Исходное сообщение
"Проблема с VPN-соединением между PIX 525 и PIX 515" Отправлено Kir_rus, 19-Окт-06 07:16
Добрый день! Спасибо за отклик! Да, конфиги всех Пиксов приведены без изменения, использовал sh run и далее просто копировал и вставлял сюда. Если я вас правильно понял: я сделал для начала на 515-м object-group network RemoteOffices и задал сеть, потом то же самое для object-group network MainOffice, далее создал ACL: access-list 100 permit ip object-group MainOffice object-group RemoteOffices. Теперь конфиг 515-го Пикса выглядит так: : Saved : PIX Version 6.3(4) interface ethernet0 auto interface ethernet1 100full interface ethernet2 auto interface ethernet3 100full interface ethernet4 auto interface ethernet5 auto nameif ethernet0 outside security0 nameif ethernet1 inside security100 nameif ethernet2 DMZ security50 nameif ethernet3 DMZ1 security50 nameif ethernet4 DMZ_pr security50 nameif ethernet5 intf5 security10 enable password qZMF4yz9mcSUGIpE encrypted passwd qZMF4yz9mcSUGIpE encrypted hostname avppix domain-name ocv.ru fixup protocol dns maximum-length 512 fixup protocol ftp 21 fixup protocol h323 h225 1720 fixup protocol h323 ras 1718-1719 fixup protocol http 80 fixup protocol rsh 514 fixup protocol rtsp 554 fixup protocol sip 5060 fixup protocol sip udp 5060 fixup protocol skinny 2000 fixup protocol smtp 25 fixup protocol sqlnet 1521 fixup protocol tftp 69 names object-group network RemoteOffices   network-object 172.25.0.0 255.255.240.0 object-group network MainOffice   network-object 172.30.0.0 255.255.240.0   network-object 172.30.128.0 255.255.240.0 access-list 100 permit ip 172.30.0.0 255.255.0.0 172.25.0.0 255.255.0.0 access-list 100 permit ip 172.25.0.0 255.255.0.0 172.30.0.0 255.255.0.0 access-list 100 permit ip object-group MainOffice object-group RemoteOffices access-list DMZ_pr_acl permit tcp host 192.168.51.4 any eq www access-list DMZ_pr_acl permit tcp host 192.168.51.4 any eq domain access-list 102 permit udp host 172.25.1.12 any eq domain access-list 102 permit udp host 172.25.1.10 any eq domain access-list 103 permit tcp 172.25.5.0 255.255.255.0 any eq www access-list 104 permit udp host 172.25.1.10 any eq www access-list 105 permit udp 172.25.5.0 255.255.255.0 any eq domain access-list DMZ_acl permit tcp host 192.168.50.2 any eq smtp access-list DMZ_acl permit tcp host 192.168.50.2 any eq domain access-list DMZ_acl permit tcp any host 192.168.50.2 eq smtp pager lines 24 logging on logging console notifications logging buffered debugging logging trap debugging logging device-id hostname logging host inside 172.25.1.12 icmp permit 172.25.0.0 255.255.0.0 inside icmp permit any DMZ mtu outside 1500 mtu inside 1500 mtu DMZ 1500 mtu DMZ1 1500 mtu DMZ_pr 1500 mtu intf5 1500 ip address outside 217.114.33.79 255.255.255.224 ip address inside 172.25.1.1 255.255.240.0 ip address DMZ 192.168.50.1 255.255.255.0 no ip address DMZ1 ip address DMZ_pr 192.168.51.1 255.255.255.0 no ip address intf5 ip audit info action alarm ip audit attack action alarm no failover failover timeout 0:00:00 failover poll 15 no failover ip address outside no failover ip address inside no failover ip address DMZ no failover ip address DMZ1 no failover ip address DMZ_pr no failover ip address intf5 pdm location 172.25.0.0 255.255.240.0 inside pdm history enable arp timeout 14400 global (outside) 1 interface nat (inside) 0 access-list 100 nat (inside) 1 access-list 102 outside 0 0 nat (DMZ) 1 192.168.50.0 255.255.255.0 0 0 nat (DMZ_pr) 1 192.168.51.0 255.255.255.0 0 0 static (DMZ,outside) tcp 217.114.33.79 smtp 192.168.50.2 smtp netmask 255.255.255.255 0 0 access-group 102 in interface outside route outside 0.0.0.0 0.0.0.0 217.114.33.65 1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00 timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00 timeout uauth 0:05:00 absolute aaa-server TACACS+ protocol tacacs+ aaa-server TACACS+ max-failed-attempts 3 aaa-server TACACS+ deadtime 10 aaa-server RADIUS protocol radius aaa-server RADIUS max-failed-attempts 3 aaa-server RADIUS deadtime 10 aaa-server LOCAL protocol local aaa authentication telnet console LOCAL aaa authentication enable console LOCAL aaa authorization command LOCAL no snmp-server location no snmp-server contact snmp-server community public no snmp-server enable traps floodguard enable sysopt connection permit-ipsec crypto ipsec transform-set ocv-main esp-3des esp-sha-hmac crypto map ocv 10 ipsec-isakmp crypto map ocv 10 match address 100 crypto map ocv 10 set peer 217.72.145.186 crypto map ocv 10 set transform-set ocv-main crypto map ocv interface outside isakmp enable outside isakmp key ******** address 217.72.145.186 netmask 255.255.255.255 isakmp identity address isakmp policy 20 authentication pre-share isakmp policy 20 encryption 3des isakmp policy 20 hash sha isakmp policy 20 group 1 isakmp policy 20 lifetime 86400 telnet timeout 5 ssh 212.45.3.160 255.255.255.248 outside ssh 172.25.0.0 255.255.0.0 inside ssh timeout 60 console timeout 0 username admin password Bd5qFFFIkcr503pw encrypted privilege 15 username secoff password I2s1vM81nlYAR8fp encrypted privilege 9 privilege configure level 1 command logout privilege configure level 1 mode enable command enable privilege configure level 1 command disable terminal width 80 Cryptochecksum:5c7413196a41a069088cd87b436b7959 : end Тем не менее после clear isakmp sa и clear ipsec sa при установке соединения по прежнему генерятся сообщения вида IPSEC(cipher_ipsec_request): decap failed for 172.83.30.249 -> 211.37.239.103 IPSEC(bv_esp_post_decap): authentication signature does not match IPSEC(cipher_ipsec_request): decap failed for 62.222.209.185 -> 50.54.78.186 IPSEC(bv_esp_post_decap): authentication signature does not match что смущает больше всего, так как идет так называемый их флудинг. Адреса причем абсолютно непонятные, рандом, что называется. Может быть, есть какие-нибудь ещё мысли? Спасибо.

Ваше сообщение
Имя*:
EMail:	Для отправки новых сообщений в текущей нити на email укажите знак ! перед адресом, например, !user@host.ru (!! - не показывать email). Более тонкая настройка отправки ответов производится в профиле зарегистрированного участника форума.
Заголовок*:
Сообщение*:	> Добрый день! > Спасибо за отклик! > Да, конфиги всех Пиксов приведены без изменения, использовал sh run и далее > просто копировал и вставлял сюда. Если я вас правильно понял: я > сделал для начала на 515-м object-group network RemoteOffices и задал сеть, > потом то же самое для object-group network MainOffice, далее создал ACL: > access-list 100 permit ip object-group MainOffice object-group RemoteOffices. Теперь > конфиг 515-го Пикса выглядит так: > : Saved > : > PIX Version 6.3(4) > interface ethernet0 auto > interface ethernet1 100full > interface ethernet2 auto > interface ethernet3 100full > interface ethernet4 auto > interface ethernet5 auto > nameif ethernet0 outside security0 > nameif ethernet1 inside security100 > nameif ethernet2 DMZ security50 > nameif ethernet3 DMZ1 security50 > nameif ethernet4 DMZ_pr security50 > nameif ethernet5 intf5 security10 > enable password qZMF4yz9mcSUGIpE encrypted > passwd qZMF4yz9mcSUGIpE encrypted > hostname avppix > domain-name ocv.ru > fixup protocol dns maximum-length 512 > fixup protocol ftp 21 > fixup protocol h323 h225 1720 > fixup protocol h323 ras 1718-1719 > fixup protocol http 80 > fixup protocol rsh 514 > fixup protocol rtsp 554 > fixup protocol sip 5060 > fixup protocol sip udp 5060 > fixup protocol skinny 2000 > fixup protocol smtp 25 > fixup protocol sqlnet 1521 > fixup protocol tftp 69 > names > object-group network RemoteOffices > network-object 172.25.0.0 255.255.240.0 > object-group network MainOffice > network-object 172.30.0.0 255.255.240.0 > network-object 172.30.128.0 255.255.240.0 > access-list 100 permit ip 172.30.0.0 255.255.0.0 172.25.0.0 255.255.0.0 > access-list 100 permit ip 172.25.0.0 255.255.0.0 172.30.0.0 255.255.0.0 > access-list 100 permit ip object-group MainOffice object-group RemoteOffices > access-list DMZ_pr_acl permit tcp host 192.168.51.4 any eq www > access-list DMZ_pr_acl permit tcp host 192.168.51.4 any eq domain > access-list 102 permit udp host 172.25.1.12 any eq domain > access-list 102 permit udp host 172.25.1.10 any eq domain > access-list 103 permit tcp 172.25.5.0 255.255.255.0 any eq www > access-list 104 permit udp host 172.25.1.10 any eq www > access-list 105 permit udp 172.25.5.0 255.255.255.0 any eq domain > access-list DMZ_acl permit tcp host 192.168.50.2 any eq smtp > access-list DMZ_acl permit tcp host 192.168.50.2 any eq domain > access-list DMZ_acl permit tcp any host 192.168.50.2 eq smtp > pager lines 24 > logging on > logging console notifications > logging buffered debugging > logging trap debugging > logging device-id hostname > logging host inside 172.25.1.12 > icmp permit 172.25.0.0 255.255.0.0 inside > icmp permit any DMZ > mtu outside 1500 > mtu inside 1500 > mtu DMZ 1500 > mtu DMZ1 1500 > mtu DMZ_pr 1500 > mtu intf5 1500 > ip address outside 217.114.33.79 255.255.255.224 > ip address inside 172.25.1.1 255.255.240.0 > ip address DMZ 192.168.50.1 255.255.255.0 > no ip address DMZ1 > ip address DMZ_pr 192.168.51.1 255.255.255.0 > no ip address intf5 > ip audit info action alarm > ip audit attack action alarm > no failover > failover timeout 0:00:00 > failover poll 15 > no failover ip address outside > no failover ip address inside > no failover ip address DMZ > no failover ip address DMZ1 > no failover ip address DMZ_pr > no failover ip address intf5 > pdm location 172.25.0.0 255.255.240.0 inside > pdm history enable > arp timeout 14400 > global (outside) 1 interface > nat (inside) 0 access-list 100 > nat (inside) 1 access-list 102 outside 0 0 > nat (DMZ) 1 192.168.50.0 255.255.255.0 0 0 > nat (DMZ_pr) 1 192.168.51.0 255.255.255.0 0 0 > static (DMZ,outside) tcp 217.114.33.79 smtp 192.168.50.2 smtp netmask 255.255.255.255 > 0 0 > access-group 102 in interface outside > route outside 0.0.0.0 0.0.0.0 217.114.33.65 1 > timeout xlate 3:00:00 > timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00 > timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00 > timeout uauth 0:05:00 absolute > aaa-server TACACS+ protocol tacacs+ > aaa-server TACACS+ max-failed-attempts 3 > aaa-server TACACS+ deadtime 10 > aaa-server RADIUS protocol radius > aaa-server RADIUS max-failed-attempts 3 > aaa-server RADIUS deadtime 10 > aaa-server LOCAL protocol local > aaa authentication telnet console LOCAL > aaa authentication enable console LOCAL > aaa authorization command LOCAL > no snmp-server location > no snmp-server contact > snmp-server community public > no snmp-server enable traps > floodguard enable > sysopt connection permit-ipsec > crypto ipsec transform-set ocv-main esp-3des esp-sha-hmac > crypto map ocv 10 ipsec-isakmp > crypto map ocv 10 match address 100 > crypto map ocv 10 set peer 217.72.145.186 > crypto map ocv 10 set transform-set ocv-main > crypto map ocv interface outside > isakmp enable outside > isakmp key ******** address 217.72.145.186 netmask 255.255.255.255 > isakmp identity address > isakmp policy 20 authentication pre-share > isakmp policy 20 encryption 3des > isakmp policy 20 hash sha > isakmp policy 20 group 1 > isakmp policy 20 lifetime 86400 > telnet timeout 5 > ssh 212.45.3.160 255.255.255.248 outside > ssh 172.25.0.0 255.255.0.0 inside > ssh timeout 60 > console timeout 0 > username admin password Bd5qFFFIkcr503pw encrypted privilege 15 > username secoff password I2s1vM81nlYAR8fp encrypted privilege 9 > privilege configure level 1 command logout > privilege configure level 1 mode enable command enable > privilege configure level 1 command disable > terminal width 80 > Cryptochecksum:5c7413196a41a069088cd87b436b7959 > : end > Тем не менее после clear isakmp sa и clear ipsec sa при > установке соединения по прежнему генерятся сообщения вида > IPSEC(cipher_ipsec_request): decap failed for 172.83.30.249 -> 211.37.239.103 > IPSEC(bv_esp_post_decap): authentication signature does not match > IPSEC(cipher_ipsec_request): decap failed for 62.222.209.185 -> 50.54.78.186 > IPSEC(bv_esp_post_decap): authentication signature does not match > что смущает больше всего, так как идет так называемый их флудинг. Адреса > причем абсолютно непонятные, рандом, что называется. > Может быть, есть какие-нибудь ещё мысли? > Спасибо.
	Введите код, изображенный на картинке: