ситуация: есть комп (Дебиан 4.0), есть Cisco PIX. Между ними по средствам isakmp нужно настроить туннель. Cisco PIX не я настраивал.
Вот как она настроена:
access-list cp299 permit ip host 83.149.33.136 host 81.91.100.50
crypto map 3des-sha 2299 ipsec-isakmp
crypto map 3des-sha 2299 match address cp299
crypto map 3des-sha 2299 set pfs group2
crypto map 3des-sha 2299 set peer 81.91.100.50
crypto map 3des-sha 2299 set transform-set strong
isakmp key hMR2yH4Gv008w966 address 81.91.100.50 netmask 255.255.255.255
…
crypto ipsec transform-set strong esp-3des esp-sha-hmac
crypto ipsec security-association lifetime seconds 3600
…
isakmp policy 9 authentication pre-share
isakmp policy 9 encryption 3des
isakmp policy 9 hash sha
isakmp policy 9 group 2
isakmp policy 9 lifetime 3600
Со своей стороны я сделал вот что:
ISAKMPD.POLICY
KeyNote-Version: 2
Authorizer: "POLICY"
Licensees: "passphrase:***"
Conditions: app_domain == "IPsec policy" &&
esp_present == "yes" &&
esp_enc_alg == "3des" &&
esp_auth_alg == "pre-share" -> "true";
pfs == "group 2"
ah_hash_alg == "sha" &&
esp_lifetime_seconds == "3600" &&
ISAKMPD.CONF
[General]
Listen-on= 192.168.0.68 (IP моего компа в локалке)
Shared-SADB= Defined
[Phase 1]
83.149.33.133= ISAKMP-peer-mega
[Phase 2]
Connections= IPsec-unico-mega
[ISAKMP-peer-mega]
Phase= 1
Transport= udp
Local-address= 192.168.0.68
Address= 83.149.**.133
Configuration= Default-main-mode
Authentication= *****
#[ISAKMP-peer-mega-aggressive]
#Phase= 1
#Transport= udp
#Local-address= 192.168.0.68
#Address= 83.149.**.133
#Configuration= Default-aggressive-mode
#Authentication= *****
[IPsec-unico-mega]
Phase= 2
ISAKMP-peer= ISAKMP-peer-mega
Configuration= Default-main-mode
Local-ID= Net-unico
Remote-ID= Net-mega
[Net-mega]
ID-type= IPV4_ADDR_SUBNET
Network= 83.149.**.133
Netmask= 255.255.255.0
[Net-unico]
ID-type= IPV4_ADDR_SUBNET
Network= 192.168.0.68
Netmask= 255.255.255.0
[Default-main-mode]
DOI= IPSEC
EXCHANGE_TYPE= ID_PROT
#Transforms= ESP-3DES ESP-SHA-HMAC
Transforms= 3DES-SHA
#[Default-aggressive-mode]
#DOI= IPSEC
#EXCHANGE_TYPE= AGGRESSIVE
#Transforms= ESP-3DES ESP-SHA-HMAC
#Transforms= 3DES-SHA
[Default-quick-mode]
DOI= IPSEC
EXCHANGE_TYPE= QUICK_MODE
Suites= QM-ESP-AES-SHA-PFS-SUITE
Короче туннель не устанавливается.
Со стороны Циски пишет:
ekb-fw1# sh isakmp sa | incl 81.91.**.50
83.149.33.133 81.91.**.50 MM_SA_SETUP 0 0
83.149.33.133 81.91.**.50 MM_SA_SETUP 0 0
81.91.**.50 - мой "белый" IP
В чем моя ошибка?! Что не так сделал в isakmpd.conf и в isakmpd.policy?
transform-set: esp-3des esp-sha-hmac
PFS: Group 2
Isakmp policy:
9 authentication pre-share
9 encryption 3des
9 hash sha
9 group 2
>>>