Всем доброго дня! Имеется впска с Debian и Cisco ISR 2801 (за NAT) все порты проброшены, с другой железки коннект нормальный! На циске л2тп сервер (конфиг ниже), на впске strongswan и xl2tpd. Вроде все настроил, пытаюсь подключится.
Из ошибок только
IDir 'CISCO_внутренний_ип' does not match to 'мой_белый_адресс'
. Вроде как не критично, но все же. И ниже
establishing connection 'VPN1' failed.
Полный лог:
root@vps:/var/run/xl2tpd# ipsec up VPN1
initiating Main Mode IKE_SA VPN1[2] to мой_белый_ип
generating ID_PROT request 0 [ SA V V V V V ]
sending packet: from впска[500] to мой_белый_ип[500] (212 bytes)
received packet: from мой_белый_ип[500] to впска[500] (100 bytes)
parsed ID_PROT response 0 [ SA V ]
received NAT-T (RFC 3947) vendor ID
selected proposal: IKE:3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024
generating ID_PROT request 0 [ KE No NAT-D NAT-D ]
sending packet: from впска[500] to мой_белый_ип[500] (244 bytes)
received packet: from мой_белый_ип[500] to впска[500] (304 bytes)
parsed ID_PROT response 0 [ KE No V V V V NAT-D NAT-D ]
received Cisco Unity vendor ID
received DPD vendor ID
received unknown vendor ID: 7b:ef:fc:65:da:03:85:af:41:01:d3:0c:68:0b:19:48
received XAuth vendor ID
remote host is behind NAT
generating ID_PROT request 0 [ ID HASH N(INITIAL_CONTACT) ]
sending packet: from впска[4500] to мой_белый_ип[4500] (100 bytes)
received packet: from мой_белый_ип[4500] to впска[4500] (68 bytes)
parsed ID_PROT response 0 [ ID HASH ]
IDir 'CISCO_внутренний_ип' does not match to 'мой_белый_ип'
deleting IKE_SA VPN1[2] between впска[впска]..мой_белый_ип[%any]
sending DELETE for IKE_SA VPN1[2]
generating INFORMATIONAL_V1 request 4221341034 [ HASH D ]
sending packet: from впска[4500] to мой_белый_ип[4500] (84 bytes)
establishing connection 'VPN1' failed
root@vps:/var/run/xl2tpd# ^C
конфиг впн клиентов:
root@vps:/var/run/xl2tpd# cat /etc/ipsec.conf
config setup
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev1
authby=secret
ike=aes128-sha1-modp1024,3des-sha1-modp1024!
esp=aes128-sha1-modp1024,3des-sha1-modp1024!
conn VPN1
keyexchange=ikev1
left=%defaultroute
auto=add
authby=secret
type=transport
leftprotoport=17/1701
rightprotoport=17/1701
right=мой_белый_ип
конфиг циски:
crypto isakmp policy 10
encr 3des
authentication pre-share
group 2
lifetime 3600
crypto isakmp key PSK_ключ address 0.0.0.0 0.0.0.0 no-xauth
crypto isakmp identity hostname
!
!
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
mode transport
!
crypto dynamic-map L2TP-MAP 10
set nat demux
set transform-set ESP-3DES-SHA
!
!
crypto map CRYPTO_MAP 100 ipsec-isakmp dynamic L2TP-MAP
Если еще что то нужно, то пишите)
Заранее спасибо!
Средний
