ru.cisco
- RU.CISCO ---------------------------------------------------------------------
From : Litovchenko Eugene 2:5020/400 16 Jan 2003 17:29:30
To : Aleksey Loginov
Subject : Re: IPsec + GRE tunnel
--------------------------------------------------------------------------------
"Aleksey Loginov" <lan@entel.kiev.ua> wrote in message
news:b068sd$2bd$1@host.talk.ru...
> Hу это значит у тебя не проходит обмен ключами, какие-то
> параметры рассогласованы.
> Показывай оба конфига или смотри внимательно сам.
> Посмотри на полный цикл попытки установки isakmp sa
> с помощью sh cry isa
> Там они должны явно ругаться на что-то.
вот конфиги....
кошка1
!
version 12.1
no service pad
service timestamps debug uptime
service timestamps log uptime
service password-encryption
!
hostname GATE
!
boot buffersize 8061
boot system flash c805-osy656i-mw.121-1.T.bin
boot system flash
aaa new-model
aaa authentication login default local
enable secret 5 *************************
enable password 7 ****************************
!
username tbm privilege 15 password 7 ***********************
!
!
!
!
clock timezone MSK 3
clock summer-time MSK recurring
ip subnet-zero
no ip source-route
!
no ip bootp server
ip domain-name tbm.ru
ip name-server 193.232.88.17
ip name-server 194.84.23.125
no ip finger
ip ssh time-out 60
ip ssh authentication-retries 2
cns event-service server
!
!
crypto isakmp policy 10
authentication pre-share
crypto isakmp key tbmmsk address 194.58.6.194
!
!
crypto ipsec transform-set one esp-des esp-md5-hmac
mode transport
!
crypto map gre local-address Serial0
crypto map gre 10 ipsec-isakmp
set peer 195.58.6.194
set transform-set one
match address 111
!
!
!
!
interface Tunnel0
ip address 172.16.2.1 255.255.255.252
tunnel source 194.84.251.197
tunnel destination 195.58.6.194
!
interface Ethernet0
ip address 10.4.1.41 255.255.0.0 secondary
ip address 195.151.45.193 255.255.255.224
ip access-group 102 in
ip accounting output-packets
ip accounting access-violations
ip nat inside
!
interface Serial0
ip address 194.84.251.197 255.255.255.252
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat outside
no cdp enable
!
ip nat pool tbm 195.151.45.195 195.151.45.199 netmask 255.255.255.224
ip nat inside source list 1 pool tbm overload
no ip http server
ip classless
ip route 0.0.0.0 0.0.0.0 194.84.251.198
ip route 10.4.0.0 255.255.0.0 Ethernet0
ip route 172.16.2.0 255.255.255.252 Tunnel0
ip route 192.168.0.0 255.255.255.0 Tunnel0 172.16.2.2
ip route 192.168.100.0 255.255.255.0 Ethernet0 10.4.0.1
!
logging facility local5
logging 10.4.1.105
access-list 1 permit 10.4.0.0 0.0.255.255
access-list 1 permit 192.168.100.0 0.0.0.255
access-list 10 permit 10.4.1.105
access-list 10 permit 10.4.1.123
access-list 10 permit 10.4.0.0 0.0.255.255
access-list 101 permit udp host 128.118.25.3 any eq ntp log
access-list 101 deny icmp any any redirect log
access-list 101 deny ip host 0.0.0.0 any log
access-list 101 deny ip 10.0.0.0 0.255.255.255 any log
access-list 101 deny ip 127.0.0.0 0.255.255.255 any log
access-list 101 deny ip 224.0.0.0 31.255.255.255 any log
access-list 101 deny ip 172.16.0.0 0.15.255.255 any log
access-list 101 deny ip 192.168.0.0 0.0.255.255 any log
access-list 101 deny ip 10.4.0.0 0.0.255.255 any log
access-list 101 deny udp any any range netbios-ns netbios-ss log
access-list 101 deny tcp any any range 137 139 log
access-list 101 deny udp any any eq 31337 log
access-list 101 deny udp any any eq tftp log
access-list 101 deny tcp any any eq ftp log
access-list 101 permit gre host 195.58.6.194 host 194.84.251.197
access-list 101 permit esp host 195.58.6.194 host 194.84.251.197
access-list 101 permit udp host 195.58.6.194 eq isakmp host 194.84.251.197
access-list 101 permit tcp any host 195.151.45.220 eq smtp
access-list 101 permit tcp any host 195.151.45.220 eq pop3
access-list 101 permit tcp any host 195.151.45.220 eq 143
access-list 101 permit tcp any host 195.151.45.220 eq 993
access-list 101 permit tcp any host 195.151.45.202 eq nntp
access-list 101 permit ip any host 195.151.45.200
access-list 101 permit tcp any eq ftp-data any
access-list 101 permit tcp any any established
access-list 101 permit udp host 193.232.88.17 eq domain any
access-list 101 permit udp host 194.84.23.125 eq domain any
access-list 101 permit ipinip host 195.58.6.194 host 194.84.251.197
access-list 101 deny ip any any log
access-list 102 permit ip host 10.4.1.1 192.168.100.0 0.0.0.255
access-list 102 permit ip host 10.4.1.57 192.168.100.0 0.0.0.255
access-list 102 permit ip host 10.4.1.221 192.168.100.0 0.0.0.255
access-list 102 permit ip host 195.151.45.200 any
access-list 102 permit ip host 195.151.45.203 any
access-list 102 permit tcp host 10.4.1.2 any
access-list 102 permit udp host 10.4.1.2 any eq domain
access-list 102 permit tcp host 10.4.1.115 any
access-list 102 permit udp host 10.4.1.115 any eq domain
access-list 102 permit ip host 10.4.1.4 any
access-list 102 permit tcp host 10.4.1.6 any eq www
access-list 102 permit tcp host 10.4.1.6 any eq smtp
access-list 102 permit tcp host 10.4.1.6 any eq pop3
access-list 102 permit udp host 10.4.1.6 any eq domain
access-list 102 permit tcp host 10.4.1.12 any eq www
access-list 102 permit udp host 10.4.1.12 any eq domain
access-list 102 permit tcp host 10.4.1.17 any eq www
access-list 102 permit udp host 10.4.1.17 any eq domain
access-list 102 permit tcp host 10.4.1.22 any eq www
access-list 102 permit udp host 10.4.1.22 any eq domain
access-list 102 permit tcp host 10.4.1.22 any eq pop3
access-list 102 permit tcp host 10.4.1.22 any eq smtp
access-list 102 permit tcp host 10.4.1.22 any eq 443
access-list 102 permit tcp host 10.4.1.23 any
access-list 102 permit udp host 10.4.1.23 any eq domain
access-list 102 permit tcp host 10.4.1.36 any eq www
access-list 102 permit udp host 10.4.1.36 any eq domain
access-list 102 permit tcp host 10.4.1.57 any eq www
access-list 102 permit udp host 10.4.1.57 any eq domain
access-list 102 permit tcp host 10.4.1.91 any
access-list 102 permit udp host 10.4.1.91 any eq domain
access-list 102 permit tcp host 10.4.111.34 any
access-list 102 permit udp host 10.4.111.34 any eq domain
access-list 102 permit ip host 10.4.1.105 any
access-list 102 permit ip host 10.4.1.112 any
access-list 102 permit tcp host 10.4.1.114 any eq pop3
access-list 102 permit udp host 10.4.1.114 any eq domain
access-list 102 permit ip host 10.4.1.123 any
access-list 102 permit udp host 10.4.255.228 any eq domain
access-list 102 permit tcp host 10.4.255.228 host 193.232.88.141 eq nntp
access-list 102 permit tcp host 10.4.200.6 any
access-list 102 permit udp host 10.4.200.6 any eq domain
access-list 102 permit ip host 10.4.200.12 any
access-list 102 permit udp host 10.4.200.13 any eq domain
access-list 102 permit tcp host 10.4.200.13 any eq ftp-data
access-list 102 permit tcp host 10.4.200.13 any eq ftp
access-list 102 permit ip host 10.4.200.14 192.168.100.0 0.0.0.255
access-list 102 permit ip host 10.4.1.15 192.168.100.0 0.0.0.255
access-list 102 permit udp host 10.4.200.15 any eq domain
access-list 102 permit tcp host 10.4.200.15 any
access-list 102 permit udp host 10.4.200.19 any eq domain
access-list 102 permit tcp host 10.4.200.19 any
access-list 102 permit tcp host 10.4.1.87 any
access-list 102 permit udp host 10.4.1.87 any eq domain
access-list 102 permit tcp host 10.4.200.18 host 62.118.250.55 eq smtp
access-list 102 permit tcp host 10.4.200.18 host 62.118.250.55 eq pop3
access-list 102 permit tcp host 10.4.255.249 any eq smtp
access-list 102 permit tcp host 10.4.255.249 any eq pop3
access-list 102 permit udp host 10.4.255.249 any eq domain
access-list 102 permit ip host 10.4.1.100 any
access-list 102 permit ip host 195.151.45.220 any
access-list 102 permit ip host 195.151.45.210 any
access-list 102 permit ip host 195.151.45.194 any
access-list 102 permit ip host 195.151.45.202 any
access-list 102 deny ip 10.4.0.0 0.0.255.255 host 10.4.255.255
access-list 102 deny ip any any log
access-list 111 permit gre host 194.84.251.197 host 195.58.6.194
access-list 111 permit ip 10.4.0.0 0.0.255.255 168.100.0.0 0.0.0.255
access-list 111 permit ip 195.151.45.192 0.0.0.31 168.100.0.0 0.0.0.255
access-list 150 permit ip 10.4.0.0 0.0.255.255 192.168.0.0 0.0.0.255
!
line con 0
transport input none
stopbits 1
line vty 0 4
password 7 *********************
!
end
======================================================
кошка 2
Building configuration...
Current configuration : 3604 bytes
!
version 12.1
no service single-slot-reload-enable
no service pad
service timestamps debug uptime
service timestamps log uptime
service password-encryption
!
hostname tbmek
!
logging rate-limit console 10 except errors
enable password 7 **********************
!
username relcom privilege 15 password 7 ********************
username tmbek privilege 7 password 7 ***********************
username tbm privilege 15 password 7 *************
mmi polling-interval 60
mmi auto-configure
no mmi pvc
mmi snmp-timeout 180
ip subnet-zero
ip subnet-zero
no ip finger
ip domain-name mplik.ru
ip name-server 195.58.27.158
ip name-server 195.58.1.145
!
no ip dhcp-client network-discovery
ip accounting-threshold 20000
call rsvp-sync
!
voice class codec 1
codec preference 1 g729r8
codec preference 2 g723r63
codec preference 3 g723r53
codec preference 4 g711alaw
!
!
!
!
!
ip subnet-zero
no ip finger
ip domain-name mplik.ru
ip name-server 195.58.27.158
ip name-server 195.58.1.145
!
no ip dhcp-client network-discovery
ip accounting-threshold 20000
call rsvp-sync
!
voice class codec 1
codec preference 1 g729r8
codec preference 2 g723r63
codec preference 3 g723r53
codec preference 4 g711alaw
!
!
!
!
!
!
!
!
crypto isakmp policy 10
authentication pre-share
crypto isakmp key tbmmsk address 194.84.251.197
!
!
crypto ipsec transform-set one esp-des esp-md5-hmac
mode transport
!
crypto map gre 10 ipsec-isakmp
set peer 194.84.251.197
set transform-set one
match address 101
!
!
!
translation-rule 1
Rule 1 ^8101% 1 ANY international
Rule 2 ^8102% 2 ANY international
Rule 3 ^8103% 3 ANY international
Rule 4 ^8104% 4 ANY international
Rule 5 ^8105% 5 ANY international
Rule 5 ^8105% 5 ANY international
Rule 6 ^8106% 6 ANY international
Rule 7 ^8107% 7 ANY international
Rule 8 ^8108% 8 ANY international
Rule 9 ^8109% 9 ANY international
Rule 10 ^8% 7 ANY international
!
!
interface Tunnel0
ip address 172.16.2.2 255.255.255.252
tunnel source ATM0.34
tunnel destination 194.84.251.197
!
interface Ethernet0
ip address 192.168.0.14 255.255.255.0
ip accounting output-packets
ip nat inside
h323-gateway voip interface
h323-gateway voip id TGK4 ipaddr 212.53.35.244 1719
h323-gateway voip id TGK8 ipaddr 212.53.35.34 1719
h323-gateway voip h323-id cis002
hold-queue 32 in
!
interface ATM0
interface ATM0
no ip address
no atm ilmi-keepalive
pvc 0/16 ilmi
!
bundle-enable
dsl operating-mode ansi-dmt
hold-queue 224 in
!
interface ATM0.34 point-to-point
ip address 195.58.6.194 255.255.255.252
ip nat outside
pvc 0/34
protocol ip 195.58.6.193 broadcast
encapsulation aal5snap
!
!
no ip classless
ip route 0.0.0.0 0.0.0.0 195.58.6.193
ip route 10.4.0.0 255.255.0.0 172.16.2.1
ip route 10.4.0.0 255.255.0.0 Tunnel0
ip route 172.16.2.0 255.255.255.252 Tunnel0
ip route 195.151.45.192 255.255.255.224 Tunnel0 172.16.2.1
no ip http server
!
ip nat inside source list 1 interface ATM0.34 overload
access-list 1 permit 192.168.0.0 0.0.0.255
access-list 1 deny any
access-list 51 permit 172.16.0.0 0.0.255.255
access-list 51 permit 195.58.1.128 0.0.0.127
access-list 51 permit 195.58.27.64 0.0.0.63
access-list 101 permit gre host 195.58.6.194 host 194.84.251.197
access-list 150 permit ip host 192.168.0.1 any log
!
voice-port 1
!
voice-port 2
!
voice-port 3
!
voice-port 4
!
dial-peer voice 8 voip
application session
application session
destination-pattern 8..T
translate-outgoing called 1
voice-class codec 1
session target ras
no vad
!
dial-peer voice 1 pots
destination-pattern ***********
port 1
!
gateway
security password ************ level endpoint
!
!
line con 0
login local
transport input none
stopbits 1
line vty 0 4
password 7 ******************
login local
!
scheduler max-task-time 5000
end
--- ifmail v.2.15dev5
* Origin: Demos online service (2:5020/400)
Вернуться к списку тем, сортированных по: возрастание даты уменьшение даты тема автор
|
