Исходное сообщение
"Настройка failover VPN между ASA 5500 и 3825" Отправлено manoff, 20-Май-09 04:02
Приветствую всех участников. Есть следующая конфигурация 1. Cisco IOS Software, 3800 Software (C3825-ADVENTERPRISEK9-M), Version 12.4(22)T​ 2. ​и ASA Cisco Adaptive Security Appliance Software Version 7.2(4) Licensed features for this platform: Maximum Physical Interfaces : 8 VLANs                       : 3, DMZ Restricted Inside Hosts                : 50 Failover                    : Disabled VPN-DES                     : Enabled VPN-3DES-AES                : Enabled VPN Peers                   : 10 WebVPN Peers                : 2 Dual ISPs                   : Disabled VLAN Trunk Ports            : 0 Проблема в следующем, в филиале где стоит ASA очень падучий канал, поэтому взят в качестве резервного еще один провайдер. Настроен через sla согласно http://cisco.com/en/US/products/hw/vpndevc/ps2030/products_c... Все отлично, работает, но проблема осталась в перебросе VPN Site-2-site на 3825 добавил второй peer в криптомап crypto map SDM_CMAP_1 2 ipsec-isakmp description Tunnel Neftevetka set peer X.X.X.X set peer Y.Y.Y.Y set transform-set neftevetka set pfs group2 match address 107 А так-же по данной ссылке http://www.cisco.com/en/US/docs/ios/12_3t/12_3t2/feature/gui... прописал crypto isakmp invalid-spi-recovery На ASA создал второй тунель через новый интерфейс привожу всю конфигу там где IP забил звездами - второй тунель, его пока не трогаю. ASA Version 7.2(4) ! hostname ciscoasa domain-name zaotmk.ru enable password GXCy2O.4seXczOLS encrypted passwd GXCy2O.4seXczOLS encrypted names name X.X.X.X External name 192.168.1.222 Dobrov ! interface Vlan1 nameif inside security-level 100 ip address 192.168.1.254 255.255.255.0 ospf cost 10 ! interface Vlan2 nameif outside security-level 0 pppoe client vpdn group dsl ip address External 255.255.255.255 pppoe setroute ospf cost 10 ! interface Vlan3 no forward interface Vlan2 nameif enforta security-level 0 ip address Y.Y.Y.Y 255.255.255.252 ! interface Ethernet0/0 switchport access vlan 2 ! interface Ethernet0/1 switchport access vlan 3 ! interface Ethernet0/2 ! interface Ethernet0/3 ! interface Ethernet0/4 ! interface Ethernet0/5 ! interface Ethernet0/6 ! interface Ethernet0/7 ! ftp mode passive clock timezone VLAST 10 clock summer-time VLADT recurring last Sun Mar 2:00 last Sun Oct 3:00 dns domain-lookup inside dns domain-lookup outside dns domain-lookup enforta dns server-group DefaultDNS name-server 212.122.1.2 name-server 212.122.17.132 name-server 87.241.223.68 domain-name *****.ru object-group service Radmin tcp description Remote Administrator port-object eq 4899 access-list inside_access_in extended permit icmp any any access-list inside_access_in extended permit ip any any access-list outside_access_in extended permit tcp any any object-group Radmin access-list outside_access_in extended permit icmp any host External access-list outside_1_cryptomap extended permit ip 192.168.1.0 255.255.255.0 192.168.9.0 255.255.255.0 access-list inside_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 192.168.9.0 255.255.255.0 access-list inside_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 192.168.3.0 255.255.255.0 access-list outside_2_cryptomap extended permit ip 192.168.1.0 255.255.255.0 192.168.3.0 255.255.255.0 access-list enforta_access_in extended permit tcp any any object-group Radmin access-list enforta_access_in extended permit icmp any any access-list enforta_cryptomap_1 extended permit ip 192.168.1.0 255.255.255.0 192.168.9.0 255.255.255.0 pager lines 24 logging enable logging asdm informational mtu inside 1500 mtu outside 1500 mtu enforta 1500 icmp unreachable rate-limit 1 burst-size 1 asdm image disk0:/asdm-524.bin no asdm history enable arp timeout 14400 global (outside) 1 interface global (enforta) 1 interface nat (inside) 0 access-list inside_nat0_outbound nat (inside) 1 0.0.0.0 0.0.0.0 static (inside,outside) tcp interface 4899 Dobrov 4899 netmask 255.255.255.255 static (inside,enforta) tcp interface 4899 Dobrov 4899 netmask 255.255.255.255 access-group inside_access_in in interface inside access-group outside_access_in in interface outside access-group enforta_access_in in interface enforta route outside 0.0.0.0 0.0.0.0 10.1.1.6 1 track 1 route enforta 0.0.0.0 0.0.0.0 Y.Y.Y.173 254 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute http server enable http 192.168.1.0 255.255.255.0 inside http 192.168.9.0 255.255.255.0 inside no snmp-server location no snmp-server contact snmp-server enable traps snmp authentication linkup linkdown coldstart sla monitor 1 type echo protocol ipIcmpEcho 212.122.1.2 interface outside num-packets 3 frequency 10 sla monitor schedule 1 life forever start-time now crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac crypto map outside_map 1 match address outside_1_cryptomap crypto map outside_map 1 set pfs crypto map outside_map 1 set peer Z.Z.Z.Z crypto map outside_map 1 set transform-set ESP-3DES-MD5 crypto map outside_map 2 match address outside_2_cryptomap crypto map outside_map 2 set pfs crypto map outside_map 2 set peer ********* crypto map outside_map 2 set transform-set ESP-3DES-MD5 crypto map outside_map interface outside crypto map enforta_map 1 match address enforta_cryptomap_1 crypto map enforta_map 1 set pfs crypto map enforta_map 1 set peer Z.Z.Z.Z crypto map enforta_map 1 set transform-set ESP-DES-MD5 crypto map enforta_map interface enforta crypto isakmp enable outside crypto isakmp enable enforta crypto isakmp policy 10 authentication pre-share encryption 3des hash md5 group 2 lifetime 86400 ! track 1 rtr 1 reachability telnet 192.168.1.0 255.255.255.0 inside telnet 192.168.3.0 255.255.255.0 inside telnet 192.168.9.0 255.255.255.0 inside telnet timeout 5 ssh timeout 5 console timeout 0 management-access inside vpdn group dsl request dialout pppoe vpdn group dsl localname pppoe-009005 vpdn group dsl ppp authentication pap vpdn username pppoe-009005 password ********* store-local dhcpd address 192.168.1.100-192.168.1.150 inside dhcpd dns 192.168.1.10 212.122.1.2 interface inside dhcpd lease 36000 interface inside dhcpd ping_timeout 750 interface inside dhcpd domain ******.ru interface inside dhcpd enable inside ! vpnclient server ********* vpnclient mode client-mode vpnclient vpngroup vpn password ******** vpnclient username VladVPN password ******** webvpn csd image disk0:/securedesktop-asa-3.2.1.103-k9.pkg username critick password zVMee9K83qp6BUz7 encrypted privilege 15 username manoff password HO.q7.xhq/kvPT04 encrypted privilege 15 username root password qkgq.0uFzuA9tDBm encrypted privilege 15 tunnel-group Z.Z.Z.Z type ipsec-l2l tunnel-group Z.Z.Z.Z ipsec-attributes pre-shared-key * tunnel-group ********** type ipsec-l2l tunnel-group ********** ipsec-attributes pre-shared-key * ! class-map inspection_default match default-inspection-traffic ! ! policy-map type inspect dns preset_dns_map parameters   message-length maximum 512 policy-map global_policy class inspection_default   inspect dns preset_dns_map   inspect ftp   inspect h323 h225   inspect h323 ras   inspect rsh   inspect rtsp   inspect esmtp   inspect sqlnet   inspect skinny   inspect sunrpc   inspect xdmcp   inspect sip   inspect netbios   inspect tftp ! service-policy global_policy global prompt hostname context sh crypto isa sa с роутера до падения канала основного провайдера IPv4 Crypto ISAKMP SA dst             src             state          conn-id status Z.Z.Z.Z      ************     QM_IDLE           1538 ACTIVE Z.Z.Z.Z      X.X.X.X          QM_IDLE           1536 ACTIVE После падения канала добавляются две строки Z.Z.Z.Z      Y.Y.Y.Y   QM_IDLE           1542 ACTIVE Z.Z.Z.Z      Y.Y.Y.Y   MM_NO_STATE       1541 ACTIVE (deleted) еще через некоторое время первая строка тоже Deleted при всем при этом с упавшим пиром все это время Z.Z.Z.Z      X.X.X.X          QM_IDLE           1536 ACTIVE Что означает последня ума не приложу. Что посоветуете еще посмотреть? Может кто ошибку видит?

Ваше сообщение
Имя*:
EMail:	Для отправки новых сообщений в текущей нити на email укажите знак ! перед адресом, например, !user@host.ru (!! - не показывать email). Более тонкая настройка отправки ответов производится в профиле зарегистрированного участника форума.
Заголовок*:
Сообщение*:	> Приветствую всех участников. Есть следующая конфигурация > 1. Cisco IOS Software, 3800 Software (C3825-ADVENTERPRISEK9-M), Version 12.4(22)T​ > 2. ​и ASA Cisco Adaptive Security Appliance Software Version 7.2(4) > Licensed features for this platform: > Maximum Physical Interfaces : 8 > VLANs > > : 3, DMZ Restricted > Inside Hosts > : 50 > Failover > : Disabled > VPN-DES > : Enabled > VPN-3DES-AES > : Enabled > VPN Peers > : 10 > WebVPN Peers > : 2 > Dual ISPs > : Disabled > VLAN Trunk Ports > : 0 > Проблема в следующем, в филиале где стоит ASA очень падучий канал, поэтому > взят в качестве резервного еще один провайдер. Настроен через sla согласно > http://cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00806e880b.shtml#intro > Все отлично, работает, но проблема осталась в перебросе VPN Site-2-site > на 3825 добавил второй peer в криптомап > crypto map SDM_CMAP_1 2 ipsec-isakmp > description Tunnel Neftevetka > set peer X.X.X.X > set peer Y.Y.Y.Y > set transform-set neftevetka > set pfs group2 > match address 107 > А так-же по данной ссылке http://www.cisco.com/en/US/docs/ios/12_3t/12_3t2/feature/guide/gt_ispir.html > прописал > crypto isakmp invalid-spi-recovery > На ASA создал второй тунель через новый интерфейс > привожу всю конфигу там где IP забил звездами - второй тунель, его > пока не трогаю. > ASA Version 7.2(4) > ! > hostname ciscoasa > domain-name zaotmk.ru > enable password GXCy2O.4seXczOLS encrypted > passwd GXCy2O.4seXczOLS encrypted > names > name X.X.X.X External > name 192.168.1.222 Dobrov > ! > interface Vlan1 > nameif inside > security-level 100 > ip address 192.168.1.254 255.255.255.0 > ospf cost 10 > ! > interface Vlan2 > nameif outside > security-level 0 > pppoe client vpdn group dsl > ip address External 255.255.255.255 pppoe setroute > ospf cost 10 > ! > interface Vlan3 > no forward interface Vlan2 > nameif enforta > security-level 0 > ip address Y.Y.Y.Y 255.255.255.252 > ! > interface Ethernet0/0 > switchport access vlan 2 > ! > interface Ethernet0/1 > switchport access vlan 3 > ! > interface Ethernet0/2 > ! > interface Ethernet0/3 > ! > interface Ethernet0/4 > ! > interface Ethernet0/5 > ! > interface Ethernet0/6 > ! > interface Ethernet0/7 > ! > ftp mode passive > clock timezone VLAST 10 > clock summer-time VLADT recurring last Sun Mar 2:00 last Sun Oct 3:00 > dns domain-lookup inside > dns domain-lookup outside > dns domain-lookup enforta > dns server-group DefaultDNS > name-server 212.122.1.2 > name-server 212.122.17.132 > name-server 87.241.223.68 > domain-name *****.ru > object-group service Radmin tcp > description Remote Administrator > port-object eq 4899 > access-list inside_access_in extended permit icmp any any > access-list inside_access_in extended permit ip any any > access-list outside_access_in extended permit tcp any any object-group Radmin > access-list outside_access_in extended permit icmp any host External > access-list outside_1_cryptomap extended permit ip 192.168.1.0 255.255.255.0 192.168.9.0 > 255.255.255.0 > access-list inside_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 192.168.9.0 > 255.255.255.0 > access-list inside_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 192.168.3.0 > 255.255.255.0 > access-list outside_2_cryptomap extended permit ip 192.168.1.0 255.255.255.0 192.168.3.0 > 255.255.255.0 > access-list enforta_access_in extended permit tcp any any object-group Radmin > access-list enforta_access_in extended permit icmp any any > access-list enforta_cryptomap_1 extended permit ip 192.168.1.0 255.255.255.0 192.168.9.0 > 255.255.255.0 > pager lines 24 > logging enable > logging asdm informational > mtu inside 1500 > mtu outside 1500 > mtu enforta 1500 > icmp unreachable rate-limit 1 burst-size 1 > asdm image disk0:/asdm-524.bin > no asdm history enable > arp timeout 14400 > global (outside) 1 interface > global (enforta) 1 interface > nat (inside) 0 access-list inside_nat0_outbound > nat (inside) 1 0.0.0.0 0.0.0.0 > static (inside,outside) tcp interface 4899 Dobrov 4899 netmask 255.255.255.255 > static (inside,enforta) tcp interface 4899 Dobrov 4899 netmask 255.255.255.255 > access-group inside_access_in in interface inside > access-group outside_access_in in interface outside > access-group enforta_access_in in interface enforta > route outside 0.0.0.0 0.0.0.0 10.1.1.6 1 track 1 > route enforta 0.0.0.0 0.0.0.0 Y.Y.Y.173 254 > timeout xlate 3:00:00 > timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 > timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 > timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 > timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute > http server enable > http 192.168.1.0 255.255.255.0 inside > http 192.168.9.0 255.255.255.0 inside > no snmp-server location > no snmp-server contact > snmp-server enable traps snmp authentication linkup linkdown coldstart > sla monitor 1 > type echo protocol ipIcmpEcho 212.122.1.2 interface outside > num-packets 3 > frequency 10 > sla monitor schedule 1 life forever start-time now > crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac > crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac > crypto map outside_map 1 match address outside_1_cryptomap > crypto map outside_map 1 set pfs > crypto map outside_map 1 set peer Z.Z.Z.Z > crypto map outside_map 1 set transform-set ESP-3DES-MD5 > crypto map outside_map 2 match address outside_2_cryptomap > crypto map outside_map 2 set pfs > crypto map outside_map 2 set peer ********* > crypto map outside_map 2 set transform-set ESP-3DES-MD5 > crypto map outside_map interface outside > crypto map enforta_map 1 match address enforta_cryptomap_1 > crypto map enforta_map 1 set pfs > crypto map enforta_map 1 set peer Z.Z.Z.Z > crypto map enforta_map 1 set transform-set ESP-DES-MD5 > crypto map enforta_map interface enforta > crypto isakmp enable outside > crypto isakmp enable enforta > crypto isakmp policy 10 > authentication pre-share > encryption 3des > hash md5 > group 2 > lifetime 86400 > ! > track 1 rtr 1 reachability > telnet 192.168.1.0 255.255.255.0 inside > telnet 192.168.3.0 255.255.255.0 inside > telnet 192.168.9.0 255.255.255.0 inside > telnet timeout 5 > ssh timeout 5 > console timeout 0 > management-access inside > vpdn group dsl request dialout pppoe > vpdn group dsl localname pppoe-009005 > vpdn group dsl ppp authentication pap > vpdn username pppoe-009005 password ********* store-local > dhcpd address 192.168.1.100-192.168.1.150 inside > dhcpd dns 192.168.1.10 212.122.1.2 interface inside > dhcpd lease 36000 interface inside > dhcpd ping_timeout 750 interface inside > dhcpd domain ******.ru interface inside > dhcpd enable inside > ! > vpnclient server ********* > vpnclient mode client-mode > vpnclient vpngroup vpn password ******** > vpnclient username VladVPN password ******** > webvpn > csd image disk0:/securedesktop-asa-3.2.1.103-k9.pkg > username critick password zVMee9K83qp6BUz7 encrypted privilege 15 > username manoff password HO.q7.xhq/kvPT04 encrypted privilege 15 > username root password qkgq.0uFzuA9tDBm encrypted privilege 15 > tunnel-group Z.Z.Z.Z type ipsec-l2l > tunnel-group Z.Z.Z.Z ipsec-attributes > pre-shared-key * > tunnel-group ********** type ipsec-l2l > tunnel-group ********** ipsec-attributes > pre-shared-key * > ! > class-map inspection_default > match default-inspection-traffic > ! > ! > policy-map type inspect dns preset_dns_map > parameters > message-length maximum 512 > policy-map global_policy > class inspection_default > inspect dns preset_dns_map > inspect ftp > inspect h323 h225 > inspect h323 ras > inspect rsh > inspect rtsp > inspect esmtp > inspect sqlnet > inspect skinny > inspect sunrpc > inspect xdmcp > inspect sip > inspect netbios > inspect tftp > ! > service-policy global_policy global > prompt hostname context > sh crypto isa sa с роутера до падения канала основного провайдера > IPv4 Crypto ISAKMP SA > dst > src > state > conn-id status > Z.Z.Z.Z ************ QM_IDLE > 1538 > ACTIVE > Z.Z.Z.Z X.X.X.X > QM_IDLE > 1536 ACTIVE > После падения канала добавляются две строки > Z.Z.Z.Z Y.Y.Y.Y QM_IDLE > 1542 ACTIVE > Z.Z.Z.Z Y.Y.Y.Y MM_NO_STATE > 1541 ACTIVE (deleted) > еще через некоторое время первая строка тоже Deleted > при всем при этом с упавшим пиром все это время > Z.Z.Z.Z X.X.X.X > QM_IDLE > 1536 ACTIVE > Что означает последня ума не приложу. Что посоветуете еще посмотреть? Может кто > ошибку видит?
	Введите код, изображенный на картинке: