[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [FW1] VPN between Cisco2600 and FW1
Hi! my customer is planning to establish a VPN between his cisco 2600 and our Checkpoint. i configured the cisco appropriately and my FW1 for this VPN support . debugging the router returns something strang - and i do not know which failure i have made. i attached my debuging-results. would be very urgent. thanx in advance. hans Router#sh run Building configuration... Current configuration: ! version 12.0 service timestamps debug uptime service timestamps log uptime no service password-encryption ! hostname Router ! ! ! ! ! ! ip subnet-zero ! isdn voice-call-failure 0 ! ! crypto isakmp policy 10 authentication pre-share group 2 --More-- crypto isakmp key abc123 address 213.47.62.85 ! ! crypto ipsec transform-set testset esp-des esp-sha-hmac ! ! crypto map testmap 10 ipsec-isakmp set peer 213.47.62.85 set transform-set testset match address 101 ! ! controller E1 0/0 ! controller E1 0/1 ! ! ! ! ! interface FastEthernet0/0 ip address 213.164.0.54 255.255.255.0 no ip directed-broadcast duplex auto speed auto crypto map testmap ! interface FastEthernet0/1 ip address 10.10.10.1 255.255.255.0 no ip directed-broadcast no keepalive duplex auto speed auto ! ip classless ip route 0.0.0.0 0.0.0.0 213.164.0.62 no ip http server ! access-list 101 permit ip 10.10.10.0 0.0.0.255 192.168.0.0 0.0.0.255 access-list 101 permit ip 192.168.0.0 0.0.0.255 10.10.10.0 0.0.0.255 ! line con 0 transport input none line aux 0 line vty 0 4 login end Router# 01:37:58: IPSEC(key_engine): request timer fired: count = 1, (identity) local= 213.164.0.54, remote= 213.47.62.85, local_proxy= 10.10.10.0/255.255.255.0/0/0 (type=4), remote_proxy= 192.168.0.0/255.255.255.0/0/0 (type=4) 01:37:58: IPSEC(sa_request): , (key eng. msg.) src= 213.164.0.54, dest= 213.47.62.85, src_proxy= 10.10.10.0/255.255.255.0/0/0 (type=4), dest_proxy= 192.168.0.0/255.255.255.0/0/0 (type=4), protocol= ESP, transform= esp-des esp-sha-hmac , lifedur= 3600s and 4608000kb, spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x4004 01:37:58: ISAKMP (0:2): beginning Main Mode exchange 01:37:58: ISAKMP (2): sending packet to 213.47.62.85 (I) MM_NO_STATE 01:37:58: ISAKMP (2): received packet from 213.47.62.85 (I) MM_NO_STATE 01:37:58: ISAKMP (0:2): processing SA payload. message ID = 0 01:37:58: ISAKMP (0:2): Checking ISAKMP transform 1 against priority 10 policy 01:37:58: ISAKMP: encryption DES-CBC 01:37:58: ISAKMP: hash SHA 01:37:58: ISAKMP: default group 2 01:37:58: ISAKMP: auth pre-share 01:37:58: ISAKMP: life type in seconds 01:37:58: ISAKMP: life duration (basic) of 3600 01:37:58: ISAKMP (0:2): atts are acceptable. Next payload is 0 01:37:58: ISAKMP (0:2): SA is doing pre-shared key authentication 01:37:58: ISAKMP (2): SA is doing pre-shared key authentication using id type ID_IPV4_ADDR 01:37:58: ISAKMP (2): sending packet to 213.47.62.85 (I) MM_SA_SETUP 01:37:58: ISAKMP (2): received packet from 213.47.62.85 (I) MM_SA_SETUP 01:37:58: ISAKMP (0:2): processing KE payload. message ID = 0 01:37:59: ISAKMP (0:2): processing NONCE payload. message ID = 0 01:37:59: ISAKMP (0:2): SKEYID state generated 01:37:59: ISAKMP (2): ID payload next-payload : 8 type : 1 protocol : 17 port : 500 length : 8 01:37:59: ISAKMP (2): Total payload length: 12 01:37:59: ISAKMP (2): sending packet to 213.47.62.85 (I) MM_KEY_EXCH 01:37:59: ISAKMP (2): received packet from 213.47.62.85 (I) MM_KEY_EXCH 01:37:59: ISAKMP (0:2): processing ID payload. message ID = 0 01:37:59: ISAKMP (0:2): processing HASH payload. message ID = 0 01:37:59: ISAKMP (0:2): SA has been authenticated with 213.47.62.85 01:37:59: ISAKMP (0:2): beginning Quick Mode exchange, M-ID of -981931657 01:37:59: IPSEC(key_engine): got a queue event... 01:37:59: IPSEC(spi_response): getting spi 24707372 for SA from 213.47.62.85 to 213.164.0.54 for prot 3 01:37:59: ISAKMP (2): received packet from 213.47.62.85 (I) QM_IDLE 01:37:59: ISAKMP (0:2): phase 1 packet is a duplicate of a previous packet. 01:37:59: ISAKMP (0:2): retransmitting due to retransmit phase 1 01:37:59: ISAKMP (0:2): time remaining never 01:37:59: ISAKMP (0:2): current time 00:00:00 01:37:59: ISAKMP (0:2): retransmitting phase 1... 01:37:59: ISAKMP (2): received packet from 213.47.62.85 (I) QM_IDLE 01:37:59: ISAKMP (0:2): phase 1 packet is a duplicate of a previous packet. 01:37:59: ISAKMP (0:2): retransmitting due to retransmit phase 1 01:37:59: ISAKMP (0:2): time remaining never 01:37:59: ISAKMP (0:2): current time 00:00:00 01:37:59: ISAKMP (0:2): retransmitting phase 1... 01:37:59: ISAKMP (2): sending packet to 213.47.62.85 (I) QM_IDLE 01:37:59: ISAKMP (2): received packet from 213.47.62.85 (I) QM_IDLE 01:37:59: ISAKMP (2): processing NOTIFY payload 14 protocol 2 spi 24707372, message ID = -537148750 01:37:59: ISAKMP (2): deleting spi 24707372 message ID = -981931657 01:37:59: ISAKMP (0:2): deleting node -981931657 01:37:59: ISAKMP (0:2): deleting node -537148750 01:37:59: ISAKMP (0:2): processing terminal NOTIFY payload (14), protocol 2, message ID = -537148750 01:37:59: ISAKMP (0:2): deleting SA 01:37:59: ISAKMP (2): sending packet to 213.47.62.85 (I) MM_NO_STATE 01:37:59: ISAKMP (0:2): deleting node
|