IPSEC crypto ISAKMP profile

Wiadomość

weis · #1

Mam taką dość dziwną sytuację. Mam zestawiony tunel S2S pomiędzy routerem Cisco [IOS] a Juniperem.

Config Cisco:

crypto isakmp policy 10
 encr aes 256
 authentication pre-share
 group 5
 lifetime 28800
crypto isakmp key cisco address 1.1.1.21
crypto isakmp aggressive-mode disable
!
crypto ipsec transform-set aes-128-sha esp-aes esp-sha-hmac
!
crypto map 2 1 ipsec-isakmp
 set peer 1.1.1.21
 set security-association lifetime seconds 7200
 set transform-set aes-128-sha
 set pfs group2
 match address 2014
!
interface GigabitEthernet1/0
 ip address 1.1.1.12 255.255.255.0
 negotiation auto
 crypto map 2
!

I wszystko działa radośnie.

Kiedy próbuję powyższą konfigurację zmienić tak aby korzystała z ISAKMP profiles to pojawia się problem.

Kod: Zaznacz cały

crypto isakmp policy 10
 encr aes 256
 authentication pre-share
 group 5  
 lifetime 28800
!
crypto isakmp aggressive-mode disable
!
crypto keyring KEYRING 
  pre-shared-key address 1.1.1.21 key cisco
! 
crypto isakmp profile ISAMKP_PROFILE
   keyring KEYRING
   match identity address 1.1.1.21 255.255.255.255
!
crypto ipsec transform-set aes-128-sha esp-aes esp-sha-hmac 
!
crypto map 2 1 ipsec-isakmp 
 set peer 1.1.1.21
 set security-association lifetime seconds 7200
 set transform-set aes-128-sha 
 set pfs group2
 set isakmp-profile ISAMKP_PROFILE
 match address 2014
 reverse-route
!
interface GigabitEthernet1/0
 ip address 1.1.1.12 255.255.255.0
 negotiation auto
 crypto map 2
!

Tunel już się nie zestawia.

Kod: Zaznacz cały

%CRYPTO-6-IKMP_MODE_FAILURE: Processing of Quick mode failed with peer at 1.1.1.21
map_db_check_isakmp_profile profile did not match
Crypto mapdb : proxy_match

Kod: Zaznacz cały

*May 11 13:17:25.854: ISAKMP (0:134217739): received packet from 1.1.1.21 dport 500 sport 500 Global (R) QM_IDLE      
*May 11 13:17:25.854: ISAKMP: set new node 184370996 to QM_IDLE      
*May 11 13:17:25.862: ISAKMP:(0:11:SW:1): processing HASH payload. message ID = 184370996
*May 11 13:17:25.862: ISAKMP:(0:11:SW:1): processing SA payload. message ID = 184370996
*May 11 13:17:25.862: ISAKMP:(0:11:SW:1):Checking IPSec proposal 1
*May 11 13:17:25.862: ISAKMP: transform 0, ESP_AES 
*May 11 13:17:25.862: ISAKMP:   attributes in transform:
*May 11 13:17:25.866: ISAKMP:      key length is 128
*May 11 13:17:25.866: ISAKMP:      authenticator is HMAC-SHA
*May 11 13:17:25.866: ISAKMP:      group is 2
*May 11 13:17:25.866: ISAKMP:      SA life type in seconds
*May 11 13:17:25.866: ISAKMP:      SA life duration (VPI) of  0x0 0x0 0x1C 0x20 
*May 11 13:17:25.870: ISAKMP:      encaps is 1 (Tunnel)
*May 11 13:17:25.870: ISAKMP:(0:11:SW:1):atts are acceptable.
*May 11 13:17:25.874: 

ISAKMP:(0:11:SW:1): IPSec policy invalidated proposal
*May 11 13:17:25.874: ISAKMP:(0:11:SW:1): phase 2 SA policy not acceptable! (local 1.1.1.12 remote 1.1.1.21)
*May 11 13:17:25.878: ISAKMP: set new node 734379644 to QM_IDLE      
*May 11 13:17:25.882: ISAKMP:(0:11:SW:1):Sending NOTIFY PROPOSAL_NOT_CHOSEN protocol 3
	spi 1702120824, message ID = 734379644
*May 11 13:17:25.886: ISAKMP:(0:11:SW:1): sending packet to 1.1.1.21 my_port 500 peer_port 500 (R) QM_IDLE      
*May 11 13:17:25.886: ISAKMP:(0:11:SW:1):purging node 734379644
*May 11 13:17:25.890: ISAKMP:(0:11:SW:1):deleting node 184370996 error TRUE reason "QM rejected"
*May 11 13:17:25.890: ISAKMP (0:134217739): Unknown Input IKE_MESG_FROM_PEER, IKE_QM_EXCH:  for node 184370996: state = IKE_QM_READY
*May 11 13:17:25.890: ISAKMP:(0:11:SW:1):Node 184370996, Input = IKE_MESG_FROM_PEER, IKE_QM_EXCH
*May 11 13:17:25.894: ISAKMP:(0:11:SW:1):Old State = IKE_QM_READY  New State = IKE_QM_READY
*May 11 13:17:25.894: %CRYPTO-6-
IKMP_MODE_FAILURE: Processing of Quick mode failed with peer at 1.1.1.21       

*May 11 13:17:35.874: ISAKMP (0:134217739): received packet from 1.1.1.21 dport 500 sport 500 Global (R) QM_IDLE      
*May 11 13:17:35.874: ISAKMP:(0:11:SW:1): phase 2 packet is a duplicate of a previous packet.
*May 11 13:17:35.874: ISAKMP:(0:11:SW:1): retransmitting due to retransmit phase 2
*May 11 13:17:35.874: ISAKMP:(0:11:SW:1): ignoring retransmission,because phase2 node marked dead 184370996

*May 11 13:17:45.882: ISAKMP (0:134217739): received packet from 1.1.1.21 dport 500 sport 500 Global (R) QM_IDLE      
*May 11 13:17:45.886: ISAKMP:(0:11:SW:1): phase 2 packet is a duplicate of a previous packet.
*May 11 13:17:45.886: ISAKMP:(0:11:SW:1): retransmitting due to retransmit phase 2
*May 11 13:17:45.886: ISAKMP:(0:11:SW:1): ignoring retransmission,because phase2 node marked dead 184370996

*May 11 13:17:55.902: ISAKMP (0:134217739): received packet from 1.1.1.21 dport 500 sport 500 Global (R) QM_IDLE      
*May 11 13:17:55.902: ISAKMP:(0:11:SW:1): phase 2 packet is a duplicate of a previous packet.
*May 11 13:17:55.902: ISAKMP:(0:11:SW:1): retransmitting due to retransmit phase 2
*May 11 13:17:55.902: ISAKMP:(0:11:SW:1): ignoring retransmission,because phase2 node marked dead 184370996

*May 11 13:18:05.886: ISAKMP (0:134217739): received packet from 1.1.1.21 dport 500 sport 500 Global (R) QM_IDLE      
*May 11 13:18:05.886: ISAKMP:(0:11:SW:1): phase 2 packet is a duplicate of a previous packet.
*May 11 13:18:05.886: ISAKMP:(0:11:SW:1): retransmitting due to retransmit phase 2
*May 11 13:18:05.886: ISAKMP:(0:11:SW:1): ignoring retransmission,because phase2 node marked dead 184370996

*May 11 13:18:15.890: ISAKMP:(0:11:SW:1):purging node 184370996
*May 11 13:18:15.914: ISAKMP (0:134217739): received packet from 1.1.1.21 dport 500 sport 500 Global (R) QM_IDLE      
*May 11 13:18:15.914: ISAKMP: set new node 184370996 to QM_IDLE      
*May 11 13:18:15.914: ISAKMP:(0:11:SW:1): processing HASH payload. message ID = 184370996
*May 11 13:18:15.914: ISAKMP:(0:11:SW:1): processing SA payload. message ID = 184370996
*May 11 13:18:15.918: ISAKMP:(0:11:SW:1):Checking IPSec proposal 1
*May 11 13:18:15.918: ISAKMP: transform 0, ESP_AES 
*May 11 13:18:15.918: ISAKMP:   attributes in transform:
*May 11 13:18:15.918: ISAKMP:      key length is 128
*May 11 13:18:15.918: ISAKMP:      authenticator is HMAC-SHA
*May 11 13:18:15.918: ISAKMP:      group is 2
*May 11 13:18:15.918: ISAKMP:      SA life type in seconds
*May 11 13:18:15.918: ISAKMP:      SA life duration (VPI) of  0x0 0x0 0x1C 0x20 
*May 11 13:18:15.918: ISAKMP:      encaps is 1 (Tunnel)
*May 11 13:18:15.918
: ISAKMP:(0:11:SW:1):atts are acceptable.
*May 11 13:18:15.918: ISAKMP:(0:11:SW:1): IPSec policy invalidated proposal
*May 11 13:18:15.918: ISAKMP:(0:11:SW:1): phase 2 SA policy not acceptable! (local 1.1.1.12 remote 1.1.1.21)
*May 11 13:18:15.918: ISAKMP: set new node 1920948922 to QM_IDLE      
*May 11 13:18:15.918: ISAKMP:(0:11:SW:1):Sending NOTIFY PROPOSAL_NOT_CHOSEN protocol 3
	spi 1702120824, message ID = 1920948922
*May 11 13:18:15.918: ISAKMP:(0:11:SW:1): sending packet to 1.1.1.21 my_port 500 peer_port 500 (R) QM_IDLE      
*May 11 13:18:15.918: ISAKMP:(0:11:SW:1):purging node 1920948922
*May 11 13:18:15.918: ISAKMP:(0:11:SW:1):deleting node 184370996 error TRUE reason "QM rejected"
*May 11 13:18:15.918: ISAKMP (0:134217739): Unknown Input IKE_MESG_FROM_PEER, IKE_QM_EXCH:  for node 184370996: state = IKE_QM_READY
*May 11 13:18:15.922: ISAKMP:(0:11:SW:1):Node 184370996, Input = IKE_MESG_FROM_PEER, IKE_QM_EXCH
*May 11 13:18:15.922: ISAKMP:(0:11:SW:1):Old State = IKE_
QM_READY  New State = IKE_QM_READY

Oba urządzenia to virtualki ale nie sądzę aby to był problem. Pewnie gdzieś czegoś brakuje przy isamk profiles.

frontier · #2

A co to za wersja IOSa?

weis · #3

Cisco IOS Software, 7200 Software (C7200-A3JK9S-M), Version 12.4(13a), RELEASE SOFTWARE (fc1)

weis · #4

Identyczny problem mam na fizycznych sprzętach. Więc jest to raczej kwestia konfiguracji.

tomiabc · #5

w poprzedniej konfiguracji masz:

crypto isakmp key cisco address 1.1.1.12

czy po skonfigurowaniu keyring KEYRING, usunąłeś klucz z używając 'no crypto isakmp key cisco address 1.1.1.21'?

weis · #6

To literówka przy wpisywaniu configu tutaj.
Próbowałem zarówno z

Kod: Zaznacz cały

 crypto isakmp key cisco address 1.1.1.21

jak i bez tego. Czyli config wygląda dobrze?

weis · #7

W ramach testów próbowałem używając tych konfiguracji zestawić tunnel pomiędzy dwoma IOSami,jeden ma config z crypto isakmp profile drugi posiada klasyczny config. To nie zadziałało czyli problem jest w konfiguracji :/

frontier · #8

Spróbuj innej wersji IOSa, u mnie to działa na 15.0(1)M10:

Kod: Zaznacz cały

R1:

crypto isakmp policy 10
 encr 3des
 authentication pre-share
 group 2
crypto isakmp key cisco123 address 192.168.23.3 255.255.255.0 no-xauth
!
!
crypto ipsec transform-set tset esp-3des esp-sha-hmac 
!
crypto map mapa 10 ipsec-isakmp 
 set peer 192.168.23.3
 set transform-set tset 
 match address 100
!

interface Loopback0
 ip address 1.1.1.1 255.255.255.255
 !        

interface FastEthernet1/0
 ip address 192.168.12.1 255.255.255.0
 duplex auto
 speed auto
 crypto map mapa
 !
!
!
access-list 100 permit ip host 1.1.1.1 host 3.3.3.3

R3:

crypto keyring KEYRING 
  pre-shared-key address 192.168.12.1 key cisco123
!
crypto isakmp policy 10
 encr 3des
 authentication pre-share
 group 2

crypto isakmp profile PROFILE
   keyring KEYRING
   match identity address 192.168.12.1 255.255.255.255 
!
crypto ipsec transform-set tset esp-3des esp-sha-hmac 
!
crypto map mapa 10 ipsec-isakmp 
 set peer 192.168.12.1
 set transform-set tset 
 set isakmp-profile PROFILE
 match address 100
!
interface Loopback0
 ip address 3.3.3.3 255.255.255.255
 !
!
interface FastEthernet0/0
 ip address 192.168.23.3 255.255.255.0
 crypto map mapa
 !
!

!
access-list 100 permit ip host 3.3.3.3 host 1.1.1.1

deletek · #9

map_db_check_isakmp_profile profile did not match

Oznacza, że masz więcej keyringów/profili niż załączyłeś powyżej.

Pamiętaj, że w związku z budową i designem ikev1 musimy znać PSK zanim znamy ike id (czyli keyring jest matchowany najpierw, potem isakmp profile).

Czyli:
1) Wyrzuć wszelkie wpisy matchujące adres peera z globalnego keyringu (crypto isakmp key)
2) upewnij się, że żaden inny keyring nie matchuje adresu peera.

weis · #10

Hmm, na 12.4 też zadziałało. Musiałem gdzieś mieć jakąś literówkę.

Działający config:

Kod: Zaznacz cały

crypto keyring KEYRING 
  pre-shared-key address 1.1.1.12 key *
!         
crypto isakmp policy 10
 encr aes 256
 authentication pre-share
 group 5  
 lifetime 28800
 
crypto isakmp aggressive-mode disable

crypto isakmp profile ISAMKP_PROFILE
   keyring KEYRING
   match identity address 1.1.1.12 255.255.255.255 
!                  
crypto ipsec transform-set aes-128-sha esp-aes esp-sha-hmac 
!         
crypto map 2 1 ipsec-isakmp 
 set peer 1.1.1.12
 set security-association lifetime seconds 7200
 set transform-set aes-128-sha 
 set pfs group2
 set isakmp-profile ISAMKP_PROFILE
 match address 2014
 reverse-route

Dzięki za pomoc.

CCIE.pl

IPSEC crypto ISAKMP profile

IPSEC crypto ISAKMP profile

Re: IPSEC crypto ISAKMP profile