ip address
 shutdown
!
interface Serial1/2
 no ip address
 shutdown
!
interface Serial1/3
 no ip address
 shutdown
!
interface Serial1/4
 no ip address
 shutdown
!
interface Serial1/5
 no ip address
 shutdown
!
interface Serial1/6
 no ip address
 shutdown
!
interface Serial1/7
 no ip address
 shutdown
!

!--- Create a pool of addresses to be assigned to the VPN Clients.

ip local pool ippool 14.1.1.100 14.1.1.200
ip classless
ip route 0.0.0.0 0.0.0.0 172.18.124.1
ip http server
ip pim bidir-enable
!
!
!
!
call rsvp-sync
!
!
mgcp profile default
!
dial-peer cor custom
!
!
!
!
!
line con 0
 exec-timeout 0 0
line aux 0
line vty 0 4
!
!
end

3640#

VPN 클라이언트 3.x 구성

이 섹션에서는 VPN 클라이언트 3.x를 구성하는 방법을 보여줍니다.

VPN Client를 시작한 다음 New(새로 만들기)를 클릭하여 새 연결을 생성합니다.
프롬프트가 표시되면 항목에 이름을 할당합니다. 원하는 경우 설명을 입력할 수도 있습니다. 완료되면 Next(다음)를 클릭합니다.
라우터의 공용 인터페이스의 IP 주소를 입력합니다. 완료되면 Next(다음)를 클릭합니다.
Group Access Information(그룹 액세스 정보)에서 그룹 이름과 비밀번호를 입력합니다. 아래 예는 이름이 "3000client"이고 비밀번호가 "cisco123"인 그룹을 보여줍니다. 비밀번호를 확인한 다음 다음을 클릭하여 계속합니다.
마침을 클릭하여 레지스트리에 프로파일을 저장합니다.
Connect(연결)를 클릭하여 라우터에 연결합니다. 창에 "보안 프로필 협상" 및 "링크가 이제 안전해졌습니다."라는 메시지가 표시됩니다.

스플릿 터널링 활성화

VPN 연결에 대해 스플릿 터널링을 활성화하려면 라우터에 액세스 목록이 구성되어 있는지 확인합니다. 아래 예에서 access-list 108 명령은 스플릿 터널링을 위해 그룹과 연결되며 터널은 14.38.X.X/16 네트워크로 구성됩니다. 트래픽은 액세스 목록 108(예: 인터넷)에 없는 디바이스로 암호화되지 않은 상태로 이동합니다.

access-list 108 permit ip 14.38.0.0 0.0.255.255 
   14.1.1.0 0.0.0.255

그런 다음 그룹 속성에 액세스 목록을 적용합니다.

crypto isakmp client configuration group 3000client
 key cisco123
 dns 14.38.100.10
 wins 14.38.100.20
 domain cisco.com
 pool ippool
acl 108

다음을 확인합니다.

이 섹션에서는 컨피그레이션이 제대로 작동하는지 확인하는 데 사용할 수 있는 정보를 제공합니다.

일부 show 명령은 출력 인터프리터 툴 에서 지원되는데(등록된 고객만), 이 툴을 사용하면 show 명령 출력의 분석 결과를 볼 수 있습니다.

3640#show crypto isakmp sa
dst             src             state     conn-id    slot 
172.18.124.159  172.18.124.96   QM_IDLE         3       0

3640#show crypto ipsec sa
interface: Ethernet0/0
Crypto map tag: clientmap, local addr. 172.18.124.96

protected vrf: 
local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
remote ident (addr/mask/prot/port): 
   (14.1.1.106/255.255.255.255/0/0)
current_peer: 172.18.124.159:500
PERMIT, flags={}
#pkts encaps: 6, #pkts encrypt: 6, #pkts digest 6
#pkts decaps: 6, #pkts decrypt: 6, #pkts verify 6
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0

local crypto endpt.: 172.18.124.96, 
   remote crypto endpt.: 172.18.124.159
path mtu 1500, media mtu 1500
current outbound spi: D026E0BA

inbound esp sas:
spi: 0x84E901C8(2229862856)
transform: esp-3des esp-md5-hmac ,
in use settings ={Tunnel, }
slot: 0, conn id: 2002, flow_id: 3, crypto map: clientmap
sa timing: remaining key lifetime (k/sec): (4450694/3532)
IV size: 8 bytes
replay detection support: Y

inbound ah sas:

inbound pcp sas:

outbound esp sas:
spi: 0xD026E0BA(3492208826)
transform: esp-3des esp-md5-hmac ,
in use settings ={Tunnel, }
slot: 0, conn id: 2003, flow_id: 4, crypto map: clientmap
sa timing: remaining key lifetime (k/sec): (4450699/3532)
IV size: 8 bytes
replay detection support: Y

outbound ah sas:

outbound pcp sas:

protected vrf: 
local ident (addr/mask/prot/port): 
   (172.18.124.159/255.255.255.255/0/0)
remote ident (addr/mask/prot/port): 
   (14.1.1.105/255.255.255.255/0/0)
current_peer: 172.18.124.159:500
PERMIT, flags={}
#pkts encaps: 6, #pkts encrypt: 6, #pkts digest 6
#pkts decaps: 6, #pkts decrypt: 6, #pkts verify 6
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0

local crypto endpt.: 172.18.124.159, 
   remote crypto endpt.: 172.18.124.96
path mtu 1500, media mtu 1500
current outbound spi: E8E398F8

inbound esp sas:
spi: 0xDFE24DFC(3756150268)
transform: esp-3des esp-md5-hmac ,
in use settings ={Tunnel, }
slot: 0, conn id: 2000, flow_id: 1, crypto map: clientmap
sa timing: remaining key lifetime (k/sec): (4572253/3530)
IV size: 8 bytes
replay detection support: Y

inbound ah sas:

inbound pcp sas:

outbound esp sas:
spi: 0xE8E398F8(3907229944)
transform: esp-3des esp-md5-hmac ,
in use settings ={Tunnel, }
slot: 0, conn id: 2001, flow_id: 2, crypto map: clientmap
sa timing: remaining key lifetime (k/sec): (4572253/3528)
IV size: 8 bytes
replay detection support: Y

outbound ah sas:

outbound pcp sas:

3640#show crypto engine connections active

  ID Interface    IP-Address      State  Algorithm          Encrypt Decrypt 
   3 Ethernet0/0  172.18.124.159  set    HMAC_MD5+3DES_56_C       0       0 
2000 Ethernet0/0  172.18.124.159  set    HMAC_MD5+3DES_56_C       0       6 
2001 Ethernet0/0  172.18.124.159  set    HMAC_MD5+3DES_56_C       6       0 
2004 Ethernet0/0  172.18.124.159  set    HMAC_MD5+3DES_56_C       0       6 
2005 Ethernet0/0  172.18.124.159  set    HMAC_MD5+3DES_56_C       6       0

문제 해결

이 섹션에서는 컨피그레이션 문제를 해결하는 데 사용할 수 있는 정보를 제공합니다.

3640#debug crypto ipsec 
Crypto IPSEC debugging is on 
3640#debug crypto isakmp 
Crypto ISAKMP debugging is on 
3640# 

ISAKMP (0:0): received packet from 172.18.124.96 
   dport 500 sport 500 Global (N) NEW SA 
ISAKMP: Found a peer struct for 172.18.124.96, peer port 500 
ISAKMP: Locking peer struct 0x63B2EAE4, IKE refcount 1 for 
   crypto_ikmp_config_initialize_sa 
ISAKMP (0:0): (Re)Setting client xauth list and state 
ISAKMP: local port 500, remote port 500 
ISAKMP: insert sa successfully sa = 63972310 
ISAKMP (0:1): processing SA payload. message ID = 0 
ISAKMP (0:1): processing ID payload. message ID = 0 
ISAKMP (0:1): peer matches *none* of the profiles 
ISAKMP (0:1): processing vendor id payload 
ISAKMP (0:1): vendor ID seems Unity/DPD but major 215 mismatch 
ISAKMP (0:1): vendor ID is XAUTH 
ISAKMP (0:1): processing vendor id payload 
ISAKMP (0:1): vendor ID is DPD 
ISAKMP (0:1): processing vendor id payload 
ISAKMP (0:1): vendor ID seems Unity/DPD but major 123 mismatch 
ISAKMP (0:1): vendor ID is NAT-T v2 
ISAKMP (0:1): processing vendor id payload 
ISAKMP (0:1): vendor ID seems Unity/DPD but major 194 mismatch 
ISAKMP (0:1): processing vendor id payload 
ISAKMP (0:1): vendor ID is Unity 
ISAKMP (0:1) Authentication by xauth preshared 
ISAKMP (0:1): Checking ISAKMP transform 1 against priority 1 policy 
ISAKMP: encryption AES-CBC 
ISAKMP: hash SHA 
ISAKMP: default group 2 
ISAKMP: auth XAUTHInitPreShared 
ISAKMP: life type in seconds 
ISAKMP: life duration (VPI) of 0x0 0x20 0xC4 0x9B 
ISAKMP: keylength of 256 
ISAKMP (0:1): Encryption algorithm offered does not match policy! 
ISAKMP (0:1): atts are not acceptable. Next payload is 3 
ISAKMP (0:1): Checking ISAKMP transform 2 against priority 1 policy 
ISAKMP: encryption AES-CBC 
ISAKMP: hash MD5 
ISAKMP: default group 2 
ISAKMP: auth XAUTHInitPreShared 
ISAKMP: life type in seconds 
ISAKMP: life duration (VPI) of 0x0 0x20 0xC4 0x9B 
ISAKMP: keylength of 256 
ISAKMP (0:1): Encryption algorithm offered does not match policy! 
ISAKMP (0:1): atts are not acceptable. Next payload is 3 
ISAKMP (0:1): Checking ISAKMP transform 3 against priority 1 policy 
ISAKMP: encryption AES-CBC 
ISAKMP: hash SHA 
ISAKMP: default group 2 
ISAKMP: auth pre-share 
ISAKMP: life type in seconds 
ISAKMP: life duration (VPI) of 0x0 0x20 0xC4 0x9B 
ISAKMP: keylength of 256 
ISAKMP (0:1): Encryption algorithm offered does not match policy! 
ISAKMP (0:1): atts are not acceptable. Next payload is 3 
ISAKMP (0:1): Checking ISAKMP transform 4 against priority 1 policy 
ISAKMP: encryption AES-CBC 
ISAKMP: hash MD5 
ISAKMP: default group 2 
ISAKMP: auth pre-share 
ISAKMP: life type in seconds 
ISAKMP: life duration (VPI) of 0x0 0x20 0xC4 0x9B 
ISAKMP: keylength of 256 
ISAKMP (0:1): Encryh of 128 
ISAKMP (0:1): Encryption algorithm offered does not match policy! 
ISAKMP (0:1): atts are not acceptable. Next payload is 3 
ISAKMP (0:1): Checking ISAKMP transform 7 against priority 1 policy 
ISAKMP: encryption AES-CBC 
ISAKMP: hash SHA 
ISAKMP: default group 2 
ISAKMP: auth pre-share 
ISAKMP: life type in seconds 
ISAKMP: life duration (VPI) of 0x0 0x20 0xC4 0x9B 
ISAKMP: keylength of 128ption algorithm offered does not 
ISAKMP (0:1): Encryption algorithm offered does not match policy! 
ISAKMP (0:1): atts are not acceptable. Next payload is 3 
ISAKMP (0:1): Checking ISAKMP transform 8 against priority 1 policy 
ISAKMP: encryption AES-CBC 
ISAKMP: hash MD5 
ISAKMP: default group 2 
ISAKMP: auth pre-share 
ISAKMP: life type in seconds 
ISAKMP: life duration (VPI) of 0x0 0x20 0xC4 0x9B 
ISAKMP: keylength of 128 
ISAKMP (0:1): Encryption algorithm offered does not match policy! 
ISAKMP (0:1): atts are not acceptable. Next payload is 3 
ISAKMP (0:1): Checking ISAKMP transform 9 against priority 1 policy 
ISAKMP: encryption 3DES-CBC 
ISAKMP: hash SHA match policy! 
ISAKMP (0:1): atts are not acceptable. Next payload is 3 
ISAKMP (0:1): Checking ISAKMP transform 5 against priority 1 policy 
ISAKMP: encryption AES-CBC 
ISAKMP: hash SHA 
ISAKMP: default group 2 
ISAKMP: auth XAUTHInitPreShared 
ISAKMP: life type in seconds 
ISAKMP: life duration (VPI) of 0x0 0x20 0xC4 0x9B 
ISAKMP: keylength of 128 
ISAKMP (0:1): Encryption algorithm offered does not match policy! 
ISAKMP (0:1): atts are not acceptable. Next payload is 3 
ISAKMP (0:1): Checking ISAKMP transform 6 against priority 1 policy 
ISAKMP: encryption AES-CBC 
ISAKMP: hash MD5 
ISAKMP: default group 2 
ISAKMP: auth XAUTHInitPreShared 
ISAKMP: life type in seconds 
ISAKMP: life duration (VPI) of 0x0 0x20 0xC4 0x9B 
ISAKMP: keylengt 
ISAKMP: default group 2 
ISAKMP: auth XAUTHInitPreShared 
ISAKMP: life type in seconds 
ISAKMP: life duration (VPI) of 0x0 0x20 0xC4 0x9B 
ISAKMP (0:1): Encryption algorithm offered does not match policy! 
ISAKMP (0:1): atts are not acceptable. Next payload is 3 
ISAKMP (0:1): Checking ISAKMP transform 10 against priority 1 policy 
ISAKMP: encryption 3DES-CBC 
ISAKMP: hash MD5 
ISAKMP: default group 2 
ISAKMP: auth XAUTHInitPreShared 
ISAKMP: life type in seconds 
ISAKMP: life duration (VPI) of 0x0 0x20 0xC4 0x9B 
ISAKMP (0:1): Encryption algorithm offered does not match policy! 
ISAKMP (0:1): atts are not acceptable. Next payload is 3 
ISAKMP (0:1): Checking ISAKMP transform 11 against priority 1 policy 
ISAKMP: encryption 3DES-CBC 
ISAKMP: hash SHA 
ISAKMP: default group 2 
ISAKMP: auth pre-share 
ISAKMP: life type in seconds 
ISAKMP: life duration (VPI) of 0x0 0x20 0xC4 0x9B 
ISAKMP (0:1): Encryption algorithm offered does not match policy! 
ISAKMP (0:1): atts are not acceptable. Next payload is 3 
ISAKMP (0:1): Checking ISAKMP transform 12 against priority 1 policy 
ISAKMP: encryption 3DES-CBC 
ISAKMP: hash MD5 
ISAKMP: default group 2 
ISAKMP: auth pre-share 
ISAKMP: life type in seconds 
ISAKMP: life duration (VPI) of 0x0 0x20 0xC4 0x9B 
ISAKMP (0:1): Encryption algorithm offered does not match policy! 
ISAKMP (0:1): atts are not acceptable. Next payload is 3 
ISAKMP (0:1): Checking ISAKMP transform 13 against priority 1 policy 
ISAKMP: encryption DES-CBC 
ISAKMP: hash MD5 
ISAKMP: default group 2 
ISAKMP: auth XAUTHInitPreShared 
ISAKMP: life type in seconds 
ISAKMP: life duration (VPI) of 0x0 0x20 0xC4 0x9B 
ISAKMP (0:1): atts are acceptable. Next payload is 3 
ISAKMP (0:1): processing KE payload. message ID = 0 
ISAKMP (0:1): processing NONCE payload. message ID = 0 
ISAKMP (0:1): vendor ID is NAT-T v2 
ISAKMP (0:1): Input = IKE_MESG_FROM_PEER, IKE_AM_EXCH 
ISAKMP (0:1): Old State = IKE_READY New State = IKE_R_AM_AAA_AWAIT 
ISAKMP: got callback 1 
ISAKMP (0:1): SKEYID state generated 
ISAKMP (0:1): constructed NAT-T vendor-02 ID 
ISAKMP (0:1): SA is doing pre-shared key authentication 
   plus XAUTH using id type ID_IPV4_ADDR 
ISAKMP (1): ID payload 
next-payload : 10 
type : 1 
addr : 172.18.124.159 
protocol : 17 
port : 0 
length : 8 
ISAKMP (1): Total payload length: 12 
ISAKMP (0:1): constructed HIS NAT-D 
ISAKMP (0:1): constructed MINE NAT-D 
ISAKMP (0:1): sending packet to 172.18.124.96 my_port 500 
   peer_port 500 (R) AG_INIT_EXCH 
ISAKMP (0:1): Input = IKE_MESG_FROM_AAA, PRESHARED_KEY_REPLY 
ISAKMP (0:1): Old State = IKE_R_AM_AAA_AWAIT New State = IKE_R_AM2 
ISAKMP (0:1): received packet from 172.18.124.96 dport 500 
   sport 500 Global (R) AG_INIT_EXCH 
ISAKMP (0:1): processing HASH payload. message ID = 0 
ISAKMP (0:1): processing NOTIFY INITIAL_CONTACT protocol 1 
spi 0, message ID = 0, sa = 63972310 
ISAKMP (0:1): Process initial contact, 
bring down existing phase 1 and 2 SA's with local 172.18.124.159 
   remote 172.18.124.96 remote port 500 
ISAKMP (0:1): returning IP addr to the address pool: 14.1.1.105 
ISAKMP (0:1): returning address 14.1.1.105 to pool 
ISAKMP:received payload type 17 
ISAKMP (0:1): Detected NAT-D payload 
ISAKMP (0:1): recalc my hash for NAT-D 
ISAKMP (0:1): NAT match MINE hash 
ISAKMP:received payload type 17 
ISAKMP (0:1): Detected NAT-D payload 
ISAKMP (0:1): recalc his hash for NAT-D 
ISAKMP (0:1): NAT match HIS hash 
ISAKMP (0:1): SA has been authenticated with 172.18.124.96 
ISAKMP: set new node 1397605141 to CONF_XAUTH 
ISAKMP (0:1): sending packet to 172.18.124.96 
   my_port 500 peer_port 500 (R) QM_IDLE 
ISAKMP (0:1): purging node 1397605141 
ISAKMP: Sending phase 1 responder lifetime 86400 
ISAKMP (0:1): peer matches *none* of the profiles 
ISAKMP (0:1): Input = IKE_MESG_FROM_PEER, IKE_AM_EXCH 
ISAKMP (0:1): Old State = IKE_R_AM2 New State = IKE_P1_COMPLETE 
IPSEC(key_engine): got a queue event... 
ISAKMP (0:1): Need XAUTH 
ISAKMP (0:1): Input = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE 
ISAKMP (0:1): Old State = IKE_P1_COMPLETE 
   New State = IKE_XAUTH_AAA_START_LOGIN_AWAIT 
ISAKMP: got callback 1 
ISAKMP: set new node 1446280258 to CONF_XAUTH 
ISAKMP/xauth: request attribute XAUTH_USER_NAME_V2 
ISAKMP/xauth: request attribute XAUTH_USER_PASSWORD_V2 
ISAKMP (0:1): initiating peer config to 172.18.124.96. ID = 1446280258 
ISAKMP (0:1): sending packet to 172.18.124.96 
   my_port 500 peer_port 500 (R) CONF_XAUTH 
ISAKMP (0:1): Input = IKE_MESG_FROM_AAA, IKE_AAA_START_LOGIN 
ISAKMP (0:1): Old State = IKE_XAUTH_AAA_START_LOGIN_AWAIT 
   New State = IKE_XAUTH_REQ_SENT 
ISAKMP (0:1): received packet from 172.18.124.96 dport 500 
   sport 500 Global (R) CONF_XAUTH 
ISAKMP (0:1): processing transaction payload from 172.18.124.96. 
   message ID = 1446280258 
ISAKMP: Config payload REPLY 
ISAKMP/xauth: reply attribute XAUTH_USER_NAME_V2 
ISAKMP/xauth: reply attribute XAUTH_USER_PASSWORD_V2 
ISAKMP (0:1): deleting node 1446280258 error FALSE 
   reason "done with xauth request/reply exchange" 
ISAKMP (0:1): Input = IKE_MESG_FROM_PEER, IKE_CFG_REPLY 
ISAKMP (0:1): Old State = IKE_XAUTH_REQ_SENT 
   New State = IKE_XAUTH_AAA_CONT_LOGIN_AWAIT 
ISAKMP: got callback 1 
ISAKMP: set new node 117774567 to CONF_XAUTH 
ISAKMP (0:1): initiating peer config to 172.18.124.96. 
   ID = 117774567 
ISAKMP (0:1): sending packet to 172.18.124.96 my_port 500 
   peer_port 500 (R) CONF_XAUTH 
ISAKMP (0:1): Input = IKE_MESG_FROM_AAA, IKE_AAA_CONT_LOGIN 
ISAKMP (0:1): Old State = IKE_XAUTH_AAA_CONT_LOGIN_AWAIT 
   New State = IKE_XAUTH_SET_SENT 
ISAKMP (0:1): received packet from 172.18.124.96 dport 500 
   sport 500 Global (R) CONF_XAUTH 
ISAKMP (0:1): processing transaction payload from 172.18.124.96. 
   message ID = 117774567 
ISAKMP: Config payload ACK 
ISAKMP (0:1): XAUTH ACK Processed 
ISAKMP (0:1): deleting node 117774567 error FALSE 
   reason "done with transaction" 
ISAKMP (0:1): Input = IKE_MESG_FROM_PEER, IKE_CFG_ACK 
ISAKMP (0:1): Old State = IKE_XAUTH_SET_SENT 
   New State = IKE_P1_COMPLETE 
ISAKMP (0:1): Input = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE 
ISAKMP (0:1): Old State = IKE_P1_COMPLETE 
   New State = IKE_P1_COMPLETE 
ISAKMP (0:1): received packet from 172.18.124.96 dport 500 
   sport 500 Global (R) QM_IDLE 
ISAKMP: set new node 188739171 to QM_IDLE 
ISAKMP (0:1): processing transaction payload from 172.18.124.96. 
   message ID = 188739171 
ISAKMP: Config payload REQUEST 
ISAKMP (0:1): checking request: 
ISAKMP: IP4_ADDRESS 
ISAKMP: IP4_NETMASK 
ISAKMP: IP4_DNS 
ISAKMP: IP4_NBNS 
ISAKMP: ADDRESS_EXPIRY 
ISAKMP: APPLICATION_VERSION 
ISAKMP: UNKNOWN Unknown Attr: 0x7000 
ISAKMP: UNKNOWN Unknown Attr: 0x7001 
ISAKMP: DEFAULT_DOMAIN 
ISAKMP: SPLIT_INCLUDE 
ISAKMP: UNKNOWN Unknown Attr: 0x7003 
ISAKMP: UNKNOWN Unknown Attr: 0x7007 
ISAKMP: UNKNOWN Unknown Attr: 0x7008 
ISAKMP: UNKNOWN Unknown Attr: 0x7009 
ISAKMP: UNKNOWN Unknown Attr: 0x700A 
ISAKMP: UNKNOWN Unknown Attr: 0x7005 
ISAKMP (0:1): Input = IKE_MESG_FROM_PEER, IKE_CFG_REQUEST 
ISAKMP (0:1): Old State = IKE_P1_COMPLETE 
   New State = IKE_CONFIG_AUTHOR_AAA_AWAIT 
ISAKMP: got callback 1 
ISAKMP (0:1): attributes sent in message: 
Address: 0.2.0.0 
ISAKMP (0:1): allocating address 14.1.1.106 
ISAKMP: Sending private address: 14.1.1.106 
ISAKMP: Sending IP4_DNS server address: 14.1.1.10 
ISAKMP: Sending IP4_NBNS server address: 14.1.1.20 
ISAKMP: Sending ADDRESS_EXPIRY seconds left to 
   use the address: 86396 
ISAKMP: Sending APPLICATION_VERSION string: Cisco 
   Internetwork Operating System Software 
IOS (tm) 3600 Software (C3640-JK9O3S-M), Version 12.2(15)T2, 
   RELEASE SOFTWARE (fc2) 
TAC Support: http://www.cisco.com/tac 
Copyright (c) 1986-2003 by cisco Systems, Inc. 
Compiled Wed 30-Apr-03 05:42 by nmasa 
ISAKMP (0/1): Unknown Attr: UNKNOWN (0x7000) 
ISAKMP (0/1): Unknown Attr: UNKNOWN (0x7001) 
ISAKMP: Sending DEFAULT_DOMAIN default domain name: cisco.com 
ISAKMP (0/1): Unknown Attr: UNKNOWN (0x7003) 
ISAKMP (0/1): Unknown Attr: UNKNOWN (0x7007) 
ISAKMP (0/1): Unknown Attr: UNKNOWN (0x7008) 
ISAKMP (0/1): Unknown Attr: UNKNOWN (0x7009) 
ISAKMP (0/1): Unknown Attr: UNKNOWN (0x700A) 
ISAKMP (0/1): Unknown Attr: UNKNOWN (0x7005) 
ISAKMP (0:1): responding to peer config from 172.18.124.96. 
   ID = 188739171 
ISAKMP (0:1): sending packet to 172.18.124.96 my_port 500 
   peer_port 500 (R) CONF_ADDR 
ISAKMP (0:1): deleting node 188739171 error FALSE reason "" 
ISAKMP (0:1): Input = IKE_MESG_FROM_AAA, IKE_AAA_GROUP_ATTR 
ISAKMP (0:1): Old State = IKE_CONFIG_AUTHOR_AAA_AWAIT 
   New State = IKE_P1_COMPLETE 
ISAKMP (0:1): received packet from 172.18.124.96 dport 500 
   sport 500 Global (R) QM_IDLE 
ISAKMP: set new node -1836135476 to QM_IDLE 
ISAKMP (0:1): processing HASH payload. message ID = -1836135476 
ISAKMP (0:1): processing SA payload. message ID = -1836135476 
ISAKMP (0:1): Checking IPSec proposal 1 
ISAKMP: transform 1, ESP_AES 
ISAKMP: attributes in transform: 
ISAKMP: authenticator is HMAC-MD5 
ISAKMP: encaps is 1 
ISAKMP: key length is 256 
ISAKMP: SA life type in seconds 
ISAKMP: SA life duration (VPI) of 0x0 0x20 0xC4 0x9B 
ISAKMP (0:1): atts are acceptable. 
ISAKMP (0:1): Checking IPSec proposal 1 
ISAKMP (0:1): transform 1, IPPCP LZS 
ISAKMP: attributes in transform: 
ISAKMP: encaps is 1 
ISAKMP: SA life type in seconds 
ISAKMP: SA life duration (VPI) of 0x0 0x20 0xC4 0x9B 
ISAKMP (0:1): atts are acceptable. 
IPSEC(validate_proposal_request): proposal part #1, 
(key eng. msg.) INBOUND local= 172.18.124.159, remote= 172.18.124.96, 
local_proxy= 172.18.124.159/255.255.255.255/0/0 (type=1), 
remote_proxy= 14.1.1.106/255.255.255.255/0/0 (type=1), 
protocol= ESP, transform= esp-aes 256 esp-md5-hmac , 
lifedur= 0s and 0kb, 
spi= 0x0(0), conn_id= 0, keysize= 256, flags= 0x2 
IPSEC(validate_proposal_request): proposal part #2, 
(key eng. msg.) INBOUND local= 172.18.124.159, remote= 172.18.124.96, 
local_proxy= 172.18.124.159/255.255.255.255/0/0 (type=1), 
remote_proxy= 14.1.1.106/255.255.255.255/0/0 (type=1), 
protocol= PCP, transform= comp-lzs , 
lifedur= 0s and 0kb, 
spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x2 
IPSEC(kei_proxy): head = clientmap, map->ivrf = , kei->ivrf = 
IPSEC(validate_transform_proposal): transform proposal 
   not supported for identity: 
{esp-aes 256 esp-md5-hmac comp-lzs } 
ISAKMP (0:1): IPSec policy invalidated proposal 
ISAKMP (0:1): Checking IPSec proposal 2 
ISAKMP: transform 1, ESP_AES 
ISAKMP: attributes in transform: 
ISAKMP: authenticator is HMAC-SHA 
ISAKMP: encaps is 1 
ISAKMP: key length is 256 
ISAKMP: SA life type in seconds 
ISAKMP: SA life duration (VPI) of 0x0 0x20 0xC4 0x9B 
ISAKMP (0:1): atts are acceptable. 
ISAKMP (0:1): Checking IPSec proposal 2 
ISAKMP (0:1): transform 1, IPPCP LZS 
ISAKMP: attributes in transform: 
ISAKMP: encaps is 1 
ISAKMP: SA life type in seconds 
ISAKMP: SA life duration (VPI) of 0x0 0x20 0xC4 0x9B 
ISAKMP (0:1): atts are acceptable. 
IPSEC(validate_proposal_request): proposal part #1, 
(key eng. msg.) INBOUND local= 172.18.124.159, remote= 172.18.124.96, 
local_proxy= 172.18.124.159/255.255.255.255/0/0 (type=1), 
remote_proxy= 14.1.1.106/255.255.255.255/0/0 (type=1), 
protocol= ESP, transform= esp-aes 256 esp-sha-hmac , 
lifedur= 0s and 0kb, 
spi= 0x0(0), conn_id= 0, keysize= 256, flags= 0x2 
IPSEC(validate_proposal_request): proposal part #2, 
(key eng. msg.) INBOUND local= 172.18.124.159, remote= 172.18.124.96, 
local_proxy= 172.18.124.159/255.255.255.255/0/0 (type=1), 
remote_proxy= 14.1.1.106/255.255.255.255/0/0 (type=1), 
protocol= PCP, transform= comp-lzs , 
lifedur= 0s and 0kb, 
spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x2 
IPSEC(kei_proxy): head = clientmap, map->ivrf = , kei->ivrf = 
IPSEC(validate_transform_proposal): transform proposal 
   not supported for identity: 
{esp-aes 256 esp-sha-hmac comp-lzs } 
ISAKMP (0:1): IPSec policy invalidated proposal 
ISAKMP (0:1): Checking IPSec proposal 3 
ISAKMP: transform 1, ESP_AES 
ISAKMP: attributes in transform: 
ISAKMP: authenticator is HMAC-MD5 
ISAKMP: encaps is 1 
ISAKMP: key length is 128 
ISAKMP: SA life type in seconds 
ISAKMP: SA life duration (VPI) of 0x0 0x20 0xC4 0x9B 
ISAKMP (0:1): atts are acceptable. 
ISAKMP (0:1): Checking IPSec proposal 3 
ISAKMP (0:1): transform 1, IPPCP LZS 
ISAKMP: attributes in transform: 
ISAKMP: encaps is 1 
ISAKMP: SA life type in seconds 
ISAKMP: SA life duration (VPI) of 0x0 0x20 0xC4 0x9B 
ISAKMP (0:1): atts are acceptable. 
IPSEC(validate_proposal_request): proposal part #1, 
(key eng. msg.) INBOUND local= 172.18.124.159, remote= 172.18.124.96, 
local_proxy= 172.18.124.159/255.255.255.255/0/0 (type=1), 
remote_proxy= 14.1.1.106/255.255.255.255/0/0 (type=1), 
protocol= ESP, transform= esp-aes esp-md5-hmac , 
lifedur= 0s and 0kb, 
spi= 0x0(0), conn_id= 0, keysize= 128, flags= 0x2 
IPSEC(validate_proposal_request): proposal part #2, 
(key eng. msg.) INBOUND local= 172.18.124.159, remote= 172.18.124.96, 
local_proxy= 172.18.124.159/255.255.255.255/0/0 (type=1), 
remote_proxy= 14.1.1.106/255.255.255.255/0/0 (type=1), 
protocol= PCP, transform= comp-lzs , 
lifedur= 0s and 0kb, 
spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x2 
IPSEC(kei_proxy): head = clientmap, map->ivrf = , kei->ivrf = 
IPSEC(validate_transform_proposal): transform proposal 
   not supported for identity: 
{esp-aes esp-md5-hmac comp-lzs } 
ISAKMP (0:1): IPSec policy invalidated proposal 
ISAKMP (0:1): Checking IPSec proposal 4 
ISAKMP: transform 1, ESP_AES 
ISAKMP: attributes in transform: 
ISAKMP: authenticator is HMAC-SHA 
ISAKMP: encaps is 1 
ISAKMP: key length is 128 
ISAKMP: SA life type in seconds 
ISAKMP: SA life duration (VPI) of 0x0 0x20 0xC4 0x9B 
ISAKMP (0:1): atts are acceptable. 
ISAKMP (0:1): Checking IPSec proposal 4 
ISAKMP (0:1): transform 1, IPPCP LZS 
ISAKMP: attributes in transform: 
ISAKMP: encaps is 1 
ISAKMP: SA life type in seconds 
ISAKMP: SA life duration (VPI) of 0x0 0x20 0xC4 0x9B 
ISAKMP (0:1): atts are acceptable. 
IPSEC(validate_proposal_request): proposal part #1, 
(key eng. msg.) INBOUND local= 172.18.124.159, remote= 172.18.124.96, 
local_proxy= 172.18.124.159/255.255.255.255/0/0 (type=1), 
remote_proxy= 14.1.1.106/255.255.255.255/0/0 (type=1), 
protocol= ESP, transform= esp-aes esp-sha-hmac , 
lifedur= 0s and 0kb, 
spi= 0x0(0), conn_id= 0, keysize= 128, flags= 0x2 
IPSEC(validate_proposal_request): proposal part #2, 
(key eng. msg.) INBOUND local= 172.18.124.159, remote= 172.18.124.96, 
local_proxy= 172.18.124.159/255.255.255.255/0/0 (type=1), 
remote_proxy= 14.1.1.106/255.255.255.255/0/0 (type=1), 
protocol= PCP, transform= comp-lzs , 
lifedur= 0s and 0kb, 
spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x2 
IPSEC(kei_proxy): head = clientmap, map->ivrf = , kei->ivrf = 
IPSEC(validate_transform_proposal): transform proposal 
   not supported for identity: 
{esp-aes esp-sha-hmac comp-lzs } 
ISAKMP (0:1): IPSec policy invalidated proposal 
ISAKMP (0:1): Checking IPSec proposal 5 
ISAKMP: transform 1, ESP_AES 
ISAKMP: attributes in transform: 
ISAKMP: authenticator is HMAC-MD5 
ISAKMP: encaps is 1 
ISAKMP: key length is 256 
ISAKMP: SA life type in seconds 
ISAKMP: SA life duration (VPI) of 0x0 0x20 0xC4 0x9B 
ISAKMP (0:1): atts are acceptable. 
IPSEC(validate_proposal_request): proposal part #1, 
(key eng. msg.) INBOUND local= 172.18.124.159, remote= 172.18.124.96, 
local_proxy= 172.18.124.159/255.255.255.255/0/0 (type=1), 
remote_proxy= 14.1.1.106/255.255.255.255/0/0 (type=1), 
protocol= ESP, transform= esp-aes 256 esp-md5-hmac , 
lifedur= 0s and 0kb, 
spi= 0x0(0), conn_id= 0, keysize= 256, flags= 0x2 
IPSEC(kei_proxy): head = clientmap, map->ivrf = , kei->ivrf = 
IPSEC(validate_transform_proposal): transform proposal 
   not supported for identity: 
{esp-aes 256 esp-md5-hmac } 
ISAKMP (0:1): IPSec policy invalidated proposal 
ISAKMP (0:1): Checking IPSec proposal 6 
ISAKMP: transform 1, ESP_AES 
ISAKMP: attributes in transform: 
ISAKMP: authenticator is HMAC-SHA 
ISAKMP: encaps is 1 
ISAKMP: key length is 256 
ISAKMP: SA life type in seconds 
ISAKMP: SA life duration (VPI) of 0x0 0x20 0xC4 0x9B 
ISAKMP (0:1): atts are acceptable. 
IPSEC(validate_proposal_request): proposal part #1, 
(key eng. msg.) INBOUND local= 172.18.124.159, remote= 172.18.124.96, 
local_proxy= 172.18.124.159/255.255.255.255/0/0 (type=1), 
remote_proxy= 14.1.1.106/255.255.255.255/0/0 (type=1), 
protocol= ESP, transform= esp-aes 256 esp-sha-hmac , 
lifedur= 0s and 0kb, 
spi= 0x0(0), conn_id= 0, keysize= 256, flags= 0x2 
IPSEC(kei_proxy): head = clientmap, map->ivrf = , kei->ivrf = 
IPSEC(validate_transform_proposal): transform proposal 
   not supported for identity: 
{esp-aes 256 esp-sha-hmac } 
ISAKMP (0:1): IPSec policy invalidated proposal 
ISAKMP (0:1): Checking IPSec proposal 7 
ISAKMP: transform 1, ESP_AES 
ISAKMP: attributes in transform: 
ISAKMP: authenticator is HMAC-MD5 
ISAKMP: encaps is 1 
ISAKMP: key length is 128 
ISAKMP: SA life type in seconds 
ISAKMP: SA life duration (VPI) of 0x0 0x20 0xC4 0x9B 
ISAKMP (0:1): atts are acceptable. 
IPSEC(validate_proposal_request): proposal part #1, 
(key eng. msg.) INBOUND local= 172.18.124.159, remote= 172.18.124.96, 
local_proxy= 172.18.124.159/255.255.255.255/0/0 (type=1), 
remote_proxy= 14.1.1.106/255.255.255.255/0/0 (type=1), 
protocol= ESP, transform= esp-aes esp-md5-hmac , 
lifedur= 0s and 0kb, 
spi= 0x0(0), conn_id= 0, keysize= 128, flags= 0x2 
IPSEC(kei_proxy): head = clientmap, map->ivrf = , kei->ivrf = 
IPSEC(validate_transform_proposal): transform proposal 
   not supported for identity: 
{esp-aes esp-md5-hmac } 
ISAKMP (0:1): IPSec policy invalidated proposal 
ISAKMP (0:1): Checking IPSec proposal 8 
ISAKMP: transform 1, ESP_AES 
ISAKMP: attributes in transform: 
ISAKMP: authenticator is HMAC-SHA 
ISAKMP: encaps is 1 
ISAKMP: key length is 128 
ISAKMP: SA life type in seconds 
ISAKMP: SA life duration (VPI) of 0x0 0x20 0xC4 0x9B 
ISAKMP (0:1): atts are acceptable. 
IPSEC(validate_proposal_request): proposal part #1, 
(key eng. msg.) INBOUND local= 172.18.124.159, remote= 172.18.124.96, 
local_proxy= 172.18.124.159/255.255.255.255/0/0 (type=1), 
remote_proxy= 14.1.1.106/255.255.255.255/0/0 (type=1), 
protocol= ESP, transform= esp-aes esp-sha-hmac , 
lifedur= 0s and 0kb, 
spi= 0x0(0), conn_id= 0, keysize= 128, flags= 0x2 
IPSEC(kei_proxy): head = clientmap, map->ivrf = , kei->ivrf = 
IPSEC(validate_transform_proposal): transform proposal 
   not supported for identity: 
{esp-aes esp-sha-hmac } 
ISAKMP (0:1): IPSec policy invalidated proposal 
ISAKMP (0:1): Checking IPSec proposal 9 
ISAKMP: transform 1, ESP_3DES 
ISAKMP: attributes in transform: 
ISAKMP: authenticator is HMAC-MD5 
ISAKMP: encaps is 1 
ISAKMP: SA life type in seconds 
ISAKMP: SA life duration (VPI) of 0x0 0x20 0xC4 0x9B 
ISAKMP (0:1): atts are acceptable. 
ISAKMP (0:1): Checking IPSec proposal 9 
ISAKMP (0:1): transform 1, IPPCP LZS 
ISAKMP: attributes in transform: 
ISAKMP: encaps is 1 
ISAKMP: SA life type in seconds 
ISAKMP: SA life duration (VPI) of 0x0 0x20 0xC4 0x9B 
ISAKMP (0:1): atts are acceptable. 
IPSEC(validate_proposal_request): proposal part #1, 
(key eng. msg.) INBOUND local= 172.18.124.159, remote= 172.18.124.96, 
local_proxy= 172.18.124.159/255.255.255.255/0/0 (type=1), 
remote_proxy= 14.1.1.106/255.255.255.255/0/0 (type=1), 
protocol= ESP, transform= esp-3des esp-md5-hmac , 
lifedur= 0s and 0kb, 
spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x2 
IPSEC(validate_proposal_request): proposal part #2, 
(key eng. msg.) INBOUND local= 172.18.124.159, remote= 172.18.124.96, 
local_proxy= 172.18.124.159/255.255.255.255/0/0 (type=1), 
remote_proxy= 14.1.1.106/255.255.255.255/0/0 (type=1), 
protocol= PCP, transform= comp-lzs , 
lifedur= 0s and 0kb, 
spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x2 
IPSEC(kei_proxy): head = clientmap, map->ivrf = , kei->ivrf = 
IPSEC(validate_transform_proposal): transform proposal 
   not supported for identity: 
{esp-3des esp-md5-hmac comp-lzs } 
ISAKMP (0:1): IPSec policy invalidated proposal 
ISAKMP (0:1): Checking IPSec proposal 10 
ISAKMP: transform 1, ESP_3DES 
ISAKMP: attributes in transform: 
ISAKMP: authenticator is HMAC-SHA 
ISAKMP: encaps is 1 
ISAKMP: SA life type in seconds 
ISAKMP: SA life duration (VPI) of 0x0 0x20 0xC4 0x9B 
ISAKMP (0:1): atts are acceptable. 
ISAKMP (0:1): Checking IPSec proposal 10 
ISAKMP (0:1): transform 1, IPPCP LZS 
ISAKMP: attributes in transform: 
ISAKMP: encaps is 1 
ISAKMP: SA life type in seconds 
ISAKMP: SA life duration (VPI) of 0x0 0x20 0xC4 0x9B 
ISAKMP (0:1): atts are acceptable. 
IPSEC(validate_proposal_request): proposal part #1, 
(key eng. msg.) INBOUND local= 172.18.124.159, remote= 172.18.124.96, 
local_proxy= 172.18.124.159/255.255.255.255/0/0 (type=1), 
remote_proxy= 14.1.1.106/255.255.255.255/0/0 (type=1), 
protocol= ESP, transform= esp-3des esp-sha-hmac , 
lifedur= 0s and 0kb, 
spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x2 
IPSEC(validate_proposal_request): proposal part #2, 
(key eng. msg.) INBOUND local= 172.18.124.159, remote= 172.18.124.96, 
local_proxy= 172.18.124.159/255.255.255.255/0/0 (type=1), 
remote_proxy= 14.1.1.106/255.255.255.255/0/0 (type=1), 
protocol= PCP, transform= comp-lzs , 
lifedur= 0s and 0kb, 
spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x2 
IPSEC(kei_proxy): head = clientmap, map->ivrf = , kei->ivrf = 
IPSEC(validate_transform_proposal): transform proposal 
   not supported for identity: 
{esp-3des esp-sha-hmac comp-lzs } 
ISAKMP (0:1): IPSec policy invalidated proposal 
ISAKMP (0:1): Checking IPSec proposal 11 
ISAKMP: transform 1, ESP_3DES 
ISAKMP: attributes in transform: 
ISAKMP: authenticator is HMAC-MD5 
ISAKMP: encaps is 1 
ISAKMP: SA life type in seconds 
ISAKMP: SA life duration (VPI) of 0x0 0x20 0xC4 0x9B 
ISAKMP (0:1): atts are acceptable. 
IPSEC(validate_proposal_request): proposal part #1, 
(key eng. msg.) INBOUND local= 172.18.124.159, remote= 172.18.124.96, 
local_proxy= 172.18.124.159/255.255.255.255/0/0 (type=1), 
remote_proxy= 14.1.1.106/255.255.255.255/0/0 (type=1), 
protocol= ESP, transform= esp-3des esp-md5-hmac , 
lifedur= 0s and 0kb, 
spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x2 
IPSEC(kei_proxy): head = clientmap, map->ivrf = , kei->ivrf = 
ISAKMP (0:1): processing NONCE payload. message ID = -1836135476 
ISAKMP (0:1): processing ID payload. message ID = -1836135476 
ISAKMP (0:1): processing ID payload. message ID = -1836135476 
ISAKMP (0:1): asking for 1 spis from ipsec 
ISAKMP (0:1): Node -1836135476, Input = IKE_MESG_FROM_PEER, 
   IKE_QM_EXCH 
ISAKMP (0:1): Old State = IKE_QM_READY 
   New State = IKE_QM_SPI_STARVE 
ISAKMP (0:1): received packet from 172.18.124.96 dport 500 
   sport 500 Global (R) QM_IDLE 
ISAKMP: set new node -1171731793 to QM_IDLE 
ISAKMP (0:1): processing HASH payload. message ID = -1171731793 
ISAKMP (0:1): processing SA payload. message ID = -1171731793 
ISAKMP (0:1): Checking IPSec proposal 1 
ISAKMP: transform 1, ESP_AES 
ISAKMP: attributes in transform: 
ISAKMP: authenticator is HMAC-MD5 
ISAKMP: encaps is 1 
ISAKMP: key length is 256 
ISAKMP: SA life type in seconds 
ISAKMP: SA life duration (VPI) of 0x0 0x20 0xC4 0x9B 
ISAKMP (0:1): atts are acceptable. 
ISAKMP (0:1): Checking IPSec proposal 1 
ISAKMP (0:1): transform 1, IPPCP LZS 
ISAKMP: attributes in transform: 
ISAKMP: encaps is 1 
ISAKMP: SA life type in seconds 
ISAKMP: SA life duration (VPI) of 0x0 0x20 0xC4 0x9B 
ISAKMP (0:1): atts are acceptable. 
IPSEC(validate_proposal_request): proposal part #1, 
(key eng. msg.) INBOUND local= 172.18.124.159, remote= 172.18.124.96, 
local_proxy= 0.0.0.0/0.0.0.0/0/0 (type=4), 
remote_proxy= 14.1.1.106/255.255.255.255/0/0 (type=1), 
protocol= ESP, transform= esp-aes 256 esp-md5-hmac , 
lifedur= 0s and 0kb, 
spi= 0x0(0), conn_id= 0, keysize= 256, flags= 0x2 
IPSEC(validate_proposal_request): proposal part #2, 
(key eng. msg.) INBOUND local= 172.18.124.159, remote= 172.18.124.96, 
local_proxy= 0.0.0.0/0.0.0.0/0/0 (type=4), 
remote_proxy= 14.1.1.106/255.255.255.255/0/0 (type=1), 
protocol= PCP, transform= comp-lzs , 
lifedur= 0s and 0kb, 
spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x2 
IPSEC(kei_proxy): head = clientmap, map->ivrf = , kei->ivrf = 
IPSEC(validate_transform_proposal): transform proposal 
   not supported for identity: 
{esp-aes 256 esp-md5-hmac comp-lzs } 
ISAKMP (0:1): IPSec policy invalidated proposal 
ISAKMP (0:1): Checking IPSec proposal 2 
ISAKMP: transform 1, ESP_AES 
ISAKMP: attributes in transform: 
ISAKMP: authenticator is HMAC-SHA 
ISAKMP: encaps is 1 
ISAKMP: key length is 256 
ISAKMP: SA life type in seconds 
ISAKMP: SA life duration (VPI) of 0x0 0x20 0xC4 0x9B 
ISAKMP (0:1): atts are acceptable. 
ISAKMP (0:1): Checking IPSec proposal 2 
ISAKMP (0:1): transform 1, IPPCP LZS 
ISAKMP: attributes in transform: 
ISAKMP: encaps is 1 
ISAKMP: SA life type in seconds 
ISAKMP: SA life duration (VPI) of 0x0 0x20 0xC4 0x9B 
ISAKMP (0:1): atts are acceptable. 
IPSEC(validate_proposal_request): proposal part #1, 
(key eng. msg.) INBOUND local= 172.18.124.159, remote= 172.18.124.96, 
local_proxy= 0.0.0.0/0.0.0.0/0/0 (type=4), 
remote_proxy= 14.1.1.106/255.255.255.255/0/0 (type=1), 
protocol= ESP, transform= esp-aes 256 esp-sha-hmac , 
lifedur= 0s and 0kb, 
spi= 0x0(0), conn_id= 0, keysize= 256, flags= 0x2 
IPSEC(validate_proposal_request): proposal part #2, 
(key eng. msg.) INBOUND local= 172.18.124.159, remote= 172.18.124.96, 
local_proxy= 0.0.0.0/0.0.0.0/0/0 (type=4), 
remote_proxy= 14.1.1.106/255.255.255.255/0/0 (type=1), 
protocol= PCP, transform= comp-lzs , 
lifedur= 0s and 0kb, 
spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x2 
IPSEC(kei_proxy): head = clientmap, map->ivrf = , kei->ivrf = 
IPSEC(validate_transform_proposal): transform proposal 
   not supported for identity: 
{esp-aes 256 esp-sha-hmac comp-lzs } 
ISAKMP (0:1): IPSec policy invalidated proposal 
ISAKMP (0:1): Checking IPSec proposal 3 
ISAKMP: transform 1, ESP_AES 
ISAKMP: attributes in transform: 
ISAKMP: authenticator is HMAC-MD5 
ISAKMP: encaps is 1 
ISAKMP: key length is 128 
ISAKMP: SA life type in seconds 
ISAKMP: SA life duration (VPI) of 0x0 0x20 0xC4 0x9B 
ISAKMP (0:1): atts are acceptable. 
ISAKMP (0:1): Checking IPSec proposal 3 
ISAKMP (0:1): transform 1, IPPCP LZS 
ISAKMP: attributes in transform: 
ISAKMP: encaps is 1 
ISAKMP: SA life type in seconds 
ISAKMP: SA life duration (VPI) of 0x0 0x20 0xC4 0x9B 
ISAKMP (0:1): atts are acceptable. 
IPSEC(validate_proposal_request): proposal part #1, 
(key eng. msg.) INBOUND local= 172.18.124.159, remote= 172.18.124.96, 
local_proxy= 0.0.0.0/0.0.0.0/0/0 (type=4), 
remote_proxy= 14.1.1.106/255.255.255.255/0/0 (type=1), 
protocol= ESP, transform= esp-aes esp-md5-hmac , 
lifedur= 0s and 0kb, 
spi= 0x0(0), conn_id= 0, keysize= 128, flags= 0x2 
IPSEC(validate_proposal_request): proposal part #2, 
(key eng. msg.) INBOUND local= 172.18.124.159, remote= 172.18.124.96, 
local_proxy= 0.0.0.0/0.0.0.0/0/0 (type=4), 
remote_proxy= 14.1.1.106/255.255.255.255/0/0 (type=1), 
protocol= PCP, transform= comp-lzs , 
lifedur= 0s and 0kb, 
spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x2 
IPSEC(kei_proxy): head = clientmap, map->ivrf = , kei->ivrf = 
IPSEC(validate_transform_proposal): transform proposal 
   not supported for identity: 
{esp-aes esp-md5-hmac comp-lzs } 
ISAKMP (0:1): IPSec policy invalidated proposal 
ISAKMP (0:1): Checking IPSec proposal 4 
ISAKMP: transform 1, ESP_AES 
ISAKMP: attributes in transform: 
ISAKMP: authenticator is HMAC-SHA 
ISAKMP: encaps is 1 
ISAKMP: key length is 128 
ISAKMP: SA life type in seconds 
ISAKMP: SA life duration (VPI) of 0x0 0x20 0xC4 0x9B 
ISAKMP (0:1): atts are acceptable. 
ISAKMP (0:1): Checking IPSec proposal 4 
ISAKMP (0:1): transform 1, IPPCP LZS 
ISAKMP: attributes in transform: 
ISAKMP: encaps is 1 
ISAKMP: SA life type in seconds 
ISAKMP: SA life duration (VPI) of 0x0 0x20 0xC4 0x9B 
ISAKMP (0:1): atts are acceptable. 
IPSEC(validate_proposal_request): proposal part #1, 
(key eng. msg.) INBOUND local= 172.18.124.159, remote= 172.18.124.96, 
local_proxy= 0.0.0.0/0.0.0.0/0/0 (type=4), 
remote_proxy= 14.1.1.106/255.255.255.255/0/0 (type=1), 
protocol= ESP, transform= esp-aes esp-sha-hmac , 
lifedur= 0s and 0kb, 
spi= 0x0(0), conn_id= 0, keysize= 128, flags= 0x2 
IPSEC(validate_proposal_request): proposal part #2, 
(key eng. msg.) INBOUND local= 172.18.124.159, remote= 172.18.124.96, 
local_proxy= 0.0.0.0/0.0.0.0/0/0 (type=4), 
remote_proxy= 14.1.1.106/255.255.255.255/0/0 (type=1), 
protocol= PCP, transform= comp-lzs , 
lifedur= 0s and 0kb, 
spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x2 
IPSEC(kei_proxy): head = clientmap, map->ivrf = , kei->ivrf = 
IPSEC(validate_transform_proposal): transform proposal 
   not supported for identity: 
{esp-aes esp-sha-hmac comp-lzs } 
ISAKMP (0:1): IPSec policy invalidated proposal 
ISAKMP (0:1): Checking IPSec proposal 5 
ISAKMP: transform 1, ESP_AES 
ISAKMP: attributes in transform: 
ISAKMP: authenticator is HMAC-MD5 
ISAKMP: encaps is 1 
ISAKMP: key length is 256 
ISAKMP: SA life type in seconds 
ISAKMP: SA life duration (VPI) of 0x0 0x20 0xC4 0x9B 
ISAKMP (0:1): processing ID payload. message ID = -1171731793 
ISAKMP (0:1): processing ID payload. message ID = -1171731793 
ISAKMP (0:1): asking for 1 spis from ipsec 
ISAKMP (0:1): Node -1171731793, Input = IKE_MESG_FROM_PEER, 
   IKE_QM_EXCH 
ISAKMP (0:1): Old State = IKE_QM_READY 
   New State = IKE_QM_SPI_STARVE 
IPSEC(key_engine): got a queue event... 
IPSEC(spi_response): getting spi 3756150268 for SA 
from 172.18.124.159 to 172.18.124.96 for prot 3 
IPSEC(key_engine): got a queue event... 
IPSEC(spi_response): getting spi 2229862856 for SA 
from 172.18.124.159 to 172.18.124.96 for prot 3 
ISAKMP: received ke message (2/1) 
ISAKMP: received ke message (2/1) 
ISAKMP (0:1): sending packet to 172.18.124.96 my_port 500 
   peer_port 500 (R) QM_IDLE 
ISAKMP (0:1): Node -1836135476, Input = IKE_MESG_FROM_IPSEC, 
   IKE_SPI_REPLY 
ISAKMP (0:1): Old State = IKE_QM_SPI_STARVE 
   New State = IKE_QM_R_QM2 
ISAKMP (0:1): received packet from 172.18.124.96 dport 500 
   sport 500 Global (R) QM_IDLE 
ISAKMP: Locking peer struct 0x63B2EAE4, 
   IPSEC refcount 1 for for stuff_ke 
ISAKMP (0:1): Creating IPSec SAs 
inbound SA from 172.18.124.96 to 172.18.124.159 (f/i) 0/ 0 
(proxy 14.1.1.106 to 172.18.124.159) 
has spi 0xDFE24DFC and conn_id 2000 and flags 2 
lifetime of 2147483 seconds 
has client flags 0x0 
ISAKMP (0:1): Old State = IKE_QM_SPI_STARVE 
   New State = IKE_QM_R_QM2 
ISAKMP (0:1): received packet from 172.18.124.96 dport 500 
   sport 500 Global (R) QM_IDLE 
ISAKMP: Locking peer struct 0x63B2EAE4, 
   IPSEC refcount 2 for for stuff_ke 
ISAKMP (0:1): Creating IPSec SAs 
inbound SA from 172.18.124.96 to 172.18.124.159 (f/i) 0/ 0 
(proxy 14.1.1.106 to 0.0.0.0) 
has spi 0x84E901C8 and conn_id 2002 and flags 2 
lifetime of 2147483 seconds 
has client flags 0x0 
outbound SA from 172.18.124.159 to 172.18.124.96 (f/i) 0/ 0 
   (proxy 0.0.0.0 to 14.1.1.106 ) 
has spi -802758470 and conn_id 2003 and flags A 
IPSEC(add mtree): src 0.0.0.0, dest 14.1.1.106, dest_port 0 
IPSEC(create_sa): sa created, 
(sa) sa_dest= 172.18.124.159, sa_prot= 50, 
sa_spi= 0x84E901C8(2229862856), 
sa_trans= esp-3des esp-md5-hmac , sa_conn_id= 2002 
IPSEC(create_sa): sa created, 
(sa) sa_dest= 172.18.124.96, sa_prot= 50, 
sa_spi= 0xD026E0BA(3492208826), 
sa_trans= esp-3des esp-md5-hmac , sa_conn_id= 2003 
ISAKMP (0:1): received packet from 172.18.124.96 dport 500 
   sport 500 Global (R) QM_IDLE 
ISAKMP: set new node 839140381 to QM_IDLE 
ISAKMP (0:1): processing HASH payload. message ID = 839140381 
ISAKMP (0:1): processing NOTIFY R_U_THERE protocol 1 
spi 0, message ID = 839140381, sa = 63972310 
ISAKMP (0:1): deleting node 839140381 error FALSE 
   reason "informational (in) state 1" 
ISAKMP (0:1): Input = IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY 
ISAKMP (0:1): Old State = IKE_P1_COMPLETE 
   New State = IKE_P1_COMPLETE 
ISAKMP (0:1): DPD/R_U_THERE received from peer 172.18.124.96, 
   sequence 0xA5A4632A 
ISAKMP: set new node 760238809 to QM_IDLE 
ISAKMP (0:1): sending packet to 172.18.124.96 my_port 500 
   peer_port 500 (R) QM_IDLE 
ISAKMP (0:1): purging node 760238809 
ISAKMP (0:1): Input = IKE_MESG_FROM_PEER, 
   IKE_MESG_KEEP_ALIVE 
ISAKMP (0:1): Old State = IKE_P1_COMPLETE 
   New State = IKE_P1_COMPLETE 
ISAKMP (0:1): purging node 188739171 
ISAKMP (0:1): purging node -1836135476 
ISAKMP (0:1): purging node -1171731793 
3640#

클라이언트 로그

로그를 보려면 VPN 클라이언트에서 LogViewer를 시작하고 구성된 모든 클래스에 대해 필터가 High로 설정되어 있는지 확인합니다. 샘플 로그 출력이 아래에 나와 있습니다.

1      10:24:17.492  02/26/02  Sev=Info/6       DIALER/0x63300002 
Initiating connection. 

2      10:24:17.492  02/26/02  Sev=Info/4       CM/0x63100002 
Begin connection process 

3      10:24:17.512  02/26/02  Sev=Info/4       CM/0x63100004 
Establish secure connection using Ethernet 

4      10:24:17.512  02/26/02  Sev=Info/4       CM/0x63100026 
Attempt connection with server "172.18.124.159" 

5      10:24:17.512  02/26/02  Sev=Info/6       IKE/0x6300003B 
Attempting to establish a connection with 172.18.124.159. 

6      10:24:17.562  02/26/02  Sev=Info/4       IKE/0x63000013 
SENDING >>> ISAKMP OAK AG (SA, KE, NON, ID, VID, VID, VID) 
to 172.18.124.159 

7      10:24:17.962  02/26/02  Sev=Info/4       IPSEC/0x63700014 
Deleted all keys 

8      10:24:18.223  02/26/02  Sev=Info/5       IKE/0x6300002F 
Received ISAKMP packet: peer = 172.18.124.159 

9      10:24:18.223  02/26/02  Sev=Info/4       IKE/0x63000014 
RECEIVING <<< ISAKMP OAK AG (SA, VID, VID, VID, VID, KE, 
ID, NON, HASH) from$ 

10     10:24:18.223  02/26/02  Sev=Info/5       IKE/0x63000059 
Vendor ID payload = 12F5F28C457168A9702D9FE274CC0100 

11     10:24:18.223  02/26/02  Sev=Info/5       IKE/0x63000001 
Peer is a Cisco-Unity compliant peer 

12     10:24:18.223  02/26/02  Sev=Info/5       IKE/0x63000059 
Vendor ID payload = AFCAD71368A1F1C96B8696FC77570100 

13     10:24:18.223  02/26/02  Sev=Info/5       IKE/0x63000001 
Peer supports DPD 

14     10:24:18.223  02/26/02  Sev=Info/5       IKE/0x63000059 
Vendor ID payload = 4C72E0B594C3C20DFCB7F4419CCEB0BE 

15     10:24:18.223  02/26/02  Sev=Info/5       IKE/0x63000059 
Vendor ID payload = 09002689DFD6B712 

16     10:24:18.263  02/26/02  Sev=Info/4       IKE/0x63000013 
SENDING >>> ISAKMP OAK AG *(HASH, NOTIFY:STATUS_INITIAL_CONTACT) 
to 172.18.1$ 

17     10:24:18.283  02/26/02  Sev=Info/5       IKE/0x6300002F 
Received ISAKMP packet: peer = 172.18.124.159 

18     10:24:18.283  02/26/02  Sev=Info/4       IKE/0x63000014 
RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:STATUS_RESP_LIFETIME) 
from 172.$ 

19     10:24:18.283  02/26/02  Sev=Info/5       IKE/0x63000044 
RESPONDER-LIFETIME notify has value of 86400 seconds 

20     10:24:18.283  02/26/02  Sev=Info/5       IKE/0x63000046 
This SA has already been alive for 1 seconds, setting expiry to 86399 second$ 

21     10:24:18.303  02/26/02  Sev=Info/5       IKE/0x6300002F 
Received ISAKMP packet: peer = 172.18.124.159 

22     10:24:18.303  02/26/02  Sev=Info/4       IKE/0x63000014 
RECEIVING <<< ISAKMP OAK TRANS *(HASH, ATTR) from 172.18.124.159 

23     10:24:18.303  02/26/02  Sev=Info/4       CM/0x63100015 
Launch xAuth application 

24     10:24:20.546  02/26/02  Sev=Info/4       CM/0x63100017 
xAuth application returned 

25     10:24:20.546  02/26/02  Sev=Info/4       IKE/0x63000013 
SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to 172.18.124.159 

26     10:24:20.566  02/26/02  Sev=Info/5       IKE/0x6300002F 
Received ISAKMP packet: peer = 172.18.124.159 

27     10:24:20.566  02/26/02  Sev=Info/4       IKE/0x63000014 
RECEIVING <<< ISAKMP OAK TRANS *(HASH, ATTR) from 172.18.124.159 

28     10:24:20.566  02/26/02  Sev=Info/4       CM/0x6310000E 
Established Phase 1 SA.  1 Phase 1 SA in the system 

29     10:24:20.576  02/26/02  Sev=Info/4       IKE/0x63000013 
SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to 172.18.124.159 

30     10:24:20.586  02/26/02  Sev=Info/4       IKE/0x63000013 
SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to 172.18.124.159 

31     10:24:20.636  02/26/02  Sev=Info/5       IKE/0x6300002F 
Received ISAKMP packet: peer = 172.18.124.159 

32     10:24:20.636  02/26/02  Sev=Info/4       IKE/0x63000014 
RECEIVING <<< ISAKMP OAK TRANS *(HASH, ATTR) from 172.18.124.159 

33     10:24:20.636  02/26/02  Sev=Info/5       IKE/0x63000010 
MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_ADDRESS: , value = 14.1.1.102 

34     10:24:20.636  02/26/02  Sev=Info/5       IKE/0x63000010 
MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_DNS(1): , value = 14.38.100.10 

35     10:24:20.636  02/26/02  Sev=Info/5       IKE/0x63000010 
MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_NBNS(1) (a.k.a. WINS) : , value = $ 

36     10:24:20.636  02/26/02  Sev=Info/5       IKE/0xA3000017 
MODE_CFG_REPLY: The received (INTERNAL_ADDRESS_EXPIRY) attribute and value ($ 

37     10:24:20.636  02/26/02  Sev=Info/5       IKE/0x6300000E 
MODE_CFG_REPLY: Attribute = APPLICATION_VERSION, value = Cisco Internetwork $ 
IOS (tm) C2600 Software (C2600-JK9O3S-M), Version 12.2(8)T,  RELEASE SOFTWAR$ 
TAC Support: http://www.cisco.com/tac 
Copyright (c) 1986-2002 by cisco Systems, Inc. 
Compiled Thu 14-Feb-02 16:50 by ccai 

38     10:24:20.636  02/26/02  Sev=Info/5       IKE/0x6300000E 
MODE_CFG_REPLY: Attribute = MODECFG_UNITY_DEFDOMAIN: , value = cisco.com 

39     10:24:20.646  02/26/02  Sev=Info/4       CM/0x63100019 
Mode Config data received 

40     10:24:20.676  02/26/02  Sev=Info/5       IKE/0x63000055 
Received a key request from Driver for IP address 172.18.124.159, GW IP = 17$ 

41     10:24:20.676  02/26/02  Sev=Info/4       IKE/0x63000013 
SENDING >>> ISAKMP OAK QM *(HASH, SA, NON, ID, ID) to 172.18.124.159 

42     10:24:20.676  02/26/02  Sev=Info/5       IKE/0x63000055 
Received a key request from Driver for IP address 10.10.10.255, GW IP = 172.$ 

43     10:24:20.676  02/26/02  Sev=Info/4       IKE/0x63000013 
SENDING >>> ISAKMP OAK QM *(HASH, SA, NON, ID, ID) to 172.18.124.159 

44     10:24:20.967  02/26/02  Sev=Info/4       IPSEC/0x63700014 
Deleted all keys 

45     10:24:20.987  02/26/02  Sev=Info/5       IKE/0x6300002F 
Received ISAKMP packet: peer = 172.18.124.159 

46     10:24:20.987  02/26/02  Sev=Info/4       IKE/0x63000014 
RECEIVING <<< ISAKMP OAK QM *(HASH, SA, NON, ID, 
ID, NOTIFY:STATUS_RESP_LIFE$ 

47     10:24:20.987  02/26/02  Sev=Info/5       IKE/0x63000044 
RESPONDER-LIFETIME notify has value of 3600 seconds 

48     10:24:20.987  02/26/02  Sev=Info/5       IKE/0x63000045 
RESPONDER-LIFETIME notify has value of 4608000 kb 

49     10:24:20.987  02/26/02  Sev=Info/4       IKE/0x63000013 
SENDING >>> ISAKMP OAK QM *(HASH) to 172.18.124.159 

50     10:24:20.987  02/26/02  Sev=Info/5       IKE/0x63000058 
Loading IPsec SA (Message ID = 0x49D93B33 OUTBOUND SPI = 0x4637A127 INBOUND $ 

51     10:24:20.987  02/26/02  Sev=Info/5       IKE/0x63000025 
Loaded OUTBOUND ESP SPI: 0x4637A127 

52     10:24:20.987  02/26/02  Sev=Info/5       IKE/0x63000026 
Loaded INBOUND ESP SPI: 0xCE633EA8 

53     10:24:20.987  02/26/02  Sev=Info/4       CM/0x6310001A 
One secure connection established 

54     10:24:21.017  02/26/02  Sev=Info/6       DIALER/0x63300003 
Connection established. 

55     10:24:21.357  02/26/02  Sev=Info/6       DIALER/0x63300008 
MAPI32 Information - Outlook not default mail client 

56     10:24:21.617  02/26/02  Sev=Info/5       IKE/0x6300002F 
Received ISAKMP packet: peer = 172.18.124.159 

57     10:24:21.617  02/26/02  Sev=Info/4       IKE/0x63000014 
RECEIVING <<< ISAKMP OAK QM *(HASH, SA, NON, ID, 
ID, NOTIFY:STATUS_RESP_LIFE$ 

58     10:24:21.617  02/26/02  Sev=Info/5       IKE/0x63000044 
RESPONDER-LIFETIME notify has value of 3600 seconds 

59     10:24:21.617  02/26/02  Sev=Info/5       IKE/0x63000045 
RESPONDER-LIFETIME notify has value of 4608000 kb 

60     10:24:21.617  02/26/02  Sev=Info/4       IKE/0x63000013 
SENDING >>> ISAKMP OAK QM *(HASH) to 172.18.124.159 

61     10:24:21.617  02/26/02  Sev=Info/5       IKE/0x63000058 
Loading IPsec SA (Message ID = 0x41AC9838 OUTBOUND SPI = 0x287931C6 INBOUND $ 

62     10:24:21.617  02/26/02  Sev=Info/5       IKE/0x63000025 
Loaded OUTBOUND ESP SPI: 0x287931C6 

63     10:24:21.617  02/26/02  Sev=Info/5       IKE/0x63000026 
Loaded INBOUND ESP SPI: 0x26EC8782 

64     10:24:21.617  02/26/02  Sev=Info/4       CM/0x63100022 
Additional Phase 2 SA established. 

65     10:24:21.617  02/26/02  Sev=Info/5       IKE/0x63000055 
Received a key request from Driver for IP address 14.38.100.10, GW IP = 172.$ 

66     10:24:21.617  02/26/02  Sev=Info/4       IKE/0x63000013 
SENDING >>> ISAKMP OAK QM *(HASH, SA, NON, ID, ID) to 172.18.124.159 

67     10:24:21.948  02/26/02  Sev=Info/5       IKE/0x6300002F 
Received ISAKMP packet: peer = 172.18.124.159 

68     10:24:21.948  02/26/02  Sev=Info/4       IKE/0x63000014 
RECEIVING <<< ISAKMP OAK QM *(HASH, SA, NON, ID, 
ID, NOTIFY:STATUS_RESP_LIFE$ 

69     10:24:21.948  02/26/02  Sev=Info/5       IKE/0x63000044 
RESPONDER-LIFETIME notify has value of 3600 seconds 

70     10:24:21.948  02/26/02  Sev=Info/5       IKE/0x63000045 
RESPONDER-LIFETIME notify has value of 4608000 kb 

71     10:24:21.948  02/26/02  Sev=Info/4       IKE/0x63000013 
SENDING >>> ISAKMP OAK QM *(HASH) to 172.18.124.159 

72     10:24:21.948  02/26/02  Sev=Info/5       IKE/0x63000058 
Loading IPsec SA (Message ID = 0xCDC476F0 OUTBOUND SPI = 0xFDE4BA9C INBOUND $ 

73     10:24:21.948  02/26/02  Sev=Info/5       IKE/0x63000025 
Loaded OUTBOUND ESP SPI: 0xFDE4BA9C 

74     10:24:21.948  02/26/02  Sev=Info/5       IKE/0x63000026 
Loaded INBOUND ESP SPI: 0xDEA46284 

75     10:24:21.948  02/26/02  Sev=Info/4       CM/0x63100022 
Additional Phase 2 SA established. 

76     10:24:22.248  02/26/02  Sev=Info/4       IPSEC/0x63700010 
Created a new key structure 

77     10:24:22.248  02/26/02  Sev=Info/4       IPSEC/0x6370000F 
Added key with SPI=0x27a13746 into key list 

78     10:24:22.248  02/26/02  Sev=Info/4       IPSEC/0x63700010 
Created a new key structure 

79     10:24:22.248  02/26/02  Sev=Info/4       IPSEC/0x6370000F 
Added key with SPI=0xa83e63ce into key list 

80     10:24:22.248  02/26/02  Sev=Info/4       IPSEC/0x63700010 
81     10:24:22.248  02/26/02  Sev=Info/4       IPSEC/0x6370000F 
Added key with SPI=0xc6317928 into key list 

82     10:24:22.248  02/26/02  Sev=Info/4       IPSEC/0x63700010 
Created a new key structure 

83     10:24:22.248  02/26/02  Sev=Info/4       IPSEC/0x6370000F 
Added key with SPI=0x8287ec26 into key list 

84     10:24:22.248  02/26/02  Sev=Info/4       IPSEC/0x63700010 
Created a new key structure 

85     10:24:22.248  02/26/02  Sev=Info/4       IPSEC/0x6370000F 
Added key with SPI=0x9cbae4fd into key list 

86     10:24:22.248  02/26/02  Sev=Info/4       IPSEC/0x63700010 
Created a new key structure 

87     10:24:22.248  02/26/02  Sev=Info/4       IPSEC/0x6370000F 
Added key with SPI=0x8462a4de into key list