Cisco IOS 라우터와 Cisco VPN 클라이언트 간에 IPSec을 Entrust 인증서를 사용하여 구성

다운로드 옵션

  • PDF     (336.6 KB)
    다양한 디바이스에서 Adobe Reader로 보기
  • ePub     (210.9 KB)
    iPhone, iPad, Android, Sony Reader 또는 Windows Phone의 다양한 앱에서 보기
  • Mobi (Kindle)     (428.5 KB)
    Kindle 디바이스에서 보기 또는 다양한 디바이스의 Kindle 앱에서 보기
업데이트:2006년 1월 19일
문서 ID:22520

편견 없는 언어

본 제품에 대한 문서 세트는 편견 없는 언어를 사용하기 위해 노력합니다. 본 설명서 세트의 목적상, 편견 없는 언어는 나이, 장애, 성별, 인종 정체성, 민족 정체성, 성적 지향성, 사회 경제적 지위 및 교차성에 기초한 차별을 의미하지 않는 언어로 정의됩니다. 제품 소프트웨어의 사용자 인터페이스에서 하드코딩된 언어, RFP 설명서에 기초한 언어 또는 참조된 서드파티 제품에서 사용하는 언어로 인해 설명서에 예외가 있을 수 있습니다. 시스코에서 어떤 방식으로 포용적인 언어를 사용하고 있는지 자세히 알아보세요.

이 번역에 관하여

Cisco는 전 세계 사용자에게 다양한 언어로 지원 콘텐츠를 제공하기 위해 기계 번역 기술과 수작업 번역을 병행하여 이 문서를 번역했습니다. 아무리 품질이 높은 기계 번역이라도 전문 번역가의 번역 결과물만큼 정확하지는 않습니다. Cisco Systems, Inc.는 이 같은 번역에 대해 어떠한 책임도 지지 않으며 항상 원본 영문 문서(링크 제공됨)를 참조할 것을 권장합니다.

소개

이 문서에서는 Entrust 인증서를 사용하여 Cisco IOS® 라우터와 Cisco VPN Client 3.x 간에 IPSec VPN 터널을 구성하는 방법을 보여 줍니다. 이 기능은 Cisco IOS 소프트웨어 릴리스 12.2(8)T 이상에서 지원됩니다. 이 문서의 컨피그레이션 예에서는 Entrust를 CA 서버로 사용하는 Cisco IOS 라우터와 Cisco VPN 클라이언트 모두에 대한 CA(인증 기관) 등록 절차를 강조 표시합니다.

시작하기 전에

표기 규칙

문서 규칙에 대한 자세한 내용은 Cisco 기술 팁 표기 규칙을 참조하십시오.

사전 요구 사항

이 문서에 대한 특정 요건이 없습니다.

사용되는 구성 요소

이 문서의 정보는 아래 소프트웨어 및 하드웨어 버전을 기반으로 합니다.

  • Cisco IOS 소프트웨어 버전 12.2(8)T(IOS 이미지: c3640-ik8o3s-mz.122-8.T)

  • Windows 2000을 실행하는 PC의 Cisco VPN 클라이언트 4.0.1

  • CA 서버로 사용되는 Entrust CA 서버

이 문서의 정보는 특정 랩 환경의 디바이스를 토대로 작성되었습니다. 이 문서에 사용된 모든 디바이스는 초기화된(기본) 컨피그레이션으로 시작되었습니다. 라이브 네트워크에서 작업하는 경우, 사용하기 전에 모든 명령의 잠재적인 영향을 이해해야 합니다.

구성

이 섹션에는 이 문서에서 설명하는 기능을 구성하기 위한 정보가 표시됩니다.

참고: 이 문서에 사용된 명령에 대한 추가 정보를 찾으려면 명령 조회 도구(등록된 고객만 해당)를 사용합니다.

네트워크 다이어그램

이 문서에서는 아래 다이어그램에 표시된 네트워크 설정을 사용합니다.

unityclient-ios-1.gif

구성

이 문서에서는 아래 표시된 구성을 사용합니다.

라우터 컨피그레이션

IOS 라우터 3640의 인증서 등록 

!--- Define a hostname and domain name for the router. !--- The fully qualified domain name (FQDN) will be used !--- as the identity of the router during certificate enrollment.

3640(config)#ip domain-name sjpki.com

!--- Generate RSA (encryption and authentication) keys.

3640(config)#crypto key generate rsa
The name for the keys will be: 3640.sjpki.com
Choose the size of the key modulus in the range of 360 to 2048 for your
  General Purpose Keys. Choosing a key modulus greater than 512 may take
  a few minutes.

How many bits in the modulus [512]:
% Generating 512 bit RSA keys ...[OK]

!--- Define the CA identity. Note that in Cisco IOS Software !--- Release 12.2(8)T, the crypto ca trustpoint command !--- replaces the crypto ca identity command from previous !--- Cisco IOS versions. So that the router will try to enroll !--- to the CA server automatically when its certificates !--- expire, auto-enroll was turned on.

3640(config)#crypto ca trustpoint SJPKI
3640(ca-trustpoint)# enrollment url http://171.69.89.126 
3640(ca-trustpoint)#enrollment mode ra
3640(ca-trustpoint)#crl query ldap://171.69.89.126
3640(ca-trustpoint)#serial-number none
3640(ca-trustpoint)#ip-address none
3640(ca-trustpoint)#password revokeme
3640(ca-trustpoint)#auto-enroll
3640(ca-trustpoint)#usage ike

!--- Retrieves CA and registration authority (RA) !--- certificates from the CA server.

3640(config)#crypto ca authen SJPKI
Certificate has the following attributes:
Fingerprint: 0D8E6CF8 C63D7068 3BA4B90A 16054812
% Do you accept this certificate? [yes/no]: y
Trustpoint CA certificate accepted.
3640(config)#

!--- Enroll to CA server and get router's own certificate.

3640(config)#crypto ca enroll SJPKI
%
% Start certificate enrollment ..

% The subject name in the certificate will be: 3640.sjpki.com
% Certificate request sent to Certificate Authority
% The certificate request fingerprint will be displayed.
% The 'show crypto ca certificate' command will also show the fingerprint.

3640(config)#    Fingerprint:  D9CE886E B4B76115 B7149128 6658E7CA

00:58:17: CRYPTO_PKI: status = 102: certificate request pending
00:58:39: CRYPTO_PKI: status = 102: certificate request pending
00:59:42: %CRYPTO-6-CERTRET: Certificate received from Certificate Authority

3640 구성 
version 12.2
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname 3640
!
logging buffered 4096 debugging

!--- Define local authentication as the authentication method !--- for Internet Key Exchange (IKE) XAUTH. !--- Note that "ClientAuth" is the tag associated with the crypto map.

aaa new-model
aaa authentication login ClientAuth local
aaa authorization network ClientAuth local
aaa session-id common
enable secret 5 $1$v49A$bfcGOfwF7qdKQqZxCIN770
!
username vpnclient password 0 cisco123
ip subnet-zero
!
!
ip domain-name sjpki.com
!
ip audit notify log
ip audit po max-events 100
!
crypto ca trustpoint SJPKI
enrollment mode ra
enrollment url http://171.69.89.126:80
usage ike
serial-number none
ip-address none
password 7 1405171D030F2F2621
crl query ldap://171.69.89.126
auto-enroll
crypto ca certificate chain SJPKI
certificate ca 3C9CC54B
308202E4 3082024D A0030201 0202043C 9CC54B30 0D06092A 864886F7 0D010105
0500302D 310B3009 06035504 06130275 73310E30 0C060355 040A1305 63697363
6F310E30 0C060355 040B1305 736A7670 6E301E17 0D303230 33323331 37343132
355A170D 32323033 32333138 31313235 5A302D31 0B300906 03550406 13027573
310E300C 06035504 0A130563 6973636F 310E300C 06035504 0B130573 6A76706E
30819F30 0D06092A 864886F7 0D010101 05000381 8D003081 89028181 00AD0B5B
DACB1B4B 6CBE7138 2A97AA1D A2D3565C 56EE74D7 32A61D4F 7FBA7E53 44A4C8CC
94E16825 99369D85 7B6F5A15 60D9AD92 8AF8800E E3E70E01 757FD5DE 470C4996
A379181A 00709FE5 9C7C5A14 959F77B1 A746F8F7 1F0077FB 99E54DAC 8F3C355F
31964497 F36E7511 EF09B23D 52CDCD2F 50E471B7 F1FFCB05 4E6EB7F4 71020301
0001A382 010F3082 010B3011 06096086 480186F8 42010104 04030200 07304F06
03551D1F 04483046 3044A042 A040A43E 303C310B 30090603 55040613 02757331
0E300C06 0355040A 13056369 73636F31 0E300C06 0355040B 1305736A 76706E31
0D300B06 03550403 13044352 4C31302B 0603551D 10042430 22800F32 30303230
33323331 37343132 355A810F 32303232 30333233 31383131 32355A30 0B060355
1D0F0404 03020106 301F0603 551D2304 18301680 14F7931A 99D0E447 69928CC0
A9FF647D F53E627F 5A301D06 03551D0E 04160414 F7931A99 D0E44769 928CC0A9
FF647DF5 3E627F5A 300C0603 551D1304 05300301 01FF301D 06092A86 4886F67D
07410004 10300E1B 0856352E 303A342E 30030204 90300D06 092A8648 86F70D01
01050500 03818100 3C6AB8D8 9E3F140D D5D051AB 7032AF51 BD357804 4D7FA32C
EB42D1EA 2AFA1EEF 548C175E FAB9B4C7 DE0E0744 0916FC71 B87768F3 28B605E9
A054900B 5E249835 3112E7FF F0B579F5 F06858F8 5940CA9C E0FC4E98 66C50A40
2ABEAF37 9DB339C0 F98EDC0C E28C82CD B2465D46 5E3AB18E 0FEEE09A 37D58506
72AE135E 3B48662D
quit
certificate ra-encrypt 3C9CC573
308202E1 3082024A A0030201 0202043C 9CC57330 0D06092A 864886F7 0D010105
0500302D 310B3009 06035504 06130275 73310E30 0C060355 040A1305 63697363
6F310E30 0C060355 040B1305 736A7670 6E301E17 0D303230 33323332 32353234
355A170D 30353033 32333233 32323435 5A305631 0B300906 03550406 13027573
310E300C 06035504 0A130563 6973636F 310E300C 06035504 0B130573 6A76706E
31273025 06035504 03131E65 6E747275 73745650 4E636F6E 6E656374 6F722045
6E747275 7374504B 4930819F 300D0609 2A864886 F70D0101 01050003 818D0030
81890281 8100AC0B BA3BC6CF 7C303853 C1C191F6 5CD91A41 2F6143B4 6662D7CB
A4CD6633 45DBAEC7 7664F88B D62C5DA9 6087C097 5F498BF5 3DDC7ACF 1F4BFA30
DA112550 841FC5AD 45AEEE65 EA1EB935 473BF5F4 3F6FDE88 E05D7097 FD8C4525
50ECE9F7 4B3EA152 0DDB8867 A7DB5FEB D7886405 4DCB7486 9D8E1E96 5E3495D8
989017F1 CA7D0203 010001A3 81E43081 E1300B06 03551D0F 04040302 0520301B
0603551D 09041430 12301006 092A8648 86F67D07 441D3103 02010130 4F060355
1D1F0448 30463044 A042A040 A43E303C 310B3009 06035504 06130275 73310E30
0C060355 040A1305 63697363 6F310E30 0C060355 040B1305 736A7670 6E310D30
0B060355 04031304 43524C31 301F0603 551D2304 18301680 14F7931A 99D0E447
69928CC0 A9FF647D F53E627F 5A301D06 03551D0E 04160414 2DDB5231 39027684
9C982D0D E4528CBC CFFB97B3 30090603 551D1304 02300030 1906092A 864886F6
7D074100 040C300A 1B045635 2E300302 04B0300D 06092A86 4886F70D 01010505
00038181 001423E0 A88F4F28 FF69BD65 F35FDCD7 BE1ACB2C 9AF076CD 407D2698
D9237E02 2026B349 799BD983 C6FE9EB1 41E3728A 0FB37EE2 E0CE0071 6194EDF8
D21A9DED A7372E20 6FFE0468 014ED8EB 018FBB96 A683B210 A32C0673 D2C2785A
818C8EC8 2B9549EF 356C96BF 8F396064 1F6D7B50 D3354171 ACA45AE7 D550F42A
30922C78 E6
quit
certificate ra-sign 3C9CC574
30820310 30820279 A0030201 0202043C 9CC57430 0D06092A 864886F7 0D010105
0500302D 310B3009 06035504 06130275 73310E30 0C060355 040A1305 63697363
6F310E30 0C060355 040B1305 736A7670 6E301E17 0D303230 33323332 32353234
355A170D 30353033 32333233 32323435 5A305631 0B300906 03550406 13027573
310E300C 06035504 0A130563 6973636F 310E300C 06035504 0B130573 6A76706E
31273025 06035504 03131E65 6E747275 73745650 4E636F6E 6E656374 6F722045
6E747275 7374504B 4930819F 300D0609 2A864886 F70D0101 01050003 818D0030
81890281 8100AC87 EF7C0E8E 2120B81F D231EE87 78CB4238 9F5E5F3B D1D1C9F7
B35993EF 7118104A 26C38AB4 7DDE9B1D 3A685A73 9788A221 AC3199D7 0D91D315
2276DAF7 F58C5A1C 690B3CC8 7C1CBE03 8BD81993 F4644D30 B3388741 A0A0C4FC
BA469358 08C39FA0 152424F9 6E55651C 565B024C A862F557 85D925AA 6074959A
AC8E934B 48090203 010001A3 82011230 82010E30 0B060355 1D0F0404 03020780
302B0603 551D1004 24302280 0F323030 32303332 33323235 3234355A 810F3230
30343034 32393033 32323435 5A301B06 03551D09 04143012 30100609 2A864886
F67D0744 1D310302 0101304F 0603551D 1F044830 463044A0 42A040A4 3E303C31
0B300906 03550406 13027573 310E300C 06035504 0A130563 6973636F 310E300C
06035504 0B130573 6A76706E 310D300B 06035504 03130443 524C3130 1F060355
1D230418 30168014 F7931A99 D0E44769 928CC0A9 FF647DF5 3E627F5A 301D0603
551D0E04 160414AA 2E19FD77 6824DE9B 41DB46FC 15229D09 48D4EF30 09060355
1D130402 30003019 06092A86 4886F67D 07410004 0C300A1B 0456352E 30030204
B0300D06 092A8648 86F70D01 01050500 03818100 9EA074F8 12D60655 181B7E4B
CEC7F891 950F22E3 83344504 CBF49334 3DB683F1 32FE454E 2C3F7B6A 6E80B7F8
5D3B29A0 06AC428B BBAA3381 4209F50C CD8A7D30 4A6842ED 6B683B94 8423E58B
B2E27650 D1104DEB 56678757 7B744187 D99955F7 DF1BCED2 849D4F9A F22CDA7C
203E19C6 125AC104 608E37DF 600F97B9 B4DCF0CE
quit
certificate 3C9CC602
308202C0 30820229 A0030201 0202043C 9CC60230 0D06092A 864886F7 0D010105
0500302D 310B3009 06035504 06130275 73310E30 0C060355 040A1305 63697363
6F310E30 0C060355 040B1305 736A7670 6E301E17 0D303230 34303832 32323534
365A170D 30333034 30383232 35353436 5A304C31 0B300906 03550406 13027573
310E300C 06035504 0A130563 6973636F 310E300C 06035504 0B130573 6A76706E
311D301B 06092A86 4886F70D 01090216 0E333634 302E736A 706B692E 636F6D30
5C300D06 092A8648 86F70D01 01010500 034B0030 48024100 B7C253B7 B915A629
3CC1514F 39F8BB0A 503D0D10 D9C95D78 106D8944 48D28864 72760A06 859DA91A
0F9304E3 9CA87FFB FA3846FA 5C798970 4D8E6203 FE701A67 02030100 01A38201
10308201 0C300B06 03551D0F 04040302 05A03019 0603551D 11041230 10820E33
3634302E 736A706B 692E636F 6D302B06 03551D10 04243022 800F3230 30323034
30383232 32353436 5A810F32 30303231 32323031 30353534 365A304F 0603551D
1F044830 463044A0 42A040A4 3E303C31 0B300906 03550406 13027573 310E300C
06035504 0A130563 6973636F 310E300C 06035504 0B130573 6A76706E 310D300B
06035504 03130443 524C3130 1F060355 1D230418 30168014 F7931A99 D0E44769
928CC0A9 FF647DF5 3E627F5A 301D0603 551D0E04 16041413 C98FDF5A AEF253F0
84D39E4B 44A10B1F A2622730 09060355 1D130402 30003019 06092A86 4886F67D
07410004 0C300A1B 0456352E 30030204 B0300D06 092A8648 86F70D01 01050500
03818100 671FC222 EADDC030 F8053380 5EEE91E5 69D3F5A7 5AC037F9 539EF9CB
25ECD678 365A954A FFD3141B 17DEEB9F 1DFE6F97 8B8FDD18 47458858 A0517D21
2EE68C30 F359C5F9 647354F8 F92F2346 B999EFB7 029F30FB AC096829 58DC7E13
EE1FA3F6 BAAF794A 0157B0B1 4935CD3A 7B613B65 940412F8 C6301264 A7E53742 75E1E403
quit

!--- Define Internet Security Association and Key Management !--- Protocol (ISAKMP) policy. The IKE authentication method !--- "rsa-sig" will be used, but it doesn't show up in !--- the configuration since it is the default method.
 
crypto isakmp policy 1
group 2

!--- Use FQDN as the ISAKMP identity.

crypto isakmp identity hostname

!--- Define the VPN group for Cisco VPN Client. !--- The VPN group name "sjvpn" matches !--- the Organizational Unit (OU) name of the client's certificate. !--- Access list "acl 100" defines the split-tunneling traffic, and !--- "vpnpool" defines the IP pool from which the VPN Client !--- receives its IP address during the IKE negotiation.

crypto isakmp client configuration group sjvpn
dns 10.1.1.5
wins 10.1.1.5
domain sjpki.com
pool vpnpool
acl 101
!

!-- Define crypto map configuration. 

crypto ipsec transform-set myset esp-des esp-md5-hmac
!
crypto dynamic-map vpnclient 10
set transform-set myset
!
!
crypto map vpn client authentication list ClientAuth
crypto map vpn isakmp authorization list ClientAuth
crypto map vpn client configuration address respond
crypto map vpn 10 ipsec-isakmp dynamic vpnclient
!
!
!
fax interface-type fax-mail
mta receive maximum-recipients 0
!
!
interface Loopback0
ip address 10.1.2.1 255.255.255.0
!
interface Ethernet0/0
ip address 10.1.3.1 255.255.255.0
no keepalive
half-duplex
!
interface Ethernet0/1
ip address 172.16.172.40 255.255.255.240
half-duplex
crypto map vpn
!
interface BRI1/0
no ip address
shutdown
!
interface BRI1/1
no ip address
shutdown
!
interface BRI1/2
no ip address
shutdown
!
interface BRI1/3
no ip address
shutdown
!
interface Serial2/0
no ip address
shutdown
no fair-queue
!
interface Serial2/1
no ip address
shutdown
!
interface Serial2/2
no ip address
shutdown
!
interface Serial2/3
no ip address
shutdown
!
interface Serial3/0
no ip address
shutdown
!
interface Serial3/1
no ip address
shutdown
!
interface Serial3/2
no ip address
shutdown
!
interface Serial3/3
no ip address
shutdown
!
ip local pool vpnpool 10.1.1.10 10.1.1.50
ip classless
ip route 0.0.0.0 0.0.0.0 172.16.172.33
no ip http server
ip pim bidir-enable
!
!
access-list 101 permit ip 10.1.0.0 0.0.255.255 10.1.1.0 0.0.0.255
!
call rsvp-sync
!
!
mgcp profile default
!
dial-peer cor custom
!
!
line con 0
line aux 0
line vty 0 4
password cisco
!
!
end

Cisco VPN 클라이언트의 인증서 등록

다음 화면 캡처는 Cisco VPN Client for Entrust 인증서를 등록하는 데 사용되는 절차를 보여줍니다. 이 경우에는 네트워크 기반 등록을 사용했습니다.

  1. VPN Client를 시작하고 Certificates(인증서) 탭을 선택한 다음 Enroll(등록)을 클릭합니다.

    unityclient-ios-2.gif

  2. 인증서 등록 유형으로 Online을 선택한 다음 URL, 도메인 및 비밀번호에 해당하는 필드를 입력합니다. 완료되면 Next를 클릭합니다.

    unityclient-ios-3.gif

  3. 인증서 필드에 정보를 입력합니다. 이전 화면에서 정보를 편집해야 하는 경우 뒤로를 클릭합니다. 그렇지 않으면 완료되면 Enroll(등록)을 클릭합니다.

    unityclient-ios-4.gif

  4. 등록 상태 창에서 CA 서버 등록 요청을 확인하면 OK(확인)를 클릭하여 계속합니다.

    unityclient-ios-5.gif

  5. 등록 후 VPN 클라이언트는 개인 인증서 1개, CA 루트 인증서 1개, RA 인증서 2개를 받아야 합니다. Digital Certificate(디지털 인증서) 화면에서 VPN 클라이언트의 인증서를 확인합니다. 인증서를 보려면 Certificates(인증서) > View(보기)로 이동합니다. 인증서는 다음 예와 비슷해야 합니다.

    unityclient-ios-6.gif

Cisco VPN 클라이언트에서 VPN 연결 구성

다음 화면 캡처는 Cisco VPN Client에서 Cisco IOS 라우터에 대한 새 연결을 구성하는 방법을 보여줍니다.

  1. VPN Client(VPN 클라이언트)를 시작하고 Connection Entries(연결 항목) 탭을 선택한 다음 New(새로 만들기)를 클릭하여 새 연결을 생성합니다.

  2. 연결 이름, 설명 및 호스트 IP 주소를 입력합니다. Certificate Authentication(인증서 인증) 필드는 VPN 클라이언트에 대한 정보로 자동으로 채워집니다. 완료되면 Save(저장)를 클릭합니다.

    unityclient-ios-7.gif

  3. 연결하려면 새 연결 항목을 선택한 다음 연결을 클릭합니다.

    unityclient-ios-8.gif

다음을 확인합니다.

이 섹션에서는 컨피그레이션이 제대로 작동하는지 확인하는 데 사용할 수 있는 정보를 제공합니다.

일부 show 명령은 출력 인터프리터 툴 에서 지원되는데(등록된 고객만), 이 툴을 사용하면 show 명령 출력의 분석 결과를 볼 수 있습니다. 

  • 3640#show crypto isakmp sa
dst src state conn-id slot
172.16.172.40 171.69.89.129 QM_IDLE 1 0
  • 3640#show crypto ipsec sa

interface: Ethernet0/1
Crypto map tag: vpn, local addr. 172.16.172.40

local ident (addr/mask/prot/port): (10.1.0.0/255.255.0.0/0/0)
remote ident (addr/mask/prot/port): (10.1.1.11/255.255.255.255/0/0)
current_peer: 171.69.89.129
PERMIT, flags={}
#pkts encaps: 4, #pkts encrypt: 4, #pkts digest 4
#pkts decaps: 17, #pkts decrypt: 17, #pkts verify 17
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0, 
#pkts decompress failed: 0, #send errors 0, #recv errors 0

local crypto endpt.: 172.16.172.40, remote crypto endpt.: 171.69.89.129
path mtu 1500, media mtu 1500
current outbound spi: E73672A9

inbound esp sas:
spi: 0xADA266D3(2913101523)
transform: esp-des esp-md5-hmac ,
in use settings ={Tunnel, }
slot: 0, conn id: 2002, flow_id: 3, crypto map: vpn
 sa timing: remaining key lifetime (k/sec): (4607997/3526)
IV size: 8 bytes
replay detection support: Y

inbound ah sas:

inbound pcp sas:

outbound esp sas:
spi: 0xE73672A9(3879105193)
transform: esp-des esp-md5-hmac ,
in use settings ={Tunnel, }
slot: 0, conn id: 2003, flow_id: 4, crypto map: vpn
sa timing: remaining key lifetime (k/sec): (4607999/3526)
IV size: 8 bytes
replay detection support: Y

outbound ah sas:

outbound pcp sas:


local ident (addr/mask/prot/port): (172.16.172.40/255.255.255.255/0/0)
remote ident (addr/mask/prot/port): (10.1.1.11/255.255.255.255/0/0)
current_peer: 171.69.89.129
PERMIT, flags={}
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest 0
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0, 
#pkts decompress failed: 0, #send errors 0, #recv errors 0

local crypto endpt.: 172.16.172.40, remote crypto endpt.: 171.69.89.129
path mtu 1500, media mtu 1500
current outbound spi: 1E04D17C

inbound esp sas:
spi: 0x96D25C98(2530368664)
transform: esp-des esp-md5-hmac ,
in use settings ={Tunnel, }
slot: 0, conn id: 2000, flow_id: 1, crypto map: vpn
sa timing: remaining key lifetime (k/sec): (4608000/3527)
IV size: 8 bytes
replay detection support: Y

inbound ah sas:

inbound pcp sas:

outbound esp sas:
spi: 0x1E04D17C(503632252)
transform: esp-des esp-md5-hmac ,
in use settings ={Tunnel, }
slot: 0, conn id: 2001, flow_id: 2, crypto map: vpn
sa timing: remaining key lifetime (k/sec): (4608000/3527)
IV size: 8 bytes
replay detection support: Y

outbound ah sas:

outbound pcp sas:


  • 3640#show crypto engine connection active

ID   Interface     IP-Address  State       Algorithm     Encrypt Decrypt
1    Ethernet0/1 172.16.172.40   set  HMAC_SHA+DES_56_CB      0       0
2000 Ethernet0/1 172.16.172.40   set  HMAC_MD5+DES_56_CB      0       0
2001 Ethernet0/1 172.16.172.40   set  HMAC_MD5+DES_56_CB      0       0
2002 Ethernet0/1 172.16.172.40   set  HMAC_MD5+DES_56_CB      0      20
2003 Ethernet0/1 172.16.172.40   set  HMAC_MD5+DES_56_CB      4       0

문제 해결

이 섹션에서는 컨피그레이션 문제를 해결하는 데 사용할 수 있는 정보를 제공합니다.

다음은 Cisco 3640 라우터에서 수집된 작동 중인 IKE 협상의 디버그 출력입니다. 다음 디버그가 켜져 있습니다. 

3640#show debug

Cryptographic Subsystem:
Crypto ISAKMP debugging is on
Crypto Engine debugging is on
Crypto IPSEC debugging is on
Crypto PKI Trans debugging is on


3640#
00:02:30: ISAKMP (0:0): received packet from 171.69.89.129 (N) NEW SA
00:02:30: ISAKMP: local port 500, remote port 500
00:02:30: ISAKMP: Created a peer node for 171.69.89.129
00:02:30: ISAKMP (0:1): Setting client config settings 62D99D98
00:02:30: ISAKMP (0:1): (Re)Setting client xauth list ClientAuth and state
00:02:30: ISAKMP: Locking CONFIG struct 0x62D99D98 from 
   crypto_ikmp_config_initialize_sa, count 1
00:02:30: ISAKMP (0:1): Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
Old State = IKE_READY New State = IKE_R_MM1 

00:02:30: ISAKMP (0:1): processing SA payload. message ID = 0
00:02:30: ISAKMP (0:1): processing vendor id payload
00:02:30: ISAKMP (0:1): vendor ID seems Unity/DPD but bad major
00:02:30: ISAKMP (0:1): vendor ID is XAUTH
00:02:30: ISAKMP (0:1): processing vendor id payload
00:02:30: ISAKMP (0:1): vendor ID is DPD
00:02:30: ISAKMP (0:1): processing vendor id payload
00:02:30: ISAKMP (0:1): vendor ID is Unity
00:02:30: ISAKMP (0:1): Checking ISAKMP transform 1 against priority 1 policy
00:02:30: ISAKMP: encryption 3DES-CBC
00:02:30: ISAKMP: hash SHA
00:02:30: ISAKMP: default group 5
00:02:30: ISAKMP: auth XAUTHInitRSA
00:02:30: ISAKMP: life type in seconds
00:02:30: ISAKMP: life duration (VPI) of 0x0 0x20 0xC4 0x9B 
00:02:30: ISAKMP (0:1): Encryption algorithm offered does not match policy!
00:02:30: ISAKMP (0:1): atts are not acceptable. Next payload is 3
00:02:30: ISAKMP (0:1): Checking ISAKMP transform 2 against priority 1 policy
00:02:30: ISAKMP: encryption 3DES-CBC
00:02:30: ISAKMP: hash MD5
00:02:30: ISAKMP: default group 5
00:02:30: ISAKMP: auth XAUTHInitRSA
00:02:30: ISAKMP: life type in seconds
00:02:30: ISAKMP: life duration (VPI) of 0x0 0x20 0xC4 0x9B 
00:02:30: ISAKMP (0:1): Encryption algorithm offered does not match policy!
00:02:30: ISAKMP (0:1): atts are not acceptable. Next payload is 3
00:02:30: ISAKMP (0:1): Checking ISAKMP transform 3 against priority 1 policy
00:02:30: ISAKMP: encryption 3DES-CBC
00:02:30: ISAKMP: hash SHA
00:02:30: ISAKMP: default group 5
00:02:30: ISAKMP: auth RSA sig
00:02:30: ISAKMP: life type in seconds
00:02:30: ISAKMP: life duration (VPI) of 0x0 0x20 0xC4 0x9B 
00:02:30: ISAKMP (0:1): Encryption algorithm offered does not match policy!
00:02:30: ISAKMP (0:1): atts are not acceptable. Next payload is 3
00:02:30: ISAKMP (0:1): Checking ISAKMP transform 4 against priority 1 policy
00:02:30: ISAKMP: encryption 3DES-CBC
00:02:30: ISAKMP: hash MD5
00:02:30: ISAKMP: default group 5
00:02:30: ISAKMP: auth RSA sig
00:02:30: ISAKMP: life type in seconds
00:02:30: ISAKMP: life duration (VPI) of 0x0 0x20 0xC4 0x9B 
00:02:30: ISAKMP (0:1): Encryption algorithm offered does not match policy!
00:02:30: ISAKMP (0:1): atts are not acceptable. Next payload is 3
00:02:30: ISAKMP (0:1): Checking ISAKMP transform 5 against priority 1 policy
00:02:30: ISAKMP: encryption 3DES-CBC
00:02:30: ISAKMP: hash SHA
00:02:30: ISAKMP: default group 2
00:02:30: ISAKMP: auth XAUTHInitRSA
00:02:30: ISAKMP: life type in seconds
00:02:30: ISAKMP: life duration (VPI) of 0x0 0x20 0xC4 0x9B 
00:02:30: ISAKMP (0:1): Encryption algorithm offered does not match policy!
00:02:30: ISAKMP (0:1): atts are not acceptable. Next payload is 3
00:02:30: ISAKMP (0:1): Checking ISAKMP transform 6 against priority 1 policy
00:02:30: ISAKMP: encryption 3DES-CBC
00:02:30: ISAKMP: hash MD5
00:02:30: ISAKMP: default group 2
00:02:30: ISAKMP: auth XAUTHInitRSA
00:02:30: ISAKMP: life type in seconds
00:02:30: ISAKMP: life duration (VPI) of 0x0 0x20 0xC4 0x9B 
00:02:30: ISAKMP (0:1): Encryption algorithm offered does not match policy!
00:02:30: ISAKMP (0:1): atts are not acceptable. Next payload is 3
00:02:30: ISAKMP (0:1): Checking ISAKMP transform 7 against priority 1 policy
00:02:30: ISAKMP: encryption 3DES-CBC
00:02:30: ISAKMP: hash SHA
00:02:30: ISAKMP: default group 2
00:02:30: ISAKMP: auth RSA sig
00:02:30: ISAKMP: life type in seconds
00:02:30: ISAKMP: life duration (VPI) of 0x0 0x20 0xC4 0x9B 
00:02:30: ISAKMP (0:1): Encryption algorithm offered does not match policy!
00:02:30: ISAKMP (0:1): atts are not acceptable. Next payload is 3
00:02:30: ISAKMP (0:1): Checking ISAKMP transform 8 against priority 1 policy
00:02:30: ISAKMP: encryption 3DES-CBC
00:02:30: ISAKMP: hash MD5
00:02:30: ISAKMP: default group 2
00:02:30: ISAKMP: auth RSA sig
00:02:30: ISAKMP: life type in seconds
00:02:30: ISAKMP: life duration (VPI) of 0x0 0x20 0xC4 0x9B 
00:02:30: ISAKMP (0:1): Encryption algorithm offered does not match policy!
00:02:30: ISAKMP (0:1): atts are not acceptable. Next payload is 3
00:02:30: ISAKMP (0:1): Checking ISAKMP transform 9 against priority 1 policy
00:02:30: ISAKMP: encryption 3DES-CBC
00:02:30: ISAKMP: hash SHA
00:02:30: ISAKMP: default group 1
00:02:30: ISAKMP: auth XAUTHInitRSA
00:02:30: ISAKMP: life type in seconds
00:02:30: ISAKMP: life duration (VPI) of 0x0 0x20 0xC4 0x9B 
00:02:30: ISAKMP (0:1): Encryption algorithm offered does not match policy!
00:02:30: ISAKMP (0:1): atts are not acceptable. Next payload is 3
00:02:30: ISAKMP (0:1): Checking ISAKMP transform 10 against priority 1 policy
00:02:30: ISAKMP: encryption 3DES-CBC
00:02:30: ISAKMP: hash MD5
00:02:30: ISAKMP: default group 1
00:02:30: ISAKMP: auth XAUTHInitRSA
00:02:30: ISAKMP: life type in seconds
00:02:30: ISAKMP: life duration (VPI) of 0x0 0x20 0xC4 0x9B 
00:02:30: ISAKMP (0:1): Encryption algorithm offered does not match policy!
00:02:30: ISAKMP (0:1): atts are not acceptable. Next payload is 3
00:02:30: ISAKMP (0:1): Checking ISAKMP transform 11 against priority 1 policy
00:02:30: ISAKMP: encryption 3DES-CBC
00:02:30: ISAKMP: hash SHA
00:02:30: ISAKMP: default group 1
00:02:30: ISAKMP: auth RSA sig
00:02:30: ISAKMP: life type in seconds
00:02:30: ISAKMP: life duration (VPI) of 0x0 0x20 0xC4 0x9B 
00:02:30: ISAKMP (0:1): Encryption algorithm offered does not match policy!
00:02:30: ISAKMP (0:1): atts are not acceptable. Next payload is 3
00:02:30: ISAKMP (0:1): Checking ISAKMP transform 12 against priority 1 policy
00:02:30: ISAKMP: encryption 3DES-CBC
00:02:30: ISAKMP: hash MD5
00:02:30: ISAKMP: default group 1
00:02:30: ISAKMP: auth RSA sig
00:02:30: ISAKMP: life type in seconds
00:02:30: ISAKMP: life duration (VPI) of 0x0 0x20 0xC4 0x9B 
00:02:30: ISAKMP (0:1): Encryption algorithm offered does not match policy!
00:02:30: ISAKMP (0:1): atts are not acceptable. Next payload is 3
00:02:30: ISAKMP (0:1): Checking ISAKMP transform 13 against priority 1 policy
00:02:30: ISAKMP: encryption DES-CBC
00:02:30: ISAKMP: hash SHA
00:02:30: ISAKMP: default group 5
00:02:30: ISAKMP: auth XAUTHInitRSA
00:02:30: ISAKMP: life type in seconds
00:02:30: ISAKMP: life duration (VPI) of 0x0 0x20 0xC4 0x9B 
00:02:30: ISAKMP (0:1): Diffie-Hellman group offered does not match policy!
00:02:30: ISAKMP (0:1): atts are not acceptable. Next payload is 3
00:02:30: ISAKMP (0:1): Checking ISAKMP transform 14 against priority 1 policy
00:02:30: ISAKMP: encryption DES-CBC
00:02:30: ISAKMP: hash MD5
00:02:30: ISAKMP: default group 5
00:02:30: ISAKMP: auth XAUTHInitRSA
00:02:30: ISAKMP: life type in seconds
00:02:30: ISAKMP: life duration (VPI) of 0x0 0x20 0xC4 0x9B 
00:02:30: ISAKMP (0:1): Hash algorithm offered does not match policy!
00:02:30: ISAKMP (0:1): atts are not acceptable. Next payload is 3
00:02:30: ISAKMP (0:1): Checking ISAKMP transform 15 against priority 1 policy
00:02:30: ISAKMP: encryption DES-CBC
00:02:30: ISAKMP: hash SHA
00:02:30: ISAKMP: default group 5
00:02:30: ISAKMP: auth RSA sig
00:02:30: ISAKMP: life type in seconds
00:02:30: ISAKMP: life duration (VPI) of 0x0 0x20 0xC4 0x9B 
00:02:30: ISAKMP (0:1): Diffie-Hellman group offered does not match policy!
00:02:30: ISAKMP (0:1): atts are not acceptable. Next payload is 3
00:02:30: ISAKMP (0:1): Checking ISAKMP transform 16 against priority 1 policy
00:02:30: ISAKMP: encryption DES-CBC
00:02:30: ISAKMP: hash MD5
00:02:30: ISAKMP: default group 5
00:02:30: ISAKMP: auth RSA sig
00:02:30: ISAKMP: life type in seconds
00:02:30: ISAKMP: life duration (VPI) of 0x0 0x20 0xC4 0x9B 
00:02:30: ISAKMP (0:1): Hash algorithm offered does not match policy!
00:02:30: ISAKMP (0:1): atts are not acceptable. Next payload is 3
00:02:30: ISAKMP (0:1): Checking ISAKMP transform 17 against priority 1 policy
00:02:30: ISAKMP: encryption DES-CBC
00:02:30: ISAKMP: hash SHA
00:02:30: ISAKMP: default group 2
00:02:30: ISAKMP: auth XAUTHInitRSA
00:02:30: ISAKMP: life type in seconds
00:02:30: ISAKMP: life duration (VPI) of 0x0 0x20 0xC4 0x9B 
00:02:30: ISAKMP (0:1): atts are acceptable. Next payload is 3
00:02:30: CryptoEngine0: generate alg parameter
00:02:31: CRYPTO_ENGINE: Dh phase 1 status: 0
00:02:31: CRYPTO_ENGINE: Dh phase 1 status: 0
00:02:31: ISAKMP (0:1): processing vendor id payload
00:02:31: ISAKMP (0:1): processing vendor id payload
00:02:31: ISAKMP (0:1): processing vendor id payload
00:02:31: ISAKMP (0:1): Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
Old State = IKE_R_MM1 New State = IKE_R_MM1 

00:02:31: ISAKMP (0:1): sending packet to 171.69.89.129 (R) MM_SA_SETUP
00:02:31: ISAKMP (0:1): Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
Old State = IKE_R_MM1 New State = IKE_R_MM2 

00:02:31: ISAKMP (0:1): received packet from 171.69.89.129 (R) MM_SA_SETUP
00:02:31: ISAKMP (0:1): Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
Old State = IKE_R_MM2 New State = IKE_R_MM3 

00:02:31: ISAKMP (0:1): processing KE payload. message ID = 0
00:02:31: CryptoEngine0: generate alg parameter
00:02:31: ISAKMP (0:1): processing NONCE payload. message ID = 0
00:02:31: CryptoEngine0: calculate pkey hmac for conn id 1
00:02:31: CryptoEngine0: create ISAKMP SKEYID for conn id 1
00:02:31: ISAKMP (0:1): SKEYID state generated
00:02:31: ISAKMP (0:1): Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
Old State = IKE_R_MM3 New State = IKE_R_MM3 

00:02:31: ISAKMP (0:1): sending packet to 171.69.89.129 (R) MM_KEY_EXCH
00:02:31: ISAKMP (0:1): Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
Old State = IKE_R_MM3 New State = IKE_R_MM4 

00:02:31: ISAKMP (0:1): received packet from 171.69.89.129 (R) MM_KEY_EXCH
00:02:31: ISAKMP (0:1): Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
Old State = IKE_R_MM4 New State = IKE_R_MM5 

00:02:31: ISAKMP (0:1): processing ID payload. message ID = 0
00:02:31: ISAKMP (0:1): processing CERT payload. message ID = 0
00:02:31: ISAKMP (0:1): processing a CT_X509_SIGNATURE cert
00:02:31: CRYPTO_PKI: status = 0: poll CRL ldap search: server=171.69.89.126, 
base=CN = CRL1, OU = sjvpn, O = cisco, C = us, attribute=
: scope=2, filter=cn=CRL1

00:02:31: CRYPTO_PKI: ldap_bind() succeeded.
00:02:32: CRYPTO_PKI: set CRL update timer with delay: 89703
00:02:32: CRYPTO_PKI: the current router time: 00:00:39 UTC Apr 9 2002

00:02:32: CRYPTO_PKI: the last CRL update time: 23:55:42 UTC Apr 8 2002
00:02:32: CRYPTO_PKI: the next CRL update time: 00:55:42 UTC Apr 10 2002
00:02:32: CRYPTO_PKI: status = 0: failed to get public key from the storage
00:02:32: CRYPTO_PKI: status = 65535: failed to get issuer pubkey in cert
00:02:32: CRYPTO_PKI: status = 0: failed to get public key from the storage
00:02:32: CRYPTO_PKI: status = 65535: failed to get issuer pubkey in cert
00:02:32: CRYPTO_PKI: status = 0: failed to get public key from the storage
00:02:32: CRYPTO_PKI: status = 65535: failed to get issuer pubkey in cert
00:02:32: CRYPTO_PKI: transaction GetCRL completed
00:02:32: CRYPTO_PKI: blocking callback received status: 105
00:02:32: CRYPTO_PKI: Certificate verified, chain status= 1
00:02:32: ISAKMP (0:1): OU = sjvpn
00:02:32: ISAKMP (0:1): processing CERT_REQ payload. message ID = 0
00:02:32: ISAKMP (0:1): peer wants a CT_X509_SIGNATURE cert
00:02:32: ISAKMP (0:1): peer want cert issued by OU = sjvpn, O = cisco, C = us
00:02:32: ISAKMP (0:1): processing SIG payload. message ID = 0
00:02:32: Crypto engine 0: RSA decrypt with public key
00:02:32: CryptoEngine0: CRYPTO_RSA_PUB_DECRYPT
00:02:32: CryptoEngine0: generate hmac context for conn id 1
00:02:32: ISAKMP (0:1): processing NOTIFY INITIAL_CONTACT protocol 1
spi 0, message ID = 0, sa = 62D99794
00:02:32: ISAKMP (0:1): Process initial contact, 
   bring down existing phase 1 and 2 SA's
00:02:32: ISAKMP (0:1): returning IP addr to the address pool
00:02:32: ISAKMP (0:1): peer does not do paranoid keepalives.

00:02:32: ISAKMP (0:1): SA has been authenticated with 171.69.89.129
00:02:32: ISAKMP (0:1): Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
Old State = IKE_R_MM5 New State = IKE_R_MM5 

00:02:32: IPSEC(key_engine): got a queue event...
00:02:32: IPSEC(key_engine_delete_sas): rec'd delete notify from ISAKMP
00:02:32: IPSEC(key_engine_delete_sas): delete all SAs 
   shared with 171.69.89.129 
00:02:32: ISAKMP (0:1): SA is doing RSA signature authentication plus XAUTH 
   using id type ID_FQDN
00:02:32: ISAKMP (1): ID payload
next-payload : 6
type : 2
protocol : 17
port : 500
length : 18
00:02:32: ISAKMP (1): Total payload length: 22
00:02:32: CryptoEngine0: generate hmac context for conn id 1
00:02:32: Crypto engine 0: RSA encrypt with private key
00:02:32: CryptoEngine0: CRYPTO_RSA_PRIV_ENCRYPT
00:02:32: CryptoEngine0: clear dh number for conn id 1
00:02:32: ISAKMP (0:1): sending packet to 171.69.89.129 (R) CONF_XAUTH 
00:02:32: CryptoEngine0: generate hmac context for conn id 1
00:02:32: ISAKMP (0:1): sending packet to 171.69.89.129 (R) CONF_XAUTH 
00:02:32: ISAKMP: Sending phase 1 responder lifetime 86400

00:02:32: ISAKMP (0:1): Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
Old State = IKE_R_MM5 New State = IKE_P1_COMPLETE 

00:02:32: ISAKMP (0:1): Need XAUTH
00:02:32: ISAKMP (0:1): Input = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE
Old State = IKE_P1_COMPLETE New State = IKE_XAUTH_AAA_START_LOGIN_AWAIT 

00:02:32: ISAKMP: got callback 1
00:02:32: ISAKMP/xauth: request attribute XAUTH_TYPE_V2
00:02:32: ISAKMP/xauth: request attribute XAUTH_MESSAGE_V2
00:02:32: ISAKMP/xauth: request attribute XAUTH_USER_NAME_V2
00:02:32: ISAKMP/xauth: request attribute XAUTH_USER_PASSWORD_V2
00:02:32: CryptoEngine0: generate hmac context for conn id 1
00:02:32: ISAKMP (0:1): initiating peer config to 171.69.89.129. 
   ID = -670289125
00:02:32: ISAKMP (0:1): sending packet to 171.69.89.129 (R) CONF_XAUTH 
00:02:32: ISAKMP (0:1): Input = IKE_MESG_FROM_AAA, IKE_AAA_START_LOGIN
Old State = IKE_XAUTH_AAA_START_LOGIN_AWAIT New State = IKE_XAUTH_REQ_SENT 

00:02:36: ISAKMP (0:1): received packet from 171.69.89.129 (R) CONF_XAUTH 
00:02:36: ISAKMP (0:1): processing transaction payload from 171.69.89.129. 
message ID = -670289125
00:02:36: CryptoEngine0: generate hmac context for conn id 1
00:02:36: ISAKMP: Config payload REPLY
00:02:36: ISAKMP/xauth: reply attribute XAUTH_TYPE_V2 unexpected
00:02:36: ISAKMP/xauth: reply attribute XAUTH_USER_NAME_V2
00:02:36: ISAKMP/xauth: reply attribute XAUTH_USER_PASSWORD_V2
00:02:36: ISAKMP (0:1): deleting node -670289125 error FALSE 
   reason "done with xauth request/reply exchange"
00:02:36: ISAKMP (0:1): Input = IKE_MESG_FROM_PEER, IKE_CFG_REPLY
Old State = IKE_XAUTH_REQ_SENT New State = IKE_XAUTH_AAA_CONT_LOGIN_AWAIT 

00:02:36: ISAKMP: got callback 1
00:02:36: CryptoEngine0: generate hmac context for conn id 1
00:02:36: ISAKMP (0:1): initiating peer config to 171.69.89.129. 
   ID = -1610220250
00:02:36: ISAKMP (0:1): sending packet to 171.69.89.129 (R) CONF_XAUTH 
00:02:36: ISAKMP (0:1): Input = IKE_MESG_FROM_AAA, IKE_AAA_CONT_LOGIN
Old State = IKE_XAUTH_AAA_CONT_LOGIN_AWAIT New State = IKE_XAUTH_SET_SENT 

00:02:36: ISAKMP (0:1): received packet from 171.69.89.129 (R) CONF_XAUTH 
00:02:36: ISAKMP (0:1): processing transaction payload from 171.69.89.129. 
message ID = -1610220250
00:02:36: CryptoEngine0: generate hmac context for conn id 1
00:02:36: ISAKMP: Config payload ACK
00:02:36: ISAKMP (0:1): XAUTH ACK Processed
00:02:36: ISAKMP (0:1): deleting node -1610220250 error FALSE 
   reason "done with transaction"
00:02:36: ISAKMP (0:1): Input = IKE_MESG_FROM_PEER, IKE_CFG_ACK
Old State = IKE_XAUTH_SET_SENT New State = IKE_P1_COMPLETE 

00:02:36: ISAKMP (0:1): Input = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE
Old State = IKE_P1_COMPLETE New State = IKE_P1_COMPLETE 

00:02:36: ISAKMP (0:1): received packet from 171.69.89.129 (R) QM_IDLE 
00:02:36: ISAKMP (0:1): processing transaction payload from 171.69.89.129. 
message ID = 1789347264
00:02:36: CryptoEngine0: generate hmac context for conn id 1
00:02:36: ISAKMP: Config payload REQUEST
00:02:36: ISAKMP (0:1): checking request:
00:02:36: ISAKMP: IP4_ADDRESS
00:02:36: ISAKMP: IP4_NETMASK
00:02:36: ISAKMP: IP4_DNS
00:02:36: ISAKMP: IP4_NBNS
00:02:36: ISAKMP: ADDRESS_EXPIRY
00:02:36: ISAKMP: APPLICATION_VERSION
00:02:36: ISAKMP: UNKNOWN Unknown Attr: 0x7000
00:02:36: ISAKMP: UNKNOWN Unknown Attr: 0x7001
00:02:36: ISAKMP: DEFAULT_DOMAIN
00:02:36: ISAKMP: SPLIT_INCLUDE
00:02:36: ISAKMP: UNKNOWN Unknown Attr: 0x7007
00:02:36: ISAKMP: UNKNOWN Unknown Attr: 0x7008
00:02:36: ISAKMP (0:1): Input = IKE_MESG_FROM_PEER, IKE_CFG_REQUEST
Old State = IKE_P1_COMPLETE New State = IKE_CONFIG_AUTHOR_AAA_AWAIT 

00:02:36: ISAKMP: got callback 1
00:02:36: ISAKMP (0:1): attributes sent in message:
00:02:36: Address: 0.2.0.0
00:02:36: ISAKMP (0:1): allocating address 10.1.1.10
00:02:36: ISAKMP: Sending private address: 10.1.1.10
00:02:36: ISAKMP: Unknown Attr: IP4_NETMASK (0x2)
00:02:36: ISAKMP: Sending IP4_DNS server address: 10.1.1.5
00:02:36: ISAKMP: Sending IP4_NBNS server address: 10.1.1.5
00:02:36: ISAKMP: Sending ADDRESS_EXPIRY seconds left 
   to use the address: 86394
00:02:36: ISAKMP: Sending APPLICATION_VERSION string: 
   Cisco Internetwork Operating System Software 
IOS (tm) 3600 Software (C3640-IK8O3S-M), Version 12.2(8)T, 
RELEASE SOFTWARE (fc2)
TAC Support: http://www.cisco.com/tac
Copyright (c) 1986-2002 by cisco Systems, Inc.
Compiled Thu 14-Feb-02 19:36 by ccai
00:02:36: ISAKMP: Unknown Attr: UNKNOWN (0x7000)
00:02:36: ISAKMP: Unknown Attr: UNKNOWN (0x7001)
00:02:36: ISAKMP: Sending DEFAULT_DOMAIN default domain name: sjpki.com
00:02:36: ISAKMP: Sending split include name 101 network 10.1.0.0 
   mask 255.255.0.0, protocol 0, src port 0, dst port 0

00:02:36: ISAKMP: Unknown Attr: UNKNOWN (0x7007)
00:02:36: ISAKMP: Unknown Attr: UNKNOWN (0x7008)
00:02:36: CryptoEngine0: generate hmac context for conn id 1
00:02:36: ISAKMP (0:1): responding to peer config from 171.69.89.129. 
   ID = 1789347264
00:02:36: ISAKMP (0:1): sending packet to 171.69.89.129 (R) CONF_ADDR 
00:02:36: ISAKMP (0:1): deleting node 1789347264 error FALSE reason ""
00:02:36: ISAKMP (0:1): Input = IKE_MESG_FROM_AAA, IKE_AAA_GROUP_ATTR
Old State = IKE_CONFIG_AUTHOR_AAA_AWAIT New State = IKE_P1_COMPLETE 

00:02:36: ISAKMP (0:1): received packet from 171.69.89.129 (R) QM_IDLE 
00:02:36: CryptoEngine0: generate hmac context for conn id 1
00:02:36: ISAKMP (0:1): processing HASH payload. message ID = -1460041169
00:02:36: ISAKMP (0:1): processing SA payload. message ID = -1460041169
00:02:36: ISAKMP (0:1): Checking IPSec proposal 1
00:02:36: ISAKMP: transform 1, ESP_3DES
00:02:36: ISAKMP: attributes in transform:
00:02:36: ISAKMP: authenticator is HMAC-MD5
00:02:36: ISAKMP: encaps is 1
00:02:36: ISAKMP: SA life type in seconds
00:02:36: ISAKMP: SA life duration (VPI) of 0x0 0x20 0xC4 0x9B 
00:02:36: validate proposal 0
00:02:36: IPSEC(validate_proposal): transform proposal 
   (prot 3, trans 3, hmac_alg 1) not supported
00:02:36: ISAKMP (0:1): atts not acceptable. Next payload is 0
00:02:36: ISAKMP (0:1): skipping next ANDed proposal (1)
00:02:36: ISAKMP (0:1): Checking IPSec proposal 2
00:02:36: ISAKMP: transform 1, ESP_3DES
00:02:36: ISAKMP: attributes in transform:
00:02:36: ISAKMP: authenticator is HMAC-SHA
00:02:36: ISAKMP: encaps is 1
00:02:36: ISAKMP: SA life type in seconds
00:02:36: ISAKMP: SA life duration (VPI) of 0x0 0x20 0xC4 0x9B 
00:02:36: validate proposal 0
00:02:36: IPSEC(validate_proposal): transform proposal 
   (prot 3, trans 3, hmac_alg 2) not supported
00:02:36: ISAKMP (0:1): atts not acceptable. Next payload is 0
00:02:36: ISAKMP (0:1): skipping next ANDed proposal (2)
00:02:36: ISAKMP (0:1): Checking IPSec proposal 3
00:02:36: ISAKMP: transform 1, ESP_3DES
00:02:36: ISAKMP: attributes in transform:
00:02:36: ISAKMP: authenticator is HMAC-MD5
00:02:36: ISAKMP: encaps is 1
00:02:36: ISAKMP: SA life type in seconds
00:02:36: ISAKMP: SA life duration (VPI) of 0x0 0x20 0xC4 0x9B 
00:02:36: validate proposal 0
00:02:36: IPSEC(validate_proposal): transform proposal 
   (prot 3, trans 3, hmac_alg 1) not supported
00:02:36: ISAKMP (0:1): atts not acceptable. Next payload is 0
00:02:36: ISAKMP (0:1): Checking IPSec proposal 4
00:02:36: ISAKMP: transform 1, ESP_3DES
00:02:36: ISAKMP: attributes in transform:
00:02:36: ISAKMP: authenticator is HMAC-SHA
00:02:36: ISAKMP: encaps is 1
00:02:36: ISAKMP: SA life type in seconds
00:02:36: ISAKMP: SA life duration (VPI) of 0x0 0x20 0xC4 0x9B 
00:02:36: validate proposal 0
00:02:36: IPSEC(validate_proposal): transform proposal 
   (prot 3, trans 3, hmac_alg 2) not supported
00:02:36: ISAKMP (0:1): atts not acceptable. Next payload is 0
00:02:36: ISAKMP (0:1): Checking IPSec proposal 5
00:02:36: ISAKMP: transform 1, ESP_DES
00:02:36: ISAKMP: attributes in transform:
00:02:36: ISAKMP: authenticator is HMAC-MD5
00:02:36: ISAKMP: encaps is 1
00:02:36: ISAKMP: SA life type in seconds
00:02:36: ISAKMP: SA life duration (VPI) of 0x0 0x20 0xC4 0x9B 
00:02:36: validate proposal 0
00:02:36: ISAKMP (0:1): atts are acceptable.
00:02:36: ISAKMP (0:1): Checking IPSec proposal 5
00:02:36: ISAKMP (0:1): transform 1, IPPCP LZS
00:02:36: ISAKMP: attributes in transform:
00:02:36: ISAKMP: encaps is 1
00:02:36: ISAKMP: SA life type in seconds
00:02:36: ISAKMP: SA life duration (VPI) of 0x0 0x20 0xC4 0x9B 
00:02:36: IPSEC(validate_proposal): transform proposal 
   (prot 4, trans 3, hmac_alg 0) not supported
00:02:36: ISAKMP (0:1): atts not acceptable. Next payload is 0
00:02:36: ISAKMP (0:1): Checking IPSec proposal 6
00:02:36: ISAKMP: transform 1, ESP_DES
00:02:36: ISAKMP: attributes in transform:
00:02:36: ISAKMP: authenticator is HMAC-SHA
00:02:36: ISAKMP: encaps is 1
00:02:36: ISAKMP: SA life type in seconds
00:02:36: ISAKMP: SA life duration (VPI) of 0x0 0x20 0xC4 0x9B 
00:02:36: validate proposal 0
00:02:36: IPSEC(validate_proposal): transform proposal 
   (prot 3, trans 2, hmac_alg 2) not supported
00:02:36: ISAKMP (0:1): atts not acceptable. Next payload is 0
00:02:36: ISAKMP (0:1): skipping next ANDed proposal (6)
00:02:36: ISAKMP (0:1): Checking IPSec proposal 7
00:02:36: ISAKMP: transform 1, ESP_DES
00:02:36: ISAKMP: attributes in transform:
00:02:36: ISAKMP: authenticator is HMAC-MD5
00:02:36: ISAKMP: encaps is 1
00:02:36: ISAKMP: SA life type in seconds
00:02:36: ISAKMP: SA life duration (VPI) of 0x0 0x20 0xC4 0x9B 
00:02:36: validate proposal 0
00:02:36: ISAKMP (0:1): atts are acceptable.
00:02:36: IPSEC(validate_proposal_request): proposal part #1,
(key eng. msg.) INBOUND local= 172.16.172.40, remote= 171.69.89.129, 
local_proxy= 172.16.172.40/255.255.255.255/0/0 (type=1), 
remote_proxy= 10.1.1.10/255.255.255.255/0/0 (type=1),
protocol= ESP, transform= esp-des esp-md5-hmac , 
lifedur= 0s and 0kb, 
spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x4
00:02:36: validate proposal request 0
00:02:36: ISAKMP (0:1): processing NONCE payload. message ID = -1460041169
00:02:36: ISAKMP (0:1): processing ID payload. message ID = -1460041169
00:02:36: ISAKMP (0:1): processing ID payload. message ID = -1460041169
00:02:36: ISAKMP (0:1): asking for 1 spis from ipsec
00:02:36: ISAKMP (0:1): Node -1460041169, Input = IKE_MESG_FROM_PEER, 
   IKE_QM_EXCH
Old State = IKE_QM_READY New State = IKE_QM_SPI_STARVE 

00:02:36: IPSEC(key_engine): got a queue event...
00:02:36: IPSEC(spi_response): getting spi 1289658319 for SA 
from 172.16.172.40 to 171.69.89.129 for prot 3
00:02:36: ISAKMP: received ke message (2/1)
00:02:36: CryptoEngine0: generate hmac context for conn id 1
00:02:36: ISAKMP (0:1): sending packet to 171.69.89.129 (R) QM_IDLE 
00:02:36: ISAKMP (0:1): Node -1460041169, Input = IKE_MESG_FROM_IPSEC, 
   IKE_SPI_REPLY
Old State = IKE_QM_SPI_STARVE New State = IKE_QM_R_QM2 

00:02:36: ISAKMP (0:1): received packet from 171.69.89.129 (R) QM_IDLE 
00:02:36: CryptoEngine0: generate hmac context for conn id 1
00:02:36: ipsec allocate flow 0
00:02:36: ipsec allocate flow 0
00:02:36: ISAKMP (0:1): Creating IPSec SAs
00:02:36: inbound SA from 171.69.89.129 to 172.16.172.40
(proxy 10.1.1.10 to 172.16.172.40)
00:02:36: has spi 0x4CDE9FCF and conn_id 2000 and flags 4
00:02:36: lifetime of 2147483 seconds
00:02:36: outbound SA from 172.16.172.40 to 171.69.89.129 
   (proxy 172.16.172.40 to 10.1.1.10)
00:02:36: has spi -154514029 and conn_id 2001 and flags C
00:02:36: lifetime of 2147483 seconds
00:02:36: ISAKMP (0:1): deleting node -1460041169 error FALSE 
   reason "quick mode done (await()"
00:02:36: ISAKMP (0:1): Node -1460041169, Input = IKE_MESG_FROM_PEER, 
   IKE_QM_EXCH
Old State = IKE_QM_R_QM2 New State = IKE_QM_PHASE2_COMPLETE 

00:02:36: IPSEC(key_engine): got a queue event...
00:02:36: IPSEC(initialize_sas): ,
(key eng. msg.) INBOUND local= 172.16.172.40, remote= 171.69.89.129, 
local_proxy= 172.16.172.40/0.0.0.0/0/0 (type=1), 
remote_proxy= 10.1.1.10/0.0.0.0/0/0 (type=1),
protocol= ESP, transform= esp-des esp-md5-hmac , 
lifedur= 2147483s and 0kb, 
spi= 0x4CDE9FCF(1289658319), conn_id= 2000, keysize= 0, flags= 0x4
00:02:36: IPSEC(initialize_sas): ,
(key eng. msg.) OUTBOUND local= 172.16.172.40, remote= 171.69.89.129, 
local_proxy= 172.16.172.40/0.0.0.0/0/0 (type=1), 
remote_proxy= 10.1.1.10/0.0.0.0/0/0 (type=1),
protocol= ESP, transform= esp-des esp-md5-hmac , 
lifedur= 2147483s and 0kb, 
spi= 0xF6CA4D93(4140453267), conn_id= 2001, keysize= 0, flags= 0xC
00:02:36: IPSEC(create_sa): sa created,
(sa) sa_dest= 172.16.172.40, sa_prot= 50, 
sa_spi= 0x4CDE9FCF(1289658319), 
sa_trans= esp-des esp-md5-hmac , sa_conn_id= 2000
00:02:36: IPSEC(create_sa): sa created,
(sa) sa_dest= 171.69.89.129, sa_prot= 50, 
sa_spi= 0xF6CA4D93(4140453267), 
sa_trans= esp-des esp-md5-hmac , sa_conn_id= 2001
00:02:36: ISAKMP: received ke message (4/1)
00:02:36: ISAKMP: Locking CONFIG struct 0x62D99D98 for 
   crypto_ikmp_config_handle_kei_mess, count 2
00:02:37: ISAKMP (0:1): received packet from 171.69.89.129 (R) QM_IDLE 
00:02:37: CryptoEngine0: generate hmac context for conn id 1
00:02:37: ISAKMP (0:1): processing HASH payload. message ID = 926518983
00:02:37: ISAKMP (0:1): processing SA payload. message ID = 926518983
00:02:37: ISAKMP (0:1): Checking IPSec proposal 1
00:02:37: ISAKMP: transform 1, ESP_3DES
00:02:37: ISAKMP: attributes in transform:
00:02:37: ISAKMP: authenticator is HMAC-MD5
00:02:37: ISAKMP: encaps is 1
00:02:37: ISAKMP: SA life type in seconds
00:02:37: ISAKMP: SA life duration (VPI) of 0x0 0x20 0xC4 0x9B 
00:02:37: validate proposal 0
00:02:37: IPSEC(validate_proposal): transform proposal 
   (prot 3, trans 3, hmac_alg 1) not supported
00:02:37: ISAKMP (0:1): atts not acceptable. Next payload is 0
00:02:37: ISAKMP (0:1): skipping next ANDed proposal (1)
00:02:37: ISAKMP (0:1): Checking IPSec proposal 2
00:02:37: ISAKMP: transform 1, ESP_3DES
00:02:37: ISAKMP: attributes in transform:
00:02:37: ISAKMP: authenticator is HMAC-SHA
00:02:37: ISAKMP: encaps is 1
00:02:37: ISAKMP: SA life type in seconds
00:02:37: ISAKMP: SA life duration (VPI) of 0x0 0x20 0xC4 0x9B 
00:02:37: validate proposal 0
00:02:37: IPSEC(validate_proposal): transform proposal 
   (prot 3, trans 3, hmac_alg 2) not supported
00:02:37: ISAKMP (0:1): atts not acceptable. Next payload is 0
00:02:37: ISAKMP (0:1): skipping next ANDed proposal (2)
00:02:37: ISAKMP (0:1): Checking IPSec proposal 3
00:02:37: ISAKMP: transform 1, ESP_3DES
00:02:37: ISAKMP: attributes in transform:
00:02:37: ISAKMP: authenticator is HMAC-MD5
00:02:37: ISAKMP: encaps is 1
00:02:37: ISAKMP: SA life type in seconds
00:02:37: ISAKMP: SA life duration (VPI) of 0x0 0x20 0xC4 0x9B 
00:02:37: validate proposal 0
00:02:37: IPSEC(validate_proposal): transform proposal 
   (prot 3, trans 3, hmac_alg 1) not supported
00:02:37: ISAKMP (0:1): atts not acceptable. Next payload is 0
00:02:37: ISAKMP (0:1): Checking IPSec proposal 4
00:02:37: ISAKMP: transform 1, ESP_3DES
00:02:37: ISAKMP: attributes in transform:
00:02:37: ISAKMP: authenticator is HMAC-SHA
00:02:37: ISAKMP: encaps is 1
00:02:37: ISAKMP: SA life type in seconds
00:02:37: ISAKMP: SA life duration (VPI) of 0x0 0x20 0xC4 0x9B 
00:02:37: validate proposal 0
00:02:37: IPSEC(validate_proposal): transform proposal 
   (prot 3, trans 3, hmac_alg 2) not supported
00:02:37: ISAKMP (0:1): atts not acceptable. Next payload is 0
00:02:37: ISAKMP (0:1): Checking IPSec proposal 5
00:02:37: ISAKMP: transform 1, ESP_DES
00:02:37: ISAKMP: attributes in transform:
00:02:37: ISAKMP: authenticator is HMAC-MD5
00:02:37: ISAKMP: encaps is 1
00:02:37: ISAKMP: SA life type in seconds
00:02:37: ISAKMP: SA life duration (VPI) of 0x0 0x20 0xC4 0x9B 
00:02:37: validate proposal 0
00:02:37: ISAKMP (0:1): atts are acceptable.
00:02:37: ISAKMP (0:1): Checking IPSec proposal 5
00:02:37: ISAKMP (0:1): transform 1, IPPCP LZS
00:02:37: ISAKMP: attributes in transform:
00:02:37: ISAKMP: encaps is 1
00:02:37: ISAKMP: SA life type in seconds
00:02:37: ISAKMP: SA life duration (VPI) of 0x0 0x20 0xC4 0x9B 
00:02:37: IPSEC(validate_proposal): transform proposal 
   (prot 4, trans 3, hmac_alg 0) not supported
00:02:37: ISAKMP (0:1): atts not acceptable. Next payload is 0
00:02:37: ISAKMP (0:1): Checking IPSec proposal 6
00:02:37: ISAKMP: transform 1, ESP_DES
00:02:37: ISAKMP: attributes in transform:
00:02:37: ISAKMP: authenticator is HMAC-SHA
00:02:37: ISAKMP: encaps is 1
00:02:37: ISAKMP: SA life type in seconds
00:02:37: ISAKMP: SA life duration (VPI) of 0x0 0x20 0xC4 0x9B 
00:02:37: validate proposal 0
00:02:37: IPSEC(validate_proposal): transform proposal 
   (prot 3, trans 2, hmac_alg 2) not supported
00:02:37: ISAKMP (0:1): atts not acceptable. Next payload is 0
00:02:37: ISAKMP (0:1): skipping next ANDed proposal (6)
00:02:37: ISAKMP (0:1): Checking IPSec proposal 7
00:02:37: ISAKMP: transform 1, ESP_DES
00:02:37: ISAKMP: attributes in transform:
00:02:37: ISAKMP: authenticator is HMAC-MD5
00:02:37: ISAKMP: encaps is 1
00:02:37: ISAKMP: SA life type in seconds
00:02:37: ISAKMP: SA life duration (VPI) of 0x0 0x20 0xC4 0x9B 
00:02:37: validate proposal 0
00:02:37: ISAKMP (0:1): atts are acceptable.
00:02:37: IPSEC(validate_proposal_request): proposal part #1,
(key eng. msg.) INBOUND local= 172.16.172.40, remote= 171.69.89.129, 
local_proxy= 10.1.0.0/255.255.0.0/0/0 (type=4), 
remote_proxy= 10.1.1.10/255.255.255.255/0/0 (type=1),
protocol= ESP, transform= esp-des esp-md5-hmac , 
lifedur= 0s and 0kb, 
spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x4
00:02:37: validate proposal request 0
00:02:37: ISAKMP (0:1): processing NONCE payload. message ID = 926518983
00:02:37: ISAKMP (0:1): processing ID payload. message ID = 926518983
00:02:37: ISAKMP (0:1): processing ID payload. message ID = 926518983
00:02:37: ISAKMP (0:1): asking for 1 spis from ipsec
00:02:37: ISAKMP (0:1): Node 926518983, Input = IKE_MESG_FROM_PEER, 
   IKE_QM_EXCH
Old State = IKE_QM_READY New State = IKE_QM_SPI_STARVE 

00:02:37: IPSEC(key_engine): got a queue event...
00:02:37: IPSEC(spi_response): getting spi 1746304572 for SA 
from 172.16.172.40 to 171.69.89.129 for prot 3
00:02:37: ISAKMP: received ke message (2/1)
00:02:37: CryptoEngine0: generate hmac context for conn id 1
00:02:37: ISAKMP (0:1): sending packet to 171.69.89.129 (R) QM_IDLE 
00:02:37: ISAKMP (0:1): Node 926518983, Input = IKE_MESG_FROM_IPSEC, 
   IKE_SPI_REPLY
Old State = IKE_QM_SPI_STARVE New State = IKE_QM_R_QM2 

00:02:37: ISAKMP (0:1): received packet from 171.69.89.129 (R) QM_IDLE 
00:02:37: CryptoEngine0: generate hmac context for conn id 1
00:02:37: ipsec allocate flow 0
00:02:37: ipsec allocate flow 0
00:02:37: ISAKMP (0:1): Creating IPSec SAs
00:02:37: inbound SA from 171.69.89.129 to 172.16.172.40
(proxy 10.1.1.10 to 10.1.0.0)
00:02:37: has spi 0x68167E3C and conn_id 2002 and flags 4
00:02:37: lifetime of 2147483 seconds
00:02:37: outbound SA from 172.16.172.40 to 171.69.89.129 
   (proxy 10.1.0.0 to 10.1.1.10)
00:02:37: has spi -697634356 and conn_id 2003 and flags C
00:02:37: lifetime of 2147483 seconds
00:02:37: ISAKMP (0:1): deleting node 926518983 error FALSE 
   reason "quick mode done (await()"
00:02:37: ISAKMP (0:1): Node 926518983, Input = IKE_MESG_FROM_PEER, 
   IKE_QM_EXCH
Old State = IKE_QM_R_QM2 New State = IKE_QM_PHASE2_COMPLETE 

00:02:37: IPSEC(key_engine): got a queue event...
00:02:37: IPSEC(initialize_sas): ,
(key eng. msg.) INBOUND local= 172.16.172.40, remote= 171.69.89.129, 
local_proxy= 10.1.0.0/255.255.0.0/0/0 (type=4), 
remote_proxy= 10.1.1.10/0.0.0.0/0/0 (type=1),
protocol= ESP, transform= esp-des esp-md5-hmac , 
lifedur= 2147483s and 0kb, 
spi= 0x68167E3C(1746304572), conn_id= 2002, keysize= 0, flags= 0x4
00:02:37: IPSEC(initialize_sas): ,
(key eng. msg.) OUTBOUND local= 172.16.172.40, remote= 171.69.89.129, 
local_proxy= 10.1.0.0/255.255.0.0/0/0 (type=4), 
remote_proxy= 10.1.1.10/0.0.0.0/0/0 (type=1),
protocol= ESP, transform= esp-des esp-md5-hmac , 
lifedur= 2147483s and 0kb, 
spi= 0xD66AF1CC(3597332940), conn_id= 2003, keysize= 0, flags= 0xC
00:02:37: IPSEC(create_sa): sa created,
(sa) sa_dest= 172.16.172.40, sa_prot= 50, 
sa_spi= 0x68167E3C(1746304572), 
sa_trans= esp-des esp-md5-hmac , sa_conn_id= 2002
00:02:37: IPSEC(create_sa): sa created,
(sa) sa_dest= 171.69.89.129, sa_prot= 50, 
sa_spi= 0xD66AF1CC(3597332940), 
sa_trans= esp-des esp-md5-hmac , sa_conn_id= 2003

관련 정보

개정 이력

개정 게시 날짜 의견
1.0
19-Jan-2006
최초 릴리스

이 문서가 도움이 되셨습니까?

Feedback피드백

지원 문의

이 문서가 적용되는 제품