Исходное сообщение
"Неработает IPSEC" Отправлено lag2010, 14-Мрт-10 13:36
Хая. Настраиваю IPSEC между двумя цисками ASA 5510 и ASA 5505. Сам туннель поднял, а вот серые сетки друг друга не видят. Если кто может помогите разобраться в проблеме. Конфиги цисок ниже xxx.xxx.xxx.xxx – внешка на 5510 yyy.yyy.yyy.yyy – внешка на 5505 5510: hostname xxx domain-name yyy enable password maBYp097k5EO6D4M encrypted passwd /nswFM5gBcizfwdB encrypted names dns-guard ! interface Ethernet0/0 speed 100 duplex full nameif outside security-level 0 ip address xxx.xxx.xxx.xxx 255.255.255.240 ! interface Ethernet0/1 shutdown no nameif no security-level no ip address ! interface Ethernet0/2 nameif inside security-level 100 ip address 192.168.0.200 255.255.255.0 ! interface Management0/0 shutdown no nameif no security-level no ip address management-only ! ftp mode passive clock timezone MSK/MSD 3 clock summer-time MSK/MDD recurring last Sun Mar 2:00 last Sun Oct 3:00 access-list inbound extended permit tcp any interface outside eq www access-list inbound extended permit udp any interface outside eq domain access-list inbound extended permit tcp any interface outside eq 3389 access-list inbound extended permit tcp any interface outside eq ssh access-list inbound extended permit tcp any interface outside eq smtp access-list inbound extended permit tcp any interface outside eq 2546 access-list inbound extended permit tcp any interface outside eq 807 access-list inbound extended permit tcp any interface outside eq 8086 access-list inbound extended permit tcp any interface outside eq domain access-list inbound extended permit tcp any interface outside eq 995 access-list inbound extended permit tcp any interface outside eq pop3 access-list inbound extended permit tcp any interface outside eq 465 access-list inbound extended permit icmp any any access-list inbound extended permit icmp any any echo-reply access-list inbound extended permit icmp any any echo access-list inbound extended permit icmp any any unreachable access-list inbound extended permit icmp any any time-exceeded access-list inbound extended permit tcp any interface outside eq ftp access-list inbound extended permit tcp any interface outside eq ftp-data access-list inbound extended permit tcp any interface outside eq 8085 access-list inbound extended permit esp any any access-list inbound extended permit tcp any interface outside eq https access-list mss-list extended permit ip any any access-list inside_nat0_outbound extended permit ip 192.168.0.0 255.255.255.0 192.168.21.0 255.255.255.0 access-list outside_nat0_inbound extended permit ip interface outside host yyy.yyy.yyy.yyy access-list outside_cryptomap_20 extended permit ip 192.168.0.0 255.255.255.0 192.168.21.0 255.255.255.0 ! tcp-map mss-map   exceed-mss allow ! pager lines 24 logging enable logging console debugging logging monitor debugging mtu outside 1500 mtu inside 1500 asdm image disk0:/asdm-508.bin no asdm history enable arp timeout 14400 global (outside) 1 interface nat (outside) 0 access-list outside_nat0_inbound outside nat (inside) 0 access-list inside_nat0_outbound nat (inside) 1 192.168.0.0 255.255.255.0 route outside 0.0.0.0 0.0.0.0 xxx.xxx.xxx.(xxx-1) 1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00 timeout uauth 0:05:00 absolute username cisco password 3USUcOPFUiMCO4Jk encrypted http server enable http 0.0.0.0 0.0.0.0 outside http 192.168.0.0 255.255.255.0 inside no snmp-server location no snmp-server contact snmp-server enable traps snmp authentication linkup linkdown coldstart crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac crypto ipsec security-association lifetime seconds 28800 crypto ipsec security-association lifetime kilobytes 4608000 crypto map outside_map_1 20 match address outside_cryptomap_20 crypto map outside_map_1 20 set peer yyy.yyy.yyy.yyy crypto map outside_map_1 20 set transform-set ESP-3DES-SHA crypto map outside_map_1 20 set security-association lifetime seconds 28800 crypto map outside_map_1 20 set security-association lifetime kilobytes 4608000 crypto map outside_map_1 interface outside isakmp identity auto isakmp enable outside isakmp policy 10 authentication pre-share isakmp policy 10 encryption 3des isakmp policy 10 hash sha isakmp policy 10 group 2 isakmp policy 10 lifetime 86400 tunnel-group yyy.yyy.yyy.yyy type ipsec-l2l tunnel-group yyy.yyy.yyy.yyy ipsec-attributes pre-shared-key * telnet 192.168.0.0 255.255.255.0 inside telnet timeout 30 ssh 0.0.0.0 0.0.0.0 outside ssh 192.168.0.0 255.255.255.0 inside ssh timeout 30 ssh version 2 console timeout 0 management-access outside ! class-map global-class match any class-map inspection_default match default-inspection-traffic class-map mss-class match access-list mss-list ! ! policy-map global_policy class inspection_default   inspect dns maximum-length 512   inspect ftp   inspect h323 h225   inspect h323 ras   inspect rsh   inspect rtsp   inspect esmtp   inspect sqlnet   inspect skinny   inspect sunrpc   inspect xdmcp   inspect sip   inspect netbios   inspect tftp policy-map mss-class class mss-class   set connection advanced-options mss-map ! service-policy global_policy global service-policy mss-class interface outside Cryptochecksum:c954e6733ceb6dd806f00ab19decea05 : end 5505: hostname zzz domain-name yyy enable password maBYp097k5EO6D4M encrypted passwd maBYp097k5EO6D4M encrypted names dns-guard ! interface Vlan1 nameif inside security-level 100 ip address 192.168.21.1 255.255.255.0 ! interface Vlan2 nameif outside security-level 0 ip address yyy.yyy.yyy.yyy 255.255.255.240 ! interface Ethernet0/0 switchport access vlan 2 ! interface Ethernet0/1 description Lan1 speed 100 duplex full ! interface Ethernet0/2 description Lan2 speed 100 duplex full ! interface Ethernet0/3 description Lan3 speed 100 duplex full ! interface Ethernet0/4 description Lan4 speed 100 duplex full ! interface Ethernet0/5 shutdown ! interface Ethernet0/6 shutdown ! interface Ethernet0/7 shutdown ! ftp mode passive dns server-group DefaultDNS domain-name osgrm.ru access-list inbound extended permit icmp any any access-list inbound extended permit icmp any any echo-reply access-list inbound extended permit icmp any any echo access-list inbound extended permit icmp any any unreachable access-list inbound extended permit icmp any any time-exceeded access-list inbound extended permit tcp any interface outside eq www access-list inbound extended permit udp any interface outside eq domain access-list inbound extended permit tcp any interface outside eq 3389 access-list inbound extended permit tcp any interface outside eq ssh access-list inbound extended permit tcp any interface outside eq smtp access-list inbound extended permit tcp any interface outside eq 2546 access-list inbound extended permit tcp any interface outside eq 807 access-list inbound extended permit tcp any interface outside eq 8086 access-list inbound extended permit tcp any interface outside eq domain access-list inbound extended permit tcp any interface outside eq 995 access-list inbound extended permit tcp any interface outside eq pop3 access-list inbound extended permit tcp any interface outside eq 465 access-list inbound extended permit tcp any interface outside eq telnet access-list inbound extended permit tcp any interface outside eq https access-list mss-list extended permit ip any any access-list inside_nat0_outbound extended permit ip 192.168.21.0 255.255.255.0 192.168.0.0 255.255.255.0 access-list outside_1_cryptomap extended permit ip 192.168.21.0 255.255.255.0 192.168.0.0 255.255.255.0 access-list outbound extended permit ip any host xxx.xxx.xxx.xxx access-list outbound extended permit udp any any access-list outbound extended deny ip any any access-list outside_nat0_inbound extended permit ip host yyy.yyy.yyy.yyy host xxx.xxx.xxx.xxx ! tcp-map mss-map ! pager lines 24 logging enable logging console debugging logging monitor debugging mtu inside 1500 mtu outside 1500 icmp unreachable rate-limit 1 burst-size 1 asdm image disk0:/asdm-524.bin no asdm history enable arp timeout 14400 global (outside) 1 interface nat (inside) 0 access-list inside_nat0_outbound nat (inside) 1 192.168.21.0 255.255.255.0 nat (outside) 0 access-list outside_nat0_inbound outside static (inside,outside) tcp interface 3389 192.168.21.4 3389 netmask 255.255.255.255 route outside 0.0.0.0 0.0.0.0 yyy.yyy.yyy.(yyy-1) 1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute http server enable http 192.168.21.0 255.255.255.0 inside http 0.0.0.0 0.0.0.0 outside no snmp-server location no snmp-server contact snmp-server enable traps snmp authentication linkup linkdown coldstart crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac crypto map outside_map 1 match address outside_1_cryptomap crypto map outside_map 1 set peer xxx.xxx.xxx.xxx crypto map outside_map 1 set transform-set ESP-3DES-SHA crypto map outside_map interface outside crypto isakmp enable outside crypto isakmp policy 10 authentication pre-share encryption 3des hash sha group 2 lifetime 86400 telnet 192.168.21.0 255.255.255.0 inside telnet timeout 30 ssh 192.168.21.0 255.255.255.0 inside ssh 0.0.0.0 0.0.0.0 outside ssh timeout 30 ssh version 2 console timeout 0 management-access outside dhcpd dns 83.242.139.10 192.168.0.2 ! dhcpd address 192.168.21.2-192.168.21.128 inside dhcpd option 3 ip 192.168.21.1 interface inside dhcpd enable inside ! username Cisco password 9ViKxX39JvevUOV0 encrypted tunnel-group xxx.xxx.xxx.xxx type ipsec-l2l tunnel-group xxx.xxx.xxx.xxx ipsec-attributes pre-shared-key * ! class-map global-class match any class-map inspection_default match default-inspection-traffic class-map mss-class match access-list mss-list ! ! policy-map global_policy class inspection_default inspect h323 h225 inspect h323 ras inspect rsh inspect rtsp inspect ftp inspect esmtp inspect sqlnet inspect skinny inspect sunrpc inspect xdmcp inspect sip inspect netbios inspect tftp policy-map mss-class class mss-class set connection advanced-options mss-map ! service-policy global_policy global service-policy mss-class interface outside prompt hostname context Cryptochecksum:3d2c67ce3bec58758e3e41fb80ad4af6 : end

Ваше сообщение
Имя*:
EMail:	Для отправки новых сообщений в текущей нити на email укажите знак ! перед адресом, например, !user@host.ru (!! - не показывать email). Более тонкая настройка отправки ответов производится в профиле зарегистрированного участника форума.
Заголовок*:
Сообщение*:	> Хая. > Настраиваю IPSEC между двумя цисками ASA 5510 и ASA 5505. Сам туннель > поднял, а вот серые сетки друг друга не видят. Если кто > может помогите разобраться в проблеме. Конфиги цисок ниже > xxx.xxx.xxx.xxx – внешка на 5510 > yyy.yyy.yyy.yyy – внешка на 5505 > 5510: > hostname xxx > domain-name yyy > enable password maBYp097k5EO6D4M encrypted > passwd /nswFM5gBcizfwdB encrypted > names > dns-guard > ! > interface Ethernet0/0 > speed 100 > duplex full > nameif outside > security-level 0 > ip address xxx.xxx.xxx.xxx 255.255.255.240 > ! > interface Ethernet0/1 > shutdown > no nameif > no security-level > no ip address > ! > interface Ethernet0/2 > nameif inside > security-level 100 > ip address 192.168.0.200 255.255.255.0 > ! > interface Management0/0 > shutdown > no nameif > no security-level > no ip address > management-only > ! > ftp mode passive > clock timezone MSK/MSD 3 > clock summer-time MSK/MDD recurring last Sun Mar 2:00 last Sun Oct 3:00 > access-list inbound extended permit tcp any interface outside eq www > access-list inbound extended permit udp any interface outside eq domain > access-list inbound extended permit tcp any interface outside eq 3389 > access-list inbound extended permit tcp any interface outside eq ssh > access-list inbound extended permit tcp any interface outside eq smtp > access-list inbound extended permit tcp any interface outside eq 2546 > access-list inbound extended permit tcp any interface outside eq 807 > access-list inbound extended permit tcp any interface outside eq 8086 > access-list inbound extended permit tcp any interface outside eq domain > access-list inbound extended permit tcp any interface outside eq 995 > access-list inbound extended permit tcp any interface outside eq pop3 > access-list inbound extended permit tcp any interface outside eq 465 > access-list inbound extended permit icmp any any > access-list inbound extended permit icmp any any echo-reply > access-list inbound extended permit icmp any any echo > access-list inbound extended permit icmp any any unreachable > access-list inbound extended permit icmp any any time-exceeded > access-list inbound extended permit tcp any interface outside eq ftp > access-list inbound extended permit tcp any interface outside eq ftp-data > access-list inbound extended permit tcp any interface outside eq 8085 > access-list inbound extended permit esp any any > access-list inbound extended permit tcp any interface outside eq https > access-list mss-list extended permit ip any any > access-list inside_nat0_outbound extended permit ip 192.168.0.0 255.255.255.0 192.168.21.0 > 255.255.255.0 > access-list outside_nat0_inbound extended permit ip interface outside host yyy.yyy.yyy.yyy > access-list outside_cryptomap_20 extended permit ip 192.168.0.0 255.255.255.0 192.168.21.0 > 255.255.255.0 > ! > tcp-map mss-map > exceed-mss allow > ! > pager lines 24 > logging enable > logging console debugging > logging monitor debugging > mtu outside 1500 > mtu inside 1500 > asdm image disk0:/asdm-508.bin > no asdm history enable > arp timeout 14400 > global (outside) 1 interface > nat (outside) 0 access-list outside_nat0_inbound outside > nat (inside) 0 access-list inside_nat0_outbound > nat (inside) 1 192.168.0.0 255.255.255.0 > route outside 0.0.0.0 0.0.0.0 xxx.xxx.xxx.(xxx-1) 1 > timeout xlate 3:00:00 > timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 > timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 > timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00 > timeout uauth 0:05:00 absolute > username cisco password 3USUcOPFUiMCO4Jk encrypted > http server enable > http 0.0.0.0 0.0.0.0 outside > http 192.168.0.0 255.255.255.0 inside > no snmp-server location > no snmp-server contact > snmp-server enable traps snmp authentication linkup linkdown coldstart > crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac > crypto ipsec security-association lifetime seconds 28800 > crypto ipsec security-association lifetime kilobytes 4608000 > crypto map outside_map_1 20 match address outside_cryptomap_20 > crypto map outside_map_1 20 set peer yyy.yyy.yyy.yyy > crypto map outside_map_1 20 set transform-set ESP-3DES-SHA > crypto map outside_map_1 20 set security-association lifetime seconds 28800 > crypto map outside_map_1 20 set security-association lifetime kilobytes 4608000 > crypto map outside_map_1 interface outside > isakmp identity auto > isakmp enable outside > isakmp policy 10 authentication pre-share > isakmp policy 10 encryption 3des > isakmp policy 10 hash sha > isakmp policy 10 group 2 > isakmp policy 10 lifetime 86400 > tunnel-group yyy.yyy.yyy.yyy type ipsec-l2l > tunnel-group yyy.yyy.yyy.yyy ipsec-attributes > pre-shared-key * > telnet 192.168.0.0 255.255.255.0 inside > telnet timeout 30 > ssh 0.0.0.0 0.0.0.0 outside > ssh 192.168.0.0 255.255.255.0 inside > ssh timeout 30 > ssh version 2 > console timeout 0 > management-access outside > ! > class-map global-class > match any > class-map inspection_default > match default-inspection-traffic > class-map mss-class > match access-list mss-list > ! > ! > policy-map global_policy > class inspection_default > inspect dns maximum-length 512 > inspect ftp > inspect h323 h225 > inspect h323 ras > inspect rsh > inspect rtsp > inspect esmtp > inspect sqlnet > inspect skinny > inspect sunrpc > inspect xdmcp > inspect sip > inspect netbios > inspect tftp > policy-map mss-class > class mss-class > set connection advanced-options mss-map > ! > service-policy global_policy global > service-policy mss-class interface outside > Cryptochecksum:c954e6733ceb6dd806f00ab19decea05 > : end > 5505: > hostname zzz > domain-name yyy > enable password maBYp097k5EO6D4M encrypted > passwd maBYp097k5EO6D4M encrypted > names > dns-guard > ! > interface Vlan1 > nameif inside > security-level 100 > ip address 192.168.21.1 255.255.255.0 > ! > interface Vlan2 > nameif outside > security-level 0 > ip address yyy.yyy.yyy.yyy 255.255.255.240 > ! > interface Ethernet0/0 > switchport access vlan 2 > ! > interface Ethernet0/1 > description Lan1 > speed 100 > duplex full > ! > interface Ethernet0/2 > description Lan2 > speed 100 > duplex full > ! > interface Ethernet0/3 > description Lan3 > speed 100 > duplex full > ! > interface Ethernet0/4 > description Lan4 > speed 100 > duplex full > ! > interface Ethernet0/5 > shutdown > ! > interface Ethernet0/6 > shutdown > ! > interface Ethernet0/7 > shutdown > ! > ftp mode passive > dns server-group DefaultDNS > domain-name osgrm.ru > access-list inbound extended permit icmp any any > access-list inbound extended permit icmp any any echo-reply > access-list inbound extended permit icmp any any echo > access-list inbound extended permit icmp any any unreachable > access-list inbound extended permit icmp any any time-exceeded > access-list inbound extended permit tcp any interface outside eq www > access-list inbound extended permit udp any interface outside eq domain > access-list inbound extended permit tcp any interface outside eq 3389 > access-list inbound extended permit tcp any interface outside eq ssh > access-list inbound extended permit tcp any interface outside eq smtp > access-list inbound extended permit tcp any interface outside eq 2546 > access-list inbound extended permit tcp any interface outside eq 807 > access-list inbound extended permit tcp any interface outside eq 8086 > access-list inbound extended permit tcp any interface outside eq domain > access-list inbound extended permit tcp any interface outside eq 995 > access-list inbound extended permit tcp any interface outside eq pop3 > access-list inbound extended permit tcp any interface outside eq 465 > access-list inbound extended permit tcp any interface outside eq telnet > access-list inbound extended permit tcp any interface outside eq https > access-list mss-list extended permit ip any any > access-list inside_nat0_outbound extended permit ip 192.168.21.0 255.255.255.0 192.168.0.0 > 255.255.255.0 > access-list outside_1_cryptomap extended permit ip 192.168.21.0 255.255.255.0 192.168.0.0 > 255.255.255.0 > access-list outbound extended permit ip any host xxx.xxx.xxx.xxx > access-list outbound extended permit udp any any > access-list outbound extended deny ip any any > access-list outside_nat0_inbound extended permit ip host yyy.yyy.yyy.yyy host xxx.xxx.xxx.xxx > ! > tcp-map mss-map > ! > pager lines 24 > logging enable > logging console debugging > logging monitor debugging > mtu inside 1500 > mtu outside 1500 > icmp unreachable rate-limit 1 burst-size 1 > asdm image disk0:/asdm-524.bin > no asdm history enable > arp timeout 14400 > global (outside) 1 interface > nat (inside) 0 access-list inside_nat0_outbound > nat (inside) 1 192.168.21.0 255.255.255.0 > nat (outside) 0 access-list outside_nat0_inbound outside > static (inside,outside) tcp interface 3389 192.168.21.4 3389 netmask 255.255.255.255 > route outside 0.0.0.0 0.0.0.0 yyy.yyy.yyy.(yyy-1) 1 > timeout xlate 3:00:00 > timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 > timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 > timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 > timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute > http server enable > http 192.168.21.0 255.255.255.0 inside > http 0.0.0.0 0.0.0.0 outside > no snmp-server location > no snmp-server contact > snmp-server enable traps snmp authentication linkup linkdown coldstart > crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac > crypto map outside_map 1 match address outside_1_cryptomap > crypto map outside_map 1 set peer xxx.xxx.xxx.xxx > crypto map outside_map 1 set transform-set ESP-3DES-SHA > crypto map outside_map interface outside > crypto isakmp enable outside > crypto isakmp policy 10 > authentication pre-share > encryption 3des > hash sha > group 2 > lifetime 86400 > telnet 192.168.21.0 255.255.255.0 inside > telnet timeout 30 > ssh 192.168.21.0 255.255.255.0 inside > ssh 0.0.0.0 0.0.0.0 outside > ssh timeout 30 > ssh version 2 > console timeout 0 > management-access outside > dhcpd dns 83.242.139.10 192.168.0.2 > ! > dhcpd address 192.168.21.2-192.168.21.128 inside > dhcpd option 3 ip 192.168.21.1 interface inside > dhcpd enable inside > ! > username Cisco password 9ViKxX39JvevUOV0 encrypted > tunnel-group xxx.xxx.xxx.xxx type ipsec-l2l > tunnel-group xxx.xxx.xxx.xxx ipsec-attributes > pre-shared-key * > ! > class-map global-class > match any > class-map inspection_default > match default-inspection-traffic > class-map mss-class > match access-list mss-list > ! > ! > policy-map global_policy > class inspection_default > inspect h323 h225 > inspect h323 ras > inspect rsh > inspect rtsp > inspect ftp > inspect esmtp > inspect sqlnet > inspect skinny > inspect sunrpc > inspect xdmcp > inspect sip > inspect netbios > inspect tftp > policy-map mss-class > class mss-class > set connection advanced-options mss-map > ! > service-policy global_policy global > service-policy mss-class interface outside > prompt hostname context > Cryptochecksum:3d2c67ce3bec58758e3e41fb80ad4af6 > : end
	Введите код, изображенный на картинке: