在ASAv上使用ASDM或CLI配置IKEv1 IPsec站点到站点隧道

下载选项

PDF (1.0 MB)
在各种设备上使用 Adobe Reader 查看
ePub (606.8 KB)
在 iPhone、iPad、Android、Sony Reader 或 Windows Phone 上使用各种应用查看
Mobi (Kindle) (866.9 KB)
在 Kindle 设备上查看或在多个设备上使用 Kindle 应用查看

已更新: 2018 年 4 月 13 日

文档 ID:119141

非歧视性语言

此产品的文档集力求使用非歧视性语言。在本文档集中，非歧视性语言是指不隐含针对年龄、残障、性别、种族身份、族群身份、性取向、社会经济地位和交叉性的歧视的语言。由于产品软件的用户界面中使用的硬编码语言、基于 RFP 文档使用的语言或引用的第三方产品使用的语言，文档中可能无法确保完全使用非歧视性语言。深入了解思科如何使用包容性语言。

关于此翻译

思科采用人工翻译与机器翻译相结合的方式将此文档翻译成不同语言，希望全球的用户都能通过各自的语言得到支持性的内容。请注意：即使是最好的机器翻译，其准确度也不及专业翻译人员的水平。 Cisco Systems, Inc. 对于翻译的准确性不承担任何责任，并建议您总是参考英文原始文档（已提供链接）。

简介

本文档介绍如何在运行v9.18.3的两个思科安全防火墙虚拟(ASAv)之间配置IKEv1 IPsec站点到站点隧道。

先决条件

要求

Cisco 建议您了解以下主题：

必须建立端到端IP连接
必须允许以下协议：
1. 用于IPsec控制平面的用户数据报协议(UDP)500和4500
2. 为IPsec数据平面封装安全负载(ESP)IP协议50

使用的组件

本文档中的信息基于以下软件和硬件版本：

运行软件版本9.18.3的思科安全防火墙ASA虚拟

本文档中的信息都是基于特定实验室环境中的设备编写的。本文档中使用的所有设备最初均采用原始（默认）配置。如果您的网络处于活动状态，请确保您了解所有命令的潜在影响。

配置

本节介绍如何通过自适应安全设备管理器(ASDM)VPN向导或CLI配置站点到站点VPN隧道。

网络图

此拓扑用于本文档中的示例：

拓扑图

通过ASDM VPN向导配置

要通过ASDM向导设置站点到站点VPN隧道，请完成以下步骤：

打开ASDM并导航至Wizards > VPN Wizards > Site-to-site VPN Wizard。 VPN向导导航

 到达向导主页后Next，单击。

VPN向导窗口1 注：最新的ASDM版本提供视频链接，解释此配置。
 
 配置对等IP地址。在本示例中，站点B上的对等IP地址设置为10.106.67.91。如果您在站点A上配置对等IP地址，则必须将其更改为10.106.67.90。还指定了可以到达远程端的接口。完成Next后，单击。

VPN向导窗口2 
 配置本地和远程网络（流量源和目标）。此图显示了站点B的配置（相反适用于站点A）。

VPN向导窗口3 
 在Security页面上，配置预共享密钥（两端必须匹配）。完成Next后，单击。

VPN向导窗口4 
 为ASA上的流量配置源接口。ASDM根据ASA版本自动创建网络地址转换(NAT)规则，并在最后一步中将其与配置的其余部分一起推送。 注：对于本文档中使用的示例，“inside”是流量的来源。
 VPN向导窗口5 
 向导现在提供推送到ASA的配置的摘要。检查并验证配置设置，然后单击Finish。

VPN向导窗口6

`通过CLI配置`

本节介绍如何通过CLI配置IKEv1 IPsec站点到站点隧道。

`配置站点B`

提示：对于ASA的IKEv2配置示例，请查看ASA和路由器之间的站点到站点IKEv2隧道配置示例Cisco文档。

第1阶段(IKEv1)

完成第1阶段配置的以下步骤：

 在CLI中输入以下命令以在外部接口上启用IKEv1:

 crypto ikev1 enable outside
 
 创建IKEv1策略，该策略定义用于散列、身份验证、Diffie-Hellman组、生存期和加密的算法/方法：

 crypto ikev1 policy 1
! The 1 in the above command refers to the Policy suite priority (1 highest, 65535 lowest)
  authentication pre-share
  encryption aes-256
  hash sha
  group 14
  lifetime 86400
 
 在IPsec属性下创建隧道组，并配置对等IP地址和隧道预共享密钥：

 tunnel-group 10.106.67.90 type ipsec-l2l
tunnel-group 10.106.67.90 ipsec-attributes
 ikev1 pre-shared-key cisco
 ! Note the IKEv1 keyword at the beginning of the pre-shared-key command.

第2阶段(IPsec)

完成第2阶段配置的以下步骤：

 创建定义要加密和隧道化的流量的访问列表。在本示例中，相关流量是来自从10.2.2.0子网到10.1.1.0的隧道的流量。如果站点之间涉及多个子网，则它可以包含多个条目。

 object network 10.2.2.0_24
 subnet 10.2.2.0 255.255.255.0
object network 10.1.1.0_24
 subnet 10.1.1.0 255.255.255.0

access-list 100 extended permit ip object 10.2.2.0_24 object 10.1.1.0_24
 
 配置转换集(TS)，其中必须包含关键字IKEv1。在远程端也必须创建相同的TS。 

 crypto ipsec ikev1 transform-set myset esp-aes-256 esp-sha-hmac
 
 配置包含以下组件的加密映射：
 
         
         对等IP地址 
         包含相关流量的已定义访问列表 
         TS 
         可选的完全向前保密(PFS)设置，创建用于保护数据的新Diffie-Hellman密钥对（在第2阶段出现之前，两端都必须启用PFS）

 
        
 
 在外部接口上应用加密映射：

 crypto map outside_map 20 match address 100
crypto map outside_map 20 set peer 10.106.67.90
crypto map outside_map 20 set ikev1 transform-set myset
crypto map outside_map 20 set pfs
crypto map outside_map interface outside

NAT免除

确保VPN流量不受任何其他NAT规则的约束。以下是所使用的NAT规则：

nat (inside,outside) 1 source static 10.2.2.0_24 10.2.2.0_24 destination static 10.1.1.0_24 10.1.1.0_24 no-proxy-arp route-lookup

注意：当使用多个子网时，您必须创建包含所有源子网和目标子网的对象组，并在NAT规则中使用它们。

object-group network 10.x.x.x_SOURCE
 network-object 10.4.4.0 255.255.255.0
 network-object 10.2.2.0 255.255.255.0

object network 10.x.x.x_DESTINATION
 network-object 10.3.3.0 255.255.255.0
 network-object 10.1.1.0 255.255.255.0

nat (inside,outside) 1 source static 10.x.x.x_SOURCE 10.x.x.x_SOURCE destination static 10.x.x.x_DESTINATION 10.x.x.x_DESTINATION no-proxy-arp route-lookup

完整配置示例

站点B的完整配置如下：

crypto ikev1 enable outside

crypto ikev1 policy 10
 authentication pre-share
 encryption aes-256
 hash sha
 group 14
 lifetime 86400

tunnel-group 10.106.67.90 type ipsec-l2l
tunnel-group 10.106.67.90 ipsec-attributes
 ikev1 pre-shared-key cisco
 !Note the IKEv1 keyword at the beginning of the pre-shared-key command.

object network 10.2.2.0_24 
 subnet 10.2.2.0 255.255.255.0 
object network 10.1.1.0_24 
 subnet 10.1.1.0 255.255.255.0

access-list 100 extended permit ip object 10.2.2.0_24 object 10.1.1.0_24

crypto ipsec ikev1 transform-set myset esp-aes esp-sha-hmac

crypto map outside_map 20 match address 100
crypto map outside_map 20 set peer 10.106.67.90
crypto map outside_map 20 set ikev1 transform-set myset
crypto map outside_map 20 set pfs
crypto map outside_map interface outside

nat (inside,outside) 1 source static 10.2.2.0_24 10.2.2.0_24 destination static 10.1.1.0_24 10.1.1.0_24 no-proxy-arp route-lookup

`组策略`

组策略用于定义应用于隧道的特定设置。这些策略与隧道组配合使用。

组策略可以定义为内部（这意味着从ASA上定义的属性中提取属性），也可以定义为外部（从外部服务器查询属性）。以下是用于定义组策略的命令：

group-policy SITE_A internal

注：您可以在组策略中定义多个属性。有关所有可能的属性的列表，请参阅配置组策略部分。

组策略可选属性

属vpn-tunnel-protocol性确定必须应用这些设置的隧道类型。在本示例中，使用IPsec:

vpn-tunnel-protocol ?
 group-policy mode commands/options:
 IPSec IP Security Protocol l2tp-ipsec L2TP using IPSec for security
 svc SSL VPN Client
 webvpn WebVPN

vpn-tunnel-protocol ikev1 - Version 8.4 and later

您可以选择配置隧道，使其保持空闲（无流量）且不发生故障。要配置此选项vpn-idle-timeout，属性值必须使用分钟，也可以将该值设置为none，这意味着隧道永远不会中断。

例如：

group-policy SITE_A attributes
  vpn-idle-timeout ?

group-policy mode commands/options:
 <1-35791394> Number of minutes
 alert-interval Specify timeout alert interval in minutes
 none Site-to-Site (IKEv1, IKEv2) and IKEv1 remote-access: Disable
 timeout and allow an unlimited idle period; AnyConnect (SSL,
 IPSec/IKEv2): Use value of default-idle-timeout

隧道组常规属性下的命令default-group-policy，定义用于推送已建立隧道的某些策略设置的组策略。未在组策略中定义的选项的默认设置取自全局默认组策略：

tunnel-group 10.106.67.91 general-attributes
 default-group-policy SITE_A

`验证`

使用本部分提供的信息验证您的配置是否正常工作。

`ASDM`

要从ASDM查看隧道状态，请导航至Monitoring > VPN。提供以下信息：

 对等IP地址
 用于建立隧道的协议
 使用的加密算法
 隧道启动的时间和启动时间
 接收和传输的数据包数量

提示：单击Refresh，以查看最新值，因为数据不会实时更新。

VPN监控窗口

`CLI`

本节介绍如何通过CLI验证配置。

`第 1 阶段`

在CLI中输入以下命令，以验证站点B端的第1阶段配置：

show crypto ikev1 sa

IKEv1 SAs:
 
 Active SA: 1
 Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
Total IKE SA: 1

1 IKE Peer: 10.106.67.91
 Type : L2L Role : initiator
 Rekey : no State : MM_ACTIVE

`第 2 阶段`

命令show crypto ipsec sa，显示在对等体之间构建的IPsec SA。加密隧道在IP地址10.106.67.90和10.106.67.91之间构建，供在网络10.1.1.0和10.2.2.0之间流动的流量使用。您可以看到为入站和出站流量构建的两个ESP SA。未使用身份验证报头(AH)，因为没有AH SA。

在CLI中输入以下命令，以验证站点A端的第2阶段配置：

interface: outside
 Crypto map tag: outside_map, seq num: 20, local addr: 10.106.67.90

 access-list 100 extended permit ip 10.1.1.0 255.255.255.0 10.2.2.0 255.255.255.0 
 local ident (addr/mask/prot/port): (10.1.1.0/255.255.255.0/0/0)
 remote ident (addr/mask/prot/port): (10.2.2.0/255.255.255.0/0/0)
 current_peer: 10.106.67.91


 #pkts encaps: 20, #pkts encrypt: 20, #pkts digest: 20
 #pkts decaps: 20, #pkts decrypt: 20, #pkts verify: 20
 #pkts compressed: 0, #pkts decompressed: 0
 #pkts not compressed: 20, #pkts comp failed: 0, #pkts decomp failed: 0
 #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
 #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
 #TFC rcvd: 0, #TFC sent: 0
 #Valid ICMP Errors rcvd: 0, #Invalid ICMP Errors rcvd: 0
 #send errors: 0, #recv errors: 0

 local crypto endpt.: 10.106.67.90/0, remote crypto endpt.: 10.106.67.91/0
 path mtu 1500, ipsec overhead 74(44), media mtu 1500
 PMTU time remaining (sec): 0, DF policy: copy-df
 ICMP error validation: disabled, TFC packets: disabled
 current outbound spi: F8951DA2
 current inbound spi : 662C7ABE

 inbound esp sas:
 spi: 0x662C7ABE (1714191038)
 SA State: active
 transform: esp-aes-256 esp-sha-hmac no compression 
 in use settings ={L2L, Tunnel, PFS Group 14, IKEv1, }
 slot: 0, conn_id: 1, crypto-map: outside_map
 sa timing: remaining key lifetime (kB/sec): (3914998/28074)
 IV size: 16 bytes
 replay detection support: Y
 Anti replay bitmap: 
 0x00000000 0x001FFFFF
 outbound esp sas:
 spi: 0xF8951DA2 (4170522018)
 SA State: active
 transform: esp-aes-256 esp-sha-hmac no compression 
 in use settings ={L2L, Tunnel, PFS Group 14, IKEv1, }
 slot: 0, conn_id: 1, crypto-map: outside_map
 sa timing: remaining key lifetime (kB/sec): (3914998/28073)
 IV size: 16 bytes
 replay detection support: Y
 Anti replay bitmap: 
 0x00000000 0x00000001

在CLI中输入以下命令，以验证站点B端的第2阶段配置：

interface: outside
 Crypto map tag: outside_map, seq num: 20, local addr: 10.106.67.91

 access-list 100 extended permit ip 10.2.2.0 255.255.255.0 10.1.1.0 255.255.255.0 
 local ident (addr/mask/prot/port): (10.2.2.0/255.255.255.0/0/0)
 remote ident (addr/mask/prot/port): (10.1.1.0/255.255.255.0/0/0)
 current_peer: 10.106.67.90


 #pkts encaps: 20, #pkts encrypt: 20, #pkts digest: 20
 #pkts decaps: 20, #pkts decrypt: 20, #pkts verify: 20
 #pkts compressed: 0, #pkts decompressed: 0
 #pkts not compressed: 20, #pkts comp failed: 0, #pkts decomp failed: 0
 #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
 #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
 #TFC rcvd: 0, #TFC sent: 0
 #Valid ICMP Errors rcvd: 0, #Invalid ICMP Errors rcvd: 0
 #send errors: 0, #recv errors: 0

 local crypto endpt.: 10.106.67.91/0, remote crypto endpt.: 10.106.67.90/0
 path mtu 1500, ipsec overhead 74(44), media mtu 1500
 PMTU time remaining (sec): 0, DF policy: copy-df
 ICMP error validation: disabled, TFC packets: disabled
 current outbound spi: 662C7ABE
 current inbound spi : F8951DA2

 inbound esp sas:
 spi: 0xF8951DA2 (4170522018)
 SA State: active
 transform: esp-aes-256 esp-sha-hmac no compression 
 in use settings ={L2L, Tunnel, PFS Group 14, IKEv1, }
 slot: 0, conn_id: 1, crypto-map: outside_map
 sa timing: remaining key lifetime (kB/sec): (4373998/27737)
 IV size: 16 bytes
 replay detection support: Y
 Anti replay bitmap: 
 0x00000000 0x001FFFFF
 outbound esp sas:
 spi: 0x662C7ABE (1714191038)
 SA State: active
 transform: esp-aes-256 esp-sha-hmac no compression 
 in use settings ={L2L, Tunnel, PFS Group 14, IKEv1, }
 slot: 0, conn_id: 1, crypto-map: outside_map
 sa timing: remaining key lifetime (kB/sec): (4373998/27737)
 IV size: 16 bytes
 replay detection support: Y
 Anti replay bitmap: 
 0x00000000 0x00000001

`故障排除`

使用本节提供的信息排除配置问题。

输入以下debug命令以确定隧道故障的位置：

 debug crypto ikev1 127 (第 1 阶段)
 debug crypto ipsec 127 (第 2 阶段)

以下是调试输出的完整示例：

IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=1, saddr=10.1.1.10, sport=23043, daddr=10.2.2.10, dport=23043
IPSEC(crypto_map_check)-3: Checking crypto map outside_map 20: matched.
Mar 15 05:41:39 [IKEv1 DEBUG]Pitcher: received a key acquire message, spi 0x0
IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=1, saddr=10.1.1.10, sport=23043, daddr=10.2.2.10, dport=23043
IPSEC(crypto_map_check)-3: Checking crypto map outside_map 20: matched.
Mar 15 05:41:39 [IKEv1]IP = 10.106.67.91, IKE Initiator: New Phase 1, Intf inside, IKE Peer 10.106.67.91 local Proxy Address 10.1.1.0, remote Proxy Address 10.2.2.0, Crypto map (outside_map)
Mar 15 05:41:39 [IKEv1 DEBUG]IP = 10.106.67.91, constructing ISAKMP SA payload
Mar 15 05:41:39 [IKEv1 DEBUG]IP = 10.106.67.91, constructing NAT-Traversal VID ver 02 payload
Mar 15 05:41:39 [IKEv1 DEBUG]IP = 10.106.67.91, constructing NAT-Traversal VID ver 03 payload
Mar 15 05:41:39 [IKEv1 DEBUG]IP = 10.106.67.91, constructing NAT-Traversal VID ver RFC payload
Mar 15 05:41:39 [IKEv1 DEBUG]IP = 10.106.67.91, constructing Fragmentation VID + extended capabilities payload
Mar 15 05:41:39 [IKEv1]IP = 10.106.67.91, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 172
Mar 15 05:41:39 [IKEv1]IKE Receiver: Packet received on 10.106.67.90:500 from 10.106.67.91:500
Mar 15 05:41:39 [IKEv1]IP = 10.106.67.91, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 132
Mar 15 05:41:39 [IKEv1 DEBUG]IP = 10.106.67.91, processing SA payload
Mar 15 05:41:39 [IKEv1 DEBUG]IP = 10.106.67.91, Oakley proposal is acceptable
Mar 15 05:41:39 [IKEv1 DEBUG]IP = 10.106.67.91, processing VID payload
Mar 15 05:41:39 [IKEv1 DEBUG]IP = 10.106.67.91, Received NAT-Traversal RFC VID
Mar 15 05:41:39 [IKEv1 DEBUG]IP = 10.106.67.91, processing VID payload
Mar 15 05:41:39 [IKEv1 DEBUG]IP = 10.106.67.91, Received Fragmentation VID
Mar 15 05:41:39 [IKEv1 DEBUG]IP = 10.106.67.91, IKE Peer included IKE fragmentation capability flags: Main Mode: True Aggressive Mode: True
Mar 15 05:41:39 [IKEv1 DEBUG]IP = 10.106.67.91, constructing ke payload
Mar 15 05:41:39 [IKEv1 DEBUG]IP = 10.106.67.91, constructing nonce payload
Mar 15 05:41:39 [IKEv1 DEBUG]IP = 10.106.67.91, constructing Cisco Unity VID payload
Mar 15 05:41:39 [IKEv1 DEBUG]IP = 10.106.67.91, constructing xauth V6 VID payload
Mar 15 05:41:39 [IKEv1 DEBUG]IP = 10.106.67.91, Send IOS VID
Mar 15 05:41:39 [IKEv1 DEBUG]IP = 10.106.67.91, Constructing ASA spoofing IOS Vendor ID payload (version: 1.0.0, capabilities: 20000001)
Mar 15 05:41:39 [IKEv1 DEBUG]IP = 10.106.67.91, constructing VID payload
Mar 15 05:41:39 [IKEv1 DEBUG]IP = 10.106.67.91, Send Altiga/Cisco VPN3000/Cisco ASA GW VID
Mar 15 05:41:39 [IKEv1 DEBUG]IP = 10.106.67.91, constructing NAT-Discovery payload
Mar 15 05:41:39 [IKEv1 DEBUG]IP = 10.106.67.91, computing NAT Discovery hash
Mar 15 05:41:39 [IKEv1 DEBUG]IP = 10.106.67.91, constructing NAT-Discovery payload
Mar 15 05:41:39 [IKEv1 DEBUG]IP = 10.106.67.91, computing NAT Discovery hash
Mar 15 05:41:39 [IKEv1]IP = 10.106.67.91, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + KE (4) + NONCE (10) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NAT-D (20) + NAT-D (20) + NONE (0) total length : 432
Mar 15 05:41:39 [IKEv1]IKE Receiver: Packet received on 10.106.67.90:500 from 10.106.67.91:500
Mar 15 05:41:39 [IKEv1]IP = 10.106.67.91, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + KE (4) + NONCE (10) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NAT-D (20) + NAT-D (20) + NONE (0) total length : 432
Mar 15 05:41:39 [IKEv1 DEBUG]IP = 10.106.67.91, processing ke payload
Mar 15 05:41:39 [IKEv1 DEBUG]IP = 10.106.67.91, processing ISA_KE payload
Mar 15 05:41:39 [IKEv1 DEBUG]IP = 10.106.67.91, processing nonce payload
Mar 15 05:41:39 [IKEv1 DEBUG]IP = 10.106.67.91, processing VID payload
Mar 15 05:41:39 [IKEv1 DEBUG]IP = 10.106.67.91, Received Cisco Unity client VID
Mar 15 05:41:39 [IKEv1 DEBUG]IP = 10.106.67.91, processing VID payload
Mar 15 05:41:39 [IKEv1 DEBUG]IP = 10.106.67.91, Received xauth V6 VID
Mar 15 05:41:39 [IKEv1 DEBUG]IP = 10.106.67.91, processing VID payload
Mar 15 05:41:39 [IKEv1 DEBUG]IP = 10.106.67.91, Processing VPN3000/ASA spoofing IOS Vendor ID payload (version: 1.0.0, capabilities: 20000001)
Mar 15 05:41:39 [IKEv1 DEBUG]IP = 10.106.67.91, processing VID payload
Mar 15 05:41:39 [IKEv1 DEBUG]IP = 10.106.67.91, Received Altiga/Cisco VPN3000/Cisco ASA GW VID
Mar 15 05:41:39 [IKEv1 DEBUG]IP = 10.106.67.91, processing NAT-Discovery payload
Mar 15 05:41:39 [IKEv1 DEBUG]IP = 10.106.67.91, computing NAT Discovery hash
Mar 15 05:41:39 [IKEv1 DEBUG]IP = 10.106.67.91, processing NAT-Discovery payload
Mar 15 05:41:39 [IKEv1 DEBUG]IP = 10.106.67.91, computing NAT Discovery hash
Mar 15 05:41:39 [IKEv1]IP = 10.106.67.91, Connection landed on tunnel_group 10.106.67.91
Mar 15 05:41:39 [IKEv1 DEBUG]Group = 10.106.67.91, IP = 10.106.67.91, Generating keys for Initiator...
Mar 15 05:41:39 [IKEv1 DEBUG]Group = 10.106.67.91, IP = 10.106.67.91, constructing ID payload
Mar 15 05:41:39 [IKEv1 DEBUG]Group = 10.106.67.91, IP = 10.106.67.91, constructing hash payload
Mar 15 05:41:39 [IKEv1 DEBUG]Group = 10.106.67.91, IP = 10.106.67.91, Computing hash for ISAKMP
Mar 15 05:41:39 [IKEv1 DEBUG]IP = 10.106.67.91, Constructing IOS keep alive payload: proposal=32767/32767 sec.
Mar 15 05:41:39 [IKEv1 DEBUG]Group = 10.106.67.91, IP = 10.106.67.91, constructing dpd vid payload
Mar 15 05:41:39 [IKEv1]IP = 10.106.67.91, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + ID (5) + HASH (8) + IOS KEEPALIVE (128) + VENDOR (13) + NONE (0) total length : 96
Mar 15 05:41:39 [IKEv1]Group = 10.106.67.91, IP = 10.106.67.91, Automatic NAT Detection Status: Remote end is NOT behind a NAT device This end is NOT behind a NAT device
Mar 15 05:41:39 [IKEv1]IKE Receiver: Packet received on 10.106.67.90:500 from 10.106.67.91:500
Mar 15 05:41:39 [IKEv1]IP = 10.106.67.91, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + ID (5) + HASH (8) + IOS KEEPALIVE (128) + VENDOR (13) + NONE (0) total length : 96
Mar 15 05:41:39 [IKEv1 DEBUG]Group = 10.106.67.91, IP = 10.106.67.91, processing ID payload
Mar 15 05:41:39 [IKEv1 DECODE]Group = 10.106.67.91, IP = 10.106.67.91, ID_IPV4_ADDR ID received 10.106.67.91
Mar 15 05:41:39 [IKEv1 DEBUG]Group = 10.106.67.91, IP = 10.106.67.91, processing hash payload
Mar 15 05:41:39 [IKEv1 DEBUG]Group = 10.106.67.91, IP = 10.106.67.91, Computing hash for ISAKMP
Mar 15 05:41:39 [IKEv1 DEBUG]IP = 10.106.67.91, Processing IOS keep alive payload: proposal=32767/32767 sec.
Mar 15 05:41:39 [IKEv1 DEBUG]Group = 10.106.67.91, IP = 10.106.67.91, processing VID payload
Mar 15 05:41:39 [IKEv1 DEBUG]Group = 10.106.67.91, IP = 10.106.67.91, Received DPD VID
Mar 15 05:41:39 [IKEv1]IP = 10.106.67.91, Connection landed on tunnel_group 10.106.67.91
Mar 15 05:41:39 [IKEv1 DEBUG]Group = 10.106.67.91, IP = 10.106.67.91, Oakley begin quick mode
Mar 15 05:41:39 [IKEv1 DECODE]Group = 10.106.67.91, IP = 10.106.67.91, IKE Initiator starting QM: msg id = ad712fa9
Mar 15 05:41:39 [IKEv1]Group = 10.106.67.91, IP = 10.106.67.91, PHASE 1 COMPLETED
Mar 15 05:41:39 [IKEv1]IP = 10.106.67.91, Keep-alive type for this connection: DPD
Mar 15 05:41:39 [IKEv1 DEBUG]Group = 10.106.67.91, IP = 10.106.67.91, Starting P1 rekey timer: 73440 seconds.
Mar 15 05:41:39 [IKEv1]Group = 10.106.67.91, IP = 10.106.67.91, Add to IKEv1 Tunnel Table succeeded for SA with logical ID 8192
Mar 15 05:41:39 [IKEv1]Group = 10.106.67.91, IP = 10.106.67.91, Add to IKEv1 MIB Table succeeded for SA with logical ID 8192
IPSEC INFO: Setting an IPSec timer of type SA Purge Timer for 30 seconds with a jitter value of 0
IPSEC INFO: IPSec SA PURGE timer started SPI 0x0001B739
IPSEC: New embryonic SA created @ 0x00007f05294f4620, 
 SCB : 0x294CFE60, 
 Direction : inbound
 SPI : 0x50EF49AD
 Session ID : 0x00002000
 VPIF num : 0x00000002
 Tunnel type : l2l
 Protocol : esp
 Lifetime : 240 seconds
 SA handle : 0x0001B739
Mar 15 05:41:39 [IKEv1 DEBUG]Group = 10.106.67.91, IP = 10.106.67.91, IKE got SPI from key engine: SPI = 0x50ef49ad
Mar 15 05:41:39 [IKEv1 DEBUG]Group = 10.106.67.91, IP = 10.106.67.91, oakley constructing quick mode
Mar 15 05:41:39 [IKEv1 DEBUG]Group = 10.106.67.91, IP = 10.106.67.91, constructing blank hash payload
Mar 15 05:41:39 [IKEv1 DEBUG]Group = 10.106.67.91, IP = 10.106.67.91, constructing IPSec SA payload
Mar 15 05:41:39 [IKEv1 DEBUG]Group = 10.106.67.91, IP = 10.106.67.91, constructing IPSec nonce payload
Mar 15 05:41:39 [IKEv1 DEBUG]Group = 10.106.67.91, IP = 10.106.67.91, constructing pfs ke payload
Mar 15 05:41:39 [IKEv1 DEBUG]Group = 10.106.67.91, IP = 10.106.67.91, constructing proxy ID
Mar 15 05:41:39 [IKEv1 DEBUG]Group = 10.106.67.91, IP = 10.106.67.91, Transmitting Proxy Id:
 Local subnet: 10.1.1.0 mask 255.255.255.0 Protocol 0 Port 0
 Remote subnet: 10.2.2.0 Mask 255.255.255.0 Protocol 0 Port 0
Mar 15 05:41:39 [IKEv1 DECODE]Group = 10.106.67.91, IP = 10.106.67.91, IKE Initiator sending Initial Contact
Mar 15 05:41:39 [IKEv1 DEBUG]Group = 10.106.67.91, IP = 10.106.67.91, constructing qm hash payload
Mar 15 05:41:39 [IKEv1 DECODE]Group = 10.106.67.91, IP = 10.106.67.91, IKE Initiator sending 1st QM pkt: msg id = ad712fa9
Mar 15 05:41:39 [IKEv1]IP = 10.106.67.91, IKE_DECODE SENDING Message (msgid=ad712fa9) with payloads : HDR + HASH (8) + SA (1) + NONCE (10) + KE (4) + ID (5) + ID (5) + NOTIFY (11) + NONE (0) total length : 464
Mar 15 05:41:39 [IKEv1]IKE Receiver: Packet received on 10.106.67.90:500 from 10.106.67.91:500
Mar 15 05:41:39 [IKEv1]IP = 10.106.67.91, IKE_DECODE RECEIVED Message (msgid=ad712fa9) with payloads : HDR + HASH (8) + SA (1) + NONCE (10) + KE (4) + ID (5) + ID (5) + NONE (0) total length : 436
Mar 15 05:41:39 [IKEv1 DEBUG]Group = 10.106.67.91, IP = 10.106.67.91, processing hash payload
Mar 15 05:41:39 [IKEv1 DEBUG]Group = 10.106.67.91, IP = 10.106.67.91, processing SA payload
Mar 15 05:41:39 [IKEv1 DEBUG]Group = 10.106.67.91, IP = 10.106.67.91, processing nonce payload
Mar 15 05:41:39 [IKEv1 DEBUG]Group = 10.106.67.91, IP = 10.106.67.91, processing ke payload
Mar 15 05:41:39 [IKEv1 DEBUG]Group = 10.106.67.91, IP = 10.106.67.91, processing ISA_KE for PFS in phase 2
Mar 15 05:41:39 [IKEv1 DEBUG]Group = 10.106.67.91, IP = 10.106.67.91, processing ID payload
Mar 15 05:41:39 [IKEv1 DECODE]Group = 10.106.67.91, IP = 10.106.67.91, ID_IPV4_ADDR_SUBNET ID received--10.1.1.0--255.255.255.0
Mar 15 05:41:39 [IKEv1 DEBUG]Group = 10.106.67.91, IP = 10.106.67.91, processing ID payload
Mar 15 05:41:39 [IKEv1 DECODE]Group = 10.106.67.91, IP = 10.106.67.91, ID_IPV4_ADDR_SUBNET ID received--10.2.2.0--255.255.255.0
Mar 15 05:41:39 [IKEv1 DEBUG]Group = 10.106.67.91, IP = 10.106.67.91, loading all IPSEC SAs
Mar 15 05:41:39 [IKEv1 DEBUG]Group = 10.106.67.91, IP = 10.106.67.91, Generating Quick Mode Key!
Mar 15 05:41:39 [IKEv1 DEBUG]Group = 10.106.67.91, IP = 10.106.67.91, Generating Quick Mode Key!
Mar 15 05:41:39 [IKEv1]Group = 10.106.67.91, IP = 10.106.67.91, Security negotiation complete for LAN-to-LAN Group (10.106.67.91) Initiator, Inbound SPI = 0x50ef49ad, Outbound SPI = 0xea689811
Mar 15 05:41:39 [IKEv1 DEBUG]Group = 10.106.67.91, IP = 10.106.67.91, oakley constructing final quick mode
Mar 15 05:41:39 [IKEv1 DECODE]Group = 10.106.67.91, IP = 10.106.67.91, IKE Initiator sending 3rd QM pkt: msg id = ad712fa9
Mar 15 05:41:39 [IKEv1]IP = 10.106.67.91, IKE_DECODE SENDING Message (msgid=ad712fa9) with payloads : HDR + HASH (8) + NONE (0) total length : 76
IPSEC INFO: Setting an IPSec timer of type SA Purge Timer for 30 seconds with a jitter value of 0
IPSEC INFO: IPSec SA PURGE timer started SPI 0x00024311
IPSEC: New embryonic SA created @ 0x00007f05294fd920, 
 SCB : 0x294CCDB0, 
 Direction : outbound
 SPI : 0xEA689811
 Session ID : 0x00002000
 VPIF num : 0x00000002
 Tunnel type : l2l
 Protocol : esp
 Lifetime : 240 seconds
 SA handle : 0x00024311
Rule Lookup for local 10.1.1.0 to remote 10.2.2.0
Peer matched map outside_map sequence 20
PROXY MATCH on crypto map outside_map seq 20
IPSEC DEBUG: Using NP outbound permit rule for SPI 0xEA689811
IPSEC: Completed host OBSA update, SPI 0xEA689811
IPSEC: Creating outbound VPN context, SPI 0xEA689811
 Flags : 0x00000005
 SA : 0x00007f05294fd920
 SPI : 0xEA689811
 MTU : 1500 bytes
 VCID : 0x00000000
 Peer : 0x00000000
 SCB : 0x02CEE703
 Channel: 0x00007f0533c4f700
IPSEC: Completed outbound VPN context, SPI 0xEA689811
VPN handle: 0x000000000000763c
IPSEC: New outbound encrypt rule, SPI 0xEA689811
 Src addr: 10.1.1.0
 Src mask: 255.255.255.0
 Dst addr: 10.2.2.0
 Dst mask: 255.255.255.0
 Src ports
 Upper: 0
 Lower: 0
 Op : ignore
 Dst ports
 Upper: 0
 Lower: 0
 Op : ignore
 Protocol: 0
 Use protocol: false
 SPI: 0x00000000
 Use SPI: false
IPSEC: Completed outbound encrypt rule, SPI 0xEA689811
Rule ID: 0x00007f05294f8a60
IPSEC: New outbound permit rule, SPI 0xEA689811
 Src addr: 10.106.67.90
 Src mask: 255.255.255.255
 Dst addr: 10.106.67.91
 Dst mask: 255.255.255.255
 Src ports
 Upper: 0
 Lower: 0
 Op : ignore
 Dst ports
 Upper: 0
 Lower: 0
 Op : ignore
 Protocol: 50
 Use protocol: true
 SPI: 0xEA689811
 Use SPI: true
IPSEC: Completed outbound permit rule, SPI 0xEA689811
Rule ID: 0x00007f05294f9110
Mar 15 05:41:39 [IKEv1 DEBUG]Group = 10.106.67.91, IP = 10.106.67.91, IKE got a KEY_ADD msg for SA: SPI = 0xea689811
IPSEC: New embryonic SA created @ 0x00007f05294f4620, 
 SCB : 0x294CFE60, 
 Direction : inbound
 SPI : 0x50EF49AD
 Session ID : 0x00002000
 VPIF num : 0x00000002
 Tunnel type: l2l
 Protocol : esp
 Lifetime : 240 seconds
 SA handle : 0x0001B739
Rule Lookup for local 10.1.1.0 to remote 10.2.2.0
Peer matched map outside_map sequence 20
PROXY MATCH on crypto map outside_map seq 20
IPSEC DEBUG: Using NP inbound permit rule for SPI 0x50EF49AD
IPSEC: Completed host IBSA update, SPI 0x50EF49AD
IPSEC: Creating inbound VPN context, SPI 0x50EF49AD
 Flags: 0x00000006
 SA : 0x00007f05294f4620
 SPI : 0x50EF49AD
 MTU : 0 bytes
 VCID : 0x00000000
 Peer : 0x0000763C
 SCB : 0x02CE8BB3
 Channel: 0x00007f0533c4f700
IPSEC: Completed inbound VPN context, SPI 0x50EF49AD
VPN handle: 0x00000000000086bc
IPSEC: Updating outbound VPN context 0x0000763C, SPI 0xEA689811
 Flags: 0x00000005
 SA : 0x00007f05294fd920
 SPI : 0xEA689811
 MTU : 1500 bytes
 VCID : 0x00000000
 Peer : 0x000086BC
 SCB : 0x02CEE703
 Channel: 0x00007f0533c4f700
IPSEC: Completed outbound VPN context, SPI 0xEA689811
VPN handle: 0x000000000000763c
IPSEC: Completed outbound inner rule, SPI 0xEA689811
Rule ID: 0x00007f05294f8a60
IPSEC: Completed outbound outer SPD rule, SPI 0xEA689811
Rule ID: 0x00007f05294f9110
IPSEC: New inbound tunnel flow rule, SPI 0x50EF49AD
 Src addr: 10.2.2.0
 Src mask: 255.255.255.0
 Dst addr: 10.1.1.0
 Dst mask: 255.255.255.0
 Src ports
 Upper: 0
 Lower: 0
 Op : ignore
 Dst ports
 Upper: 0
 Lower: 0
 Op : ignore
 Protocol: 0
 Use protocol: false
 SPI: 0x00000000
 Use SPI: false
IPSEC: Completed inbound tunnel flow rule, SPI 0x50EF49AD
Rule ID: 0x00007f05294f8180
IPSEC: New inbound decrypt rule, SPI 0x50EF49AD
 Src addr: 10.106.67.91
 Src mask: 255.255.255.255
 Dst addr: 10.106.67.90
 Dst mask: 255.255.255.255
 Src ports
 Upper: 0
 Lower: 0
 Op : ignore
 Dst ports
 Upper: 0
 Lower: 0
 Op : ignore
 Protocol: 50
 Use protocol: true
 SPI: 0x50EF49AD
 Use SPI: true
IPSEC: Completed inbound decrypt rule, SPI 0x50EF49AD
Rule ID: 0x00007f05294f7ad0
IPSEC: New inbound permit rule, SPI 0x50EF49AD
 Src addr: 10.106.67.91
 Src mask: 255.255.255.255
 Dst addr: 10.106.67.90
 Dst mask: 255.255.255.255
 Src ports
 Upper: 0
 Lower: 0
 Op : ignore
 Dst ports
 Upper: 0
 Lower: 0
 Op : ignore
 Protocol: 50
 Use protocol: true
 SPI: 0x50EF49AD
 Use SPI: true
IPSEC: Completed inbound permit rule, SPI 0x50EF49AD
Rule ID: 0x00007f05294f4510
IPSEC INFO: Destroying an IPSec timer of type SA Purge Timer
IPSEC INFO: Destroying an IPSec timer of type SA Purge Timer
Mar 15 05:41:39 [IKEv1 DEBUG]Group = 10.106.67.91, IP = 10.106.67.91, Pitcher: received KEY_UPDATE, spi 0x50ef49ad
Mar 15 05:41:39 [IKEv1 DEBUG]Group = 10.106.67.91, IP = 10.106.67.91, Starting P2 rekey timer: 24480 seconds.
Mar 15 05:41:39 [IKEv1]Group = 10.106.67.91, IP = 10.106.67.91, PHASE 2 COMPLETED (msgid=ad712fa9)

修订历史记录

版本	发布日期	备注
1.0	10-Jul-2015	初始版本

由思科工程师提供

文卡塔阿迪蒂亚B
思科TAC工程师
拉胡尔·戈文丹
思科TAC工程师
帕万·贡杜
技术咨询工程师

此文档是否有帮助?

反馈

联系我们

提交支持案例
(需要思科服务合同)