❗️Toto je původní verze internetového fóra ISPforum.cz do února 2020 bez možnosti registrace nových uživatelů. Aktivní verzi fóra naleznete na adrese https://telekomunikace.cz

IPsec - resend phase1 packet

Návody a problémy s konfigurací.
Odpovědět
miki17
Příspěvky: 26
Registrován: 14 years ago

IPsec - resend phase1 packet

Příspěvekod miki17 » 13 years ago

Snažím se s kolegou z jiné lokatity odladit spojení MK vs Drytek a mám problém identifikovat problém. Podle logu to vypadá, že spolu obě zařízení vyjednávají za stejných podmínek, ale přesto nám neprojde ani první fáze. Mohl by prosím někdo zkušený mrknout na log,jestli tam něco nevyčte? Moc děkuji

Kód: Vybrat vše

Jan/08/2012 07:58:40 ipsec,debug suitable outbound SP found: 10.101.0.0/16[0] 10.102.0.0/16[0] proto=any dir=out
Jan/08/2012 07:58:40 ipsec,debug suitable inbound SP found: 10.102.0.0/16[0] 10.101.0.0/16[0] proto=any dir=in
Jan/08/2012 07:58:40 ipsec,debug new acquire 10.101.0.0/16[0] 10.102.0.0/16[0] proto=any dir=out
Jan/08/2012 07:58:40 ipsec,debug,packet  (proto_id=AH spisize=4 spi=00000000 spi_p=00000000 encmode=Tunnel reqid=0:0)
Jan/08/2012 07:58:40 ipsec,debug,packet   (trns_id=MD5 authtype=hmac-md5)
Jan/08/2012 07:58:40 ipsec,debug,packet   (trns_id=SHA authtype=hmac-sha)
Jan/08/2012 07:58:40 ipsec,debug IPsec-SA request for 10.102.1.253 queued due to no phase1 found.
Jan/08/2012 07:58:40 ipsec,debug,packet ===
Jan/08/2012 07:58:40 ipsec,debug initiate new phase 1 negotiation: 10.102.3.12[500]<=>10.102.1.253[500]
Jan/08/2012 07:58:40 ipsec,debug begin Identity Protection mode.
Jan/08/2012 07:58:40 ipsec,debug,packet new cookie:
Jan/08/2012 07:58:40 ipsec,debug,packet 4282b8f671dd7c77
Jan/08/2012 07:58:40 ipsec,debug,packet add payload of len 56, next type 13
Jan/08/2012 07:58:40 ipsec,debug,packet add payload of len 16, next type 0
Jan/08/2012 07:58:40 ipsec,debug,packet 108 bytes from 10.102.3.12[500] to 10.102.1.253[500]
Jan/08/2012 07:58:40 ipsec,debug,packet sockname 10.102.3.12[500]
Jan/08/2012 07:58:40 ipsec,debug,packet send packet from 10.102.3.12[500]
Jan/08/2012 07:58:40 ipsec,debug,packet send packet to 10.102.1.253[500]
Jan/08/2012 07:58:40 ipsec,debug,packet src4 10.102.3.12[500]
Jan/08/2012 07:58:40 ipsec,debug,packet dst4 10.102.1.253[500]
Jan/08/2012 07:58:40 ipsec,debug,packet 1 times of 108 bytes message will be sent to 10.102.1.253[500]
Jan/08/2012 07:58:40 ipsec,debug,packet 4282b8f6 71dd7c77 00000000 00000000 01100200 00000000 0000006c 0d00003c
Jan/08/2012 07:58:40 ipsec,debug,packet 00000001 00000001 00000030 01010001 00000028 01010000 800b0001 000c0004
Jan/08/2012 07:58:40 ipsec,debug,packet 00015180 80010007 800e0080 80030001 80020002 80040002 00000014 afcad713
Jan/08/2012 07:58:40 ipsec,debug,packet 68a1f1c9 6b8696fc 77570100
Jan/08/2012 07:58:40 ipsec,debug,packet resend phase1 packet 4282b8f671dd7c77:0000000000000000
Jan/08/2012 07:58:40 ipsec,debug,packet ==========
Jan/08/2012 07:58:40 ipsec,debug,packet 108 bytes message received from 10.102.1.253[500] to 10.102.3.12[500]
Jan/08/2012 07:58:40 ipsec,debug,packet 4282b8f6 71dd7c77 2327eeb9 5b3d4d06 01100200 00000000 0000006c 0d00003c
Jan/08/2012 07:58:40 ipsec,debug,packet 00000001 00000001 00000030 01010001 00000028 01010000 800b0001 000c0004
Jan/08/2012 07:58:40 ipsec,debug,packet 00015180 80010007 800e0080 80030001 80020002 80040002 00000014 afcad713
Jan/08/2012 07:58:40 ipsec,debug,packet 68a1f1c9 6b8696fc 77570100
Jan/08/2012 07:58:40 ipsec,debug,packet begin.
Jan/08/2012 07:58:40 ipsec,debug,packet seen nptype=1(sa)
Jan/08/2012 07:58:40 ipsec,debug,packet seen nptype=13(vid)
Jan/08/2012 07:58:40 ipsec,debug,packet succeed.
Jan/08/2012 07:58:40 ipsec,debug received Vendor ID: DPD
Jan/08/2012 07:58:40 ipsec,debug,packet total SA len=56
Jan/08/2012 07:58:40 ipsec,debug,packet 00000001 00000001 00000030 01010001 00000028 01010000 800b0001 000c0004
Jan/08/2012 07:58:40 ipsec,debug,packet 00015180 80010007 800e0080 80030001 80020002 80040002
Jan/08/2012 07:58:40 ipsec,debug,packet begin.
Jan/08/2012 07:58:40 ipsec,debug,packet seen nptype=2(prop)
Jan/08/2012 07:58:40 ipsec,debug,packet succeed.
Jan/08/2012 07:58:40 ipsec,debug,packet proposal #1 len=48
Jan/08/2012 07:58:40 ipsec,debug,packet begin.
Jan/08/2012 07:58:40 ipsec,debug,packet seen nptype=3(trns)
Jan/08/2012 07:58:40 ipsec,debug,packet succeed.
Jan/08/2012 07:58:40 ipsec,debug,packet transform #1 len=40
Jan/08/2012 07:58:40 ipsec,debug,packet type=Life Type, flag=0x8000, lorv=seconds
Jan/08/2012 07:58:40 ipsec,debug,packet type=Life Duration, flag=0x0000, lorv=4
Jan/08/2012 07:58:40 ipsec,debug,packet type=Encryption Algorithm, flag=0x8000, lorv=AES-CBC
Jan/08/2012 07:58:40 ipsec,debug,packet encryption(aes)
Jan/08/2012 07:58:40 ipsec,debug,packet type=Key Length, flag=0x8000, lorv=128
Jan/08/2012 07:58:40 ipsec,debug,packet type=Authentication Method, flag=0x8000, lorv=pre-shared key
Jan/08/2012 07:58:41 ipsec,debug,packet type=Hash Algorithm, flag=0x8000, lorv=SHA
Jan/08/2012 07:58:41 ipsec,debug,packet hash(sha1)
Jan/08/2012 07:58:41 ipsec,debug,packet type=Group Description, flag=0x8000, lorv=1024-bit MODP group
Jan/08/2012 07:58:41 ipsec,debug,packet hmac(modp1024)
Jan/08/2012 07:58:41 ipsec,debug,packet pair 1:
Jan/08/2012 07:58:41 ipsec,debug,packet  0x497e48: next=(nil) tnext=(nil)
Jan/08/2012 07:58:41 ipsec,debug,packet proposal #1: 1 transform
Jan/08/2012 07:58:41 ipsec,debug,packet prop#=1, prot-id=ISAKMP, spi-size=0, #trns=1
Jan/08/2012 07:58:41 ipsec,debug,packet trns#=1, trns-id=IKE
Jan/08/2012 07:58:41 ipsec,debug,packet type=Life Type, flag=0x8000, lorv=seconds
Jan/08/2012 07:58:41 ipsec,debug,packet type=Life Duration, flag=0x0000, lorv=4
Jan/08/2012 07:58:41 ipsec,debug,packet type=Encryption Algorithm, flag=0x8000, lorv=AES-CBC
Jan/08/2012 07:58:41 ipsec,debug,packet type=Key Length, flag=0x8000, lorv=128
Jan/08/2012 07:58:41 ipsec,debug,packet type=Authentication Method, flag=0x8000, lorv=pre-shared key
Jan/08/2012 07:58:41 ipsec,debug,packet type=Hash Algorithm, flag=0x8000, lorv=SHA
Jan/08/2012 07:58:41 ipsec,debug,packet type=Group Description, flag=0x8000, lorv=1024-bit MODP group
Jan/08/2012 07:58:41 ipsec,debug,packet Compared: DB:Peer
Jan/08/2012 07:58:41 ipsec,debug,packet (lifetime = 86400:86400)
Jan/08/2012 07:58:41 ipsec,debug,packet (lifebyte = 0:0)
Jan/08/2012 07:58:41 ipsec,debug,packet enctype = AES-CBC:AES-CBC
Jan/08/2012 07:58:41 ipsec,debug,packet (encklen = 128:128)
Jan/08/2012 07:58:41 ipsec,debug,packet hashtype = SHA:SHA
Jan/08/2012 07:58:41 ipsec,debug,packet authmethod = pre-shared key:pre-shared key
Jan/08/2012 07:58:41 ipsec,debug,packet dh_group = 1024-bit MODP group:1024-bit MODP group
Jan/08/2012 07:58:41 ipsec,debug,packet an acceptable proposal found.
Jan/08/2012 07:58:41 ipsec,debug,packet hmac(modp1024)
Jan/08/2012 07:58:41 ipsec,debug,packet agreed on pre-shared key auth.
Jan/08/2012 07:58:41 ipsec,debug,packet ===
Jan/08/2012 07:58:41 ipsec,debug,packet compute DH's private.
Jan/08/2012 07:58:41 ipsec,debug,packet 5a2ec506 fafb1e6e f966e33d df23b8ad b776281c e91b3488 7d408ae5 9565030a
Jan/08/2012 07:58:41 ipsec,debug,packet 0f394ad7 2e637332 fbafab64 cb8fd022 97d4e77d 2ebb083f e3dafffb 3c688d6d
Jan/08/2012 07:58:41 ipsec,debug,packet 8bcd4b43 5f5849cc c6b6d9e4 fb5eeb8c 5ab5fd44 ba6c19ca 861da6ca 5d622a98
Jan/08/2012 07:58:41 ipsec,debug,packet 8e985fa6 e8b20ffa c6c3a0f5 3ff3c982 aebe4b66 1f0acf93 ae7a13ff 86718e44
Jan/08/2012 07:58:41 ipsec,debug,packet compute DH's public.
Jan/08/2012 07:58:41 ipsec,debug,packet 37efe998 f1720e8e d2a5de06 3cac53a8 ba12cd29 2a227802 678634bb 1f069ee3
Jan/08/2012 07:58:41 ipsec,debug,packet 325a08d4 4a86604c 700fed1b 3780eb6c eeeeff6a 93b57812 d50b0a8a 7d1cd4b2
Jan/08/2012 07:58:41 ipsec,debug,packet f42db890 0e7fbe64 2e7ad99c 720e2a29 fe4c6a89 f133ce86 852c1460 48d37778
Jan/08/2012 07:58:41 ipsec,debug,packet 39b34279 6286741b b3d31be0 83a158c2 6beb51cc 53ccb8a7 1c38a7ed ed196920
Jan/08/2012 07:58:41 ipsec,debug,packet add payload of len 128, next type 10
Jan/08/2012 07:58:41 ipsec,debug,packet add payload of len 24, next type 0
Jan/08/2012 07:58:41 ipsec,debug,packet 188 bytes from 10.102.3.12[500] to 10.102.1.253[500]
Jan/08/2012 07:58:41 ipsec,debug,packet sockname 10.102.3.12[500]
Jan/08/2012 07:58:41 ipsec,debug,packet send packet from 10.102.3.12[500]
Jan/08/2012 07:58:41 ipsec,debug,packet send packet to 10.102.1.253[500]
Jan/08/2012 07:58:41 ipsec,debug,packet src4 10.102.3.12[500]
Jan/08/2012 07:58:41 ipsec,debug,packet dst4 10.102.1.253[500]
Jan/08/2012 07:58:41 ipsec,debug,packet 1 times of 188 bytes message will be sent to 10.102.1.253[500]
Jan/08/2012 07:58:41 ipsec,debug,packet 4282b8f6 71dd7c77 2327eeb9 5b3d4d06 04100200 00000000 000000bc 0a000084
Jan/08/2012 07:58:41 ipsec,debug,packet 37efe998 f1720e8e d2a5de06 3cac53a8 ba12cd29 2a227802 678634bb 1f069ee3
Jan/08/2012 07:58:41 ipsec,debug,packet 325a08d4 4a86604c 700fed1b 3780eb6c eeeeff6a 93b57812 d50b0a8a 7d1cd4b2
Jan/08/2012 07:58:41 ipsec,debug,packet f42db890 0e7fbe64 2e7ad99c 720e2a29 fe4c6a89 f133ce86 852c1460 48d37778
Jan/08/2012 07:58:41 ipsec,debug,packet 39b34279 6286741b b3d31be0 83a158c2 6beb51cc 53ccb8a7 1c38a7ed ed196920
Jan/08/2012 07:58:41 ipsec,debug,packet 0000001c d06d9b7e 6b5ce3da 08bc159c a599598a 5d24cdd5 4825929c
Jan/08/2012 07:58:41 ipsec,debug,packet resend phase1 packet 4282b8f671dd7c77:2327eeb95b3d4d06
Jan/08/2012 07:58:42 ipsec,debug,packet ==========
Jan/08/2012 07:58:42 ipsec,debug,packet 180 bytes message received from 10.102.1.253[500] to 10.102.3.12[500]
Jan/08/2012 07:58:42 ipsec,debug,packet 4282b8f6 71dd7c77 2327eeb9 5b3d4d06 04100200 00000000 000000b4 0a000084
Jan/08/2012 07:58:42 ipsec,debug,packet c8a1379b 2e6dce2f 6300de09 d5e5f40a d8cd332e 2522837f 0afa2d2b d892785d
Jan/08/2012 07:58:42 ipsec,debug,packet 8717bbe1 7d263697 eec50dc1 c4d7c6ec af40ed5d cc7e525a 886fc25b 3f6110aa
Jan/08/2012 07:58:42 ipsec,debug,packet 9e4fa969 1a71be03 0fe812bc b2ea698f 458f3a74 9fe88f26 af375147 c4e00ebb
Jan/08/2012 07:58:42 ipsec,debug,packet 3ccbfc13 c0f24961 96de59cf 53448cb8 1d0b6776 6ff079da 2bb64c5b c8eba75b
Jan/08/2012 07:58:42 ipsec,debug,packet 00000014 c1886c5e 58555455 56d71839 ca93f82b
Jan/08/2012 07:58:42 ipsec,debug,packet begin.
Jan/08/2012 07:58:42 ipsec,debug,packet seen nptype=4(ke)
Jan/08/2012 07:58:42 ipsec,debug,packet seen nptype=10(nonce)
Jan/08/2012 07:58:42 ipsec,debug,packet succeed.
Jan/08/2012 07:58:42 ipsec,debug,packet ===
Jan/08/2012 07:58:42 ipsec,debug,packet compute DH's shared.
Jan/08/2012 07:58:42 ipsec,debug,packet
Jan/08/2012 07:58:42 ipsec,debug,packet bd29ec33 0212535d 6cb4995e 5000e4e7 c9c28592 8b962118 a6ce70ef 44a84e07
Jan/08/2012 07:58:42 ipsec,debug,packet 957767bf cc2693e0 2981072a 6c78d05b 65098091 28dbf6a4 79c27a4a 71dd21ec
Jan/08/2012 07:58:42 ipsec,debug,packet e615137b 39cc2b7a aa283723 c2ea23ad e3fcb65a 4e5a103a c72d9079 bc9fe68c
Jan/08/2012 07:58:42 ipsec,debug,packet 0d8bff6b e54fbbe6 561c482c 07c5ba03 d612e71f dbf41fdb c3f7c16b a9ff27e2
Jan/08/2012 07:58:42 ipsec,debug,packet the psk found.
Jan/08/2012 07:58:42 ipsec,debug,packet nonce 1:
Jan/08/2012 07:58:42 ipsec,debug,packet d06d9b7e 6b5ce3da 08bc159c a599598a 5d24cdd5 4825929c
Jan/08/2012 07:58:42 ipsec,debug,packet nonce 2:
Jan/08/2012 07:58:42 ipsec,debug,packet c1886c5e 58555455 56d71839 ca93f82b
Jan/08/2012 07:58:42 ipsec,debug,packet hmac(hmac_sha1)
Jan/08/2012 07:58:42 ipsec,debug,packet SKEYID computed:
Jan/08/2012 07:58:42 ipsec,debug,packet 9192f25e 8c37e3d9 2da0027d 57c70010 c01025ba
Jan/08/2012 07:58:42 ipsec,debug,packet hmac(hmac_sha1)
Jan/08/2012 07:58:42 ipsec,debug,packet SKEYID_d computed:
Jan/08/2012 07:58:42 ipsec,debug,packet 584baa2e 85a66fd6 6c537a5d 6abef68c 5a311416
Jan/08/2012 07:58:42 ipsec,debug,packet hmac(hmac_sha1)
Jan/08/2012 07:58:42 ipsec,debug,packet SKEYID_a computed:
Jan/08/2012 07:58:42 ipsec,debug,packet a604b1de 6da38b1e 75642d48 6692c469 65057c37
Jan/08/2012 07:58:42 ipsec,debug,packet hmac(hmac_sha1)
Jan/08/2012 07:58:42 ipsec,debug,packet SKEYID_e computed:
Jan/08/2012 07:58:42 ipsec,debug,packet fecbcb2b a3b8178a add4b385 416be987 127eb5e2
Jan/08/2012 07:58:42 ipsec,debug,packet encryption(aes)
Jan/08/2012 07:58:42 ipsec,debug,packet hash(sha1)
Jan/08/2012 07:58:42 ipsec,debug,packet final encryption key computed:
Jan/08/2012 07:58:42 ipsec,debug,packet fecbcb2b a3b8178a add4b385 416be987
Jan/08/2012 07:58:42 ipsec,debug,packet hash(sha1)
Jan/08/2012 07:58:42 ipsec,debug,packet encryption(aes)
Jan/08/2012 07:58:42 ipsec,debug,packet IV computed:
Jan/08/2012 07:58:42 ipsec,debug,packet daabb992 3fb28e00 02d92f76 e15edc86
Jan/08/2012 07:58:42 ipsec,debug,packet use ID type of IPv4_address
Jan/08/2012 07:58:42 ipsec,debug,packet HASH with:
Jan/08/2012 07:58:42 ipsec,debug,packet 37efe998 f1720e8e d2a5de06 3cac53a8 ba12cd29 2a227802 678634bb 1f069ee3
Jan/08/2012 07:58:42 ipsec,debug,packet 325a08d4 4a86604c 700fed1b 3780eb6c eeeeff6a 93b57812 d50b0a8a 7d1cd4b2
Jan/08/2012 07:58:42 ipsec,debug,packet f42db890 0e7fbe64 2e7ad99c 720e2a29 fe4c6a89 f133ce86 852c1460 48d37778
Jan/08/2012 07:58:42 ipsec,debug,packet 39b34279 6286741b b3d31be0 83a158c2 6beb51cc 53ccb8a7 1c38a7ed ed196920
Jan/08/2012 07:58:42 ipsec,debug,packet c8a1379b 2e6dce2f 6300de09 d5e5f40a d8cd332e 2522837f 0afa2d2b d892785d
Jan/08/2012 07:58:42 ipsec,debug,packet 8717bbe1 7d263697 eec50dc1 c4d7c6ec af40ed5d cc7e525a 886fc25b 3f6110aa
Jan/08/2012 07:58:42 ipsec,debug,packet 9e4fa969 1a71be03 0fe812bc b2ea698f 458f3a74 9fe88f26 af375147 c4e00ebb
Jan/08/2012 07:58:42 ipsec,debug,packet 3ccbfc13 c0f24961 96de59cf 53448cb8 1d0b6776 6ff079da 2bb64c5b c8eba75b
Jan/08/2012 07:58:42 ipsec,debug,packet 4282b8f6 71dd7c77 2327eeb9 5b3d4d06 00000001 00000001 00000030 01010001
Jan/08/2012 07:58:42 ipsec,debug,packet 00000028 01010000 800b0001 000c0004 00015180 80010007 800e0080 80030001
Jan/08/2012 07:58:42 ipsec,debug,packet 80020002 80040002 011101f4 0a66030c
Jan/08/2012 07:58:42 ipsec,debug,packet hmac(hmac_sha1)
Jan/08/2012 07:58:42 ipsec,debug,packet HASH computed:
Jan/08/2012 07:58:42 ipsec,debug,packet e7816de4 d4dab265 292b0009 8d93437f 57738193
Jan/08/2012 07:58:42 ipsec,debug,packet add payload of len 8, next type 8
Jan/08/2012 07:58:42 ipsec,debug,packet add payload of len 20, next type 0
Jan/08/2012 07:58:42 ipsec,debug,packet begin encryption.
Jan/08/2012 07:58:42 ipsec,debug,packet encryption(aes)
Jan/08/2012 07:58:42 ipsec,debug,packet pad length = 12
Jan/08/2012 07:58:42 ipsec,debug,packet 0800000c 011101f4 0a66030c 00000018 e7816de4 d4dab265 292b0009 8d93437f
Jan/08/2012 07:58:42 ipsec,debug,packet 57738193 aac48ca3 8bf06113 89036c0b
Jan/08/2012 07:58:42 ipsec,debug,packet encryption(aes)
Jan/08/2012 07:58:42 ipsec,debug,packet with key:
Jan/08/2012 07:58:42 ipsec,debug,packet fecbcb2b a3b8178a add4b385 416be987
Jan/08/2012 07:58:42 ipsec,debug,packet encrypted payload by IV:
Jan/08/2012 07:58:42 ipsec,debug,packet daabb992 3fb28e00 02d92f76 e15edc86
Jan/08/2012 07:58:42 ipsec,debug,packet save IV for next:
Jan/08/2012 07:58:42 ipsec,debug,packet a7b83add 13cb1a04 a1ca5c1b a5d771b3
Jan/08/2012 07:58:42 ipsec,debug,packet encrypted.
Jan/08/2012 07:58:42 ipsec,debug,packet 76 bytes from 10.102.3.12[500] to 10.102.1.253[500]
Jan/08/2012 07:58:42 ipsec,debug,packet sockname 10.102.3.12[500]
Jan/08/2012 07:58:42 ipsec,debug,packet send packet from 10.102.3.12[500]
Jan/08/2012 07:58:42 ipsec,debug,packet send packet to 10.102.1.253[500]
Jan/08/2012 07:58:42 ipsec,debug,packet src4 10.102.3.12[500]
Jan/08/2012 07:58:42 ipsec,debug,packet dst4 10.102.1.253[500]
Jan/08/2012 07:58:42 ipsec,debug,packet 1 times of 76 bytes message will be sent to 10.102.1.253[500]
Jan/08/2012 07:58:42 ipsec,debug,packet 4282b8f6 71dd7c77 2327eeb9 5b3d4d06 05100201 00000000 0000004c eb6def51
Jan/08/2012 07:58:42 ipsec,debug,packet 5e71777f 99251fa4 9e7bfea8 5bf19cd0 4102f004 c3293a99 10230bec a7b83add
Jan/08/2012 07:58:42 ipsec,debug,packet 13cb1a04 a1ca5c1b a5d771b3
Jan/08/2012 07:58:42 ipsec,debug,packet resend phase1 packet 4282b8f671dd7c77:2327eeb95b3d4d06
Jan/08/2012 07:58:45 ipsec,debug,packet ==========
Jan/08/2012 07:58:45 ipsec,debug,packet 180 bytes message received from 10.102.1.253[500] to 10.102.3.12[500]
Jan/08/2012 07:58:45 ipsec,debug,packet 4282b8f6 71dd7c77 2327eeb9 5b3d4d06 04100200 00000000 000000b4 0a000084
Jan/08/2012 07:58:45 ipsec,debug,packet c8a1379b 2e6dce2f 6300de09 d5e5f40a d8cd332e 2522837f 0afa2d2b d892785d
Jan/08/2012 07:58:45 ipsec,debug,packet 8717bbe1 7d263697 eec50dc1 c4d7c6ec af40ed5d cc7e525a 886fc25b 3f6110aa
Jan/08/2012 07:58:45 ipsec,debug,packet 9e4fa969 1a71be03 0fe812bc b2ea698f 458f3a74 9fe88f26 af375147 c4e00ebb
Jan/08/2012 07:58:45 ipsec,debug,packet 3ccbfc13 c0f24961 96de59cf 53448cb8 1d0b6776 6ff079da 2bb64c5b c8eba75b
Jan/08/2012 07:58:45 ipsec,debug,packet 00000014 c1886c5e 58555455 56d71839 ca93f82b
Jan/08/2012 07:58:45 ipsec,debug,packet sockname 10.102.3.12[500]
Jan/08/2012 07:58:45 ipsec,debug,packet send packet from 10.102.3.12[500]
Jan/08/2012 07:58:45 ipsec,debug,packet send packet to 10.102.1.253[500]
Jan/08/2012 07:58:45 ipsec,debug,packet src4 10.102.3.12[500]
Jan/08/2012 07:58:45 ipsec,debug,packet dst4 10.102.1.253[500]
Jan/08/2012 07:58:45 ipsec,debug,packet 1 times of 76 bytes message will be sent to 10.102.1.253[500]
Jan/08/2012 07:58:45 ipsec,debug,packet 4282b8f6 71dd7c77 2327eeb9 5b3d4d06 05100201 00000000 0000004c eb6def51
Jan/08/2012 07:58:45 ipsec,debug,packet 5e71777f 99251fa4 9e7bfea8 5bf19cd0 4102f004 c3293a99 10230bec a7b83add
Jan/08/2012 07:58:45 ipsec,debug,packet 13cb1a04 a1ca5c1b a5d771b3
Jan/08/2012 07:58:45 ipsec,debug the packet is retransmitted by 10.102.1.253[500].
Jan/08/2012 07:58:51 ipsec,debug,packet ==========
Jan/08/2012 07:58:51 ipsec,debug,packet 180 bytes message received from 10.102.1.253[500] to 10.102.3.12[500]
Jan/08/2012 07:58:51 ipsec,debug,packet 4282b8f6 71dd7c77 2327eeb9 5b3d4d06 04100200 00000000 000000b4 0a000084
Jan/08/2012 07:58:51 ipsec,debug,packet c8a1379b 2e6dce2f 6300de09 d5e5f40a d8cd332e 2522837f 0afa2d2b d892785d
Jan/08/2012 07:58:51 ipsec,debug,packet 8717bbe1 7d263697 eec50dc1 c4d7c6ec af40ed5d cc7e525a 886fc25b 3f6110aa
Jan/08/2012 07:58:51 ipsec,debug,packet 9e4fa969 1a71be03 0fe812bc b2ea698f 458f3a74 9fe88f26 af375147 c4e00ebb
Jan/08/2012 07:58:51 ipsec,debug,packet 3ccbfc13 c0f24961 96de59cf 53448cb8 1d0b6776 6ff079da 2bb64c5b c8eba75b
Jan/08/2012 07:58:51 ipsec,debug,packet 00000014 c1886c5e 58555455 56d71839 ca93f82b
Jan/08/2012 07:58:51 ipsec,debug,packet sockname 10.102.3.12[500]
Jan/08/2012 07:58:51 ipsec,debug,packet send packet from 10.102.3.12[500]
Jan/08/2012 07:58:51 ipsec,debug,packet send packet to 10.102.1.253[500]
Jan/08/2012 07:58:51 ipsec,debug,packet src4 10.102.3.12[500]
Jan/08/2012 07:58:51 ipsec,debug,packet dst4 10.102.1.253[500]
Jan/08/2012 07:58:51 ipsec,debug,packet 1 times of 76 bytes message will be sent to 10.102.1.253[500]
Jan/08/2012 07:58:51 ipsec,debug,packet 4282b8f6 71dd7c77 2327eeb9 5b3d4d06 05100201 00000000 0000004c eb6def51
Jan/08/2012 07:58:51 ipsec,debug,packet 5e71777f 99251fa4 9e7bfea8 5bf19cd0 4102f004 c3293a99 10230bec a7b83add
Jan/08/2012 07:58:51 ipsec,debug,packet 13cb1a04 a1ca5c1b a5d771b3
Jan/08/2012 07:58:51 ipsec,debug the packet is retransmitted by 10.102.1.253[500].
Jan/08/2012 07:58:52 ipsec,debug,packet 76 bytes from 10.102.3.12[500] to 10.102.1.253[500]
Jan/08/2012 07:58:52 ipsec,debug,packet sockname 10.102.3.12[500]
Jan/08/2012 07:58:52 ipsec,debug,packet send packet from 10.102.3.12[500]
Jan/08/2012 07:58:52 ipsec,debug,packet send packet to 10.102.1.253[500]
Jan/08/2012 07:58:52 ipsec,debug,packet src4 10.102.3.12[500]
Jan/08/2012 07:58:52 ipsec,debug,packet dst4 10.102.1.253[500]
Jan/08/2012 07:58:52 ipsec,debug,packet 1 times of 76 bytes message will be sent to 10.102.1.253[500]
Jan/08/2012 07:58:52 ipsec,debug,packet 4282b8f6 71dd7c77 2327eeb9 5b3d4d06 05100201 00000000 0000004c eb6def51
Jan/08/2012 07:58:52 ipsec,debug,packet 5e71777f 99251fa4 9e7bfea8 5bf19cd0 4102f004 c3293a99 10230bec a7b83add
Jan/08/2012 07:58:52 ipsec,debug,packet 13cb1a04 a1ca5c1b a5d771b3
Jan/08/2012 07:58:52 ipsec,debug,packet resend phase1 packet 4282b8f671dd7c77:2327eeb95b3d4d06
Jan/08/2012 07:59:02 ipsec,debug,packet 76 bytes from 10.102.3.12[500] to 10.102.1.253[500]
Jan/08/2012 07:59:02 ipsec,debug,packet sockname 10.102.3.12[500]
Jan/08/2012 07:59:02 ipsec,debug,packet send packet from 10.102.3.12[500]
Jan/08/2012 07:59:02 ipsec,debug,packet send packet to 10.102.1.253[500]
Jan/08/2012 07:59:02 ipsec,debug,packet src4 10.102.3.12[500]
Jan/08/2012 07:59:02 ipsec,debug,packet dst4 10.102.1.253[500]
Jan/08/2012 07:59:02 ipsec,debug,packet 1 times of 76 bytes message will be sent to 10.102.1.253[500]
Jan/08/2012 07:59:02 ipsec,debug,packet 4282b8f6 71dd7c77 2327eeb9 5b3d4d06 05100201 00000000 0000004c eb6def51
Jan/08/2012 07:59:02 ipsec,debug,packet 5e71777f 99251fa4 9e7bfea8 5bf19cd0 4102f004 c3293a99 10230bec a7b83add
Jan/08/2012 07:59:02 ipsec,debug,packet 13cb1a04 a1ca5c1b a5d771b3
Jan/08/2012 07:59:02 ipsec,debug,packet resend phase1 packet 4282b8f671dd7c77:2327eeb95b3d4d06
Jan/08/2012 07:59:10 ipsec,debug,packet ==========
0 x
Nahoru
Majklik
Příspěvky: 1949
Registrován: 14 years ago

Příspěvekod Majklik » 13 years ago

No, možná by to chtělo jendoduché schéma s popisem co chceš dosáhnout a kde jsou jaké adresy. Protože to co vidím, se mi jeví jako silně neběžná situace.
Dle toho soudím, že chceš použít dvě krabičky v roli IPsec security gateway, které dělají tunel mezi dvěma LAN sítěma, které mají IP segmenty 10.101.0.0/16 a 10.102.0.0/16. To je asi jasné, ale celkem nejasné je, prč ty dvě IPsec brány mají na straně tunelové IP adresy ležící uvnitř toho segmentu 10.102.0.0/16? A to vidím 10.102.3.12 a 10.102.1.253. Né, že by nemělo jít nakonfigurovat obecně, ale postrádá to hodně smysl, není v tom nějaká bota?
Jinak, Draytek je pěkný krám, má zprasený IP stack, který nezvládá korektně práci s fragmentovanými pakety (ověřeno na modelech 2200, 2600, 2800, 2900, 2910, 2950 a něco 3x00), dlouho neúspěšně řešeno i s jejich supportem. Pokud nemáte mezi těma dvma sítěma infrastrukturu zachovávající stejné MTU po celé trase, tak přičina nefunkčnosti může být i v tom (ale furt lepší situace, než jejich VoIP stack, který je ochoten "držet" nahozený VoIP hovor i hodiny po položení sluchátka, zapomíná posílat SIP zprávy o ukončení hovoru k ústředně, to dokáže pěkně prodražit levné VoIP služby).
0 x
Nahoru
miki17
Příspěvky: 26
Registrován: 14 years ago

Příspěvekod miki17 » 13 years ago

Díky za reakci. Protože mám Mikrotik za NATem, tak jsem volil cestu menšího odporu a to přes L2TP protokol. Proto ty dvě stejně vypadající IP. Draytek ji údajně neumí změnit. Nakonec jsem rezignoval a pořídíme na druhou stranu taky Mikrotik. Nestojí zas až takové peníze a jistě se to vyplatí. Pokud se to ovšem podaří nastavit :)
0 x
Nahoru
Majklik
Příspěvky: 1949
Registrován: 14 years ago

Příspěvekod Majklik » 13 years ago

Aha, tochu šílené.
Vetšina Drayteků novějšího data umí NAT-T pro IPsec, takže na Drayteku nastavit režim dial-in a mikrotik zapnout nat-t a send initial contact a mělo by to proti sobě jet (L2TP jde strčit pak až dovnitř toho IPsecu, některé umí i GRE). Pokud máš tlustou linku, tak se RBčko zhroutí, protože nemají podporu pro HW šifrování, Drayteky (vyjma 2200) to mají. Takže na řadě RB4xxAH čekej max tak do 10 Mbps kanálu.
0 x
Nahoru
Odpovědět

Zpět na „Konfigurace“