[c-nsp] IPSec between Cisco and D-Link
Justin Shore
justin at justinshore.com
Fri Dec 12 14:33:30 EST 2008
It looks like you have a phase 2 problem. Your IPSec transform-set
isn't matching up with what the D-Link is offering. Try changing the
transform-set to something more useful like this:
crypto ipsec transform-set encraes128md5 esp-aes 128 esp-md5-hmac
It would be better if you used AES256.
crypto ipsec transform-set encraes256md5 esp-aes 256 esp-md5-hmac
These are good fallback transform-sets if need be.
crypto ipsec transform-set encr3dessha esp-3des esp-sha-hmac
crypto ipsec transform-set encr3dessha-gre esp-3des esp-sha-hmac
Don't forget to update your crypto maps with the name of the
transform-set you chose to use. Also, I would not recommend messing
with the lifetime values unless the remote end requires it.
Justin
twisted mac wrote:
> Seems fair enough :)
>
> logs from dlink
>
> 2008-12-11 17:30:21: IkeSnoop: Received IKE packet from
> 82.x.x.x:500 Exchange
> type : Informational ISAKMP Version : 1.0 Flags : E (encryption) Cookies :
> 0x458f51017c4a446 -> 0xa582286a38ab6fb0 Message ID : 0x2f8ad085 Packet
> length : 452 bytes # payloads : 2 Payloads: HASH (Hash) Payload data length
> : 20 bytes N (Notification) Payload data length : 396 bytes Protocol ID :
> ESP Notification : No proposal chosen
>
>
> logs from cisco:
>
> xxx#debug crypto isakmp
> Crypto ISAKMP debugging is on
> xxx#
> 2d23h: ISAKMP (0:134217749): received packet from 217.x.x.x dport 500 sport
> 500 Global (R) QM_IDLE
> 2d23h: ISAKMP: set new node -1473959992 to QM_IDLE
> 2d23h: ISAKMP:(0:21:SW:1): processing HASH payload. message ID = -1473959992
> 2d23h: ISAKMP:(0:21:SW:1): processing SA payload. message ID = -1473959992
> 2d23h: ISAKMP:(0:21:SW:1):Checking IPSec proposal 1
> 2d23h: ISAKMP: transform 1, ESP_AES
> 2d23h: ISAKMP: attributes in transform:
> 2d23h: ISAKMP: key length is 128
> 2d23h: ISAKMP: authenticator is HMAC-MD5
> 2d23h: ISAKMP: SA life type in seconds
> 2d23h: ISAKMP: SA life duration (basic) of 3600
> 2d23h: ISAKMP: encaps is 1 (Tunnel)
> 2d23h: ISAKMP:(0:21:SW:1):atts are acceptable.
> 2d23h: ISAKMP:(0:21:SW:1):Checking IPSec proposal 1
> 2d23h: ISAKMP: transform 2, ESP_AES
> 2d23h: ISAKMP: attributes in transform:
> 2d23h: ISAKMP: key length is 128
> 2d23h: ISAKMP: authenticator is HMAC-SHA
> 2d23h: ISAKMP: SA life type in seconds
> 2d23h: ISAKMP: SA life duration (basic) of 3600
> 2d23h: ISAKMP: encaps is 1 (Tunnel)
> 2d23h: ISAKMP:(0:21:SW:1):atts are acceptable.
> 2d23h: ISAKMP:(0:21:SW:1):Checking IPSec proposal 1
> 2d23h: ISAKMP: transform 3, ESP_3DES
> 2d23h: ISAKMP: attributes in transform:
> 2d23h: ISAKMP: authenticator is HMAC-MD5
> 2d23h: ISAKMP: SA life type in seconds
> 2d23h: ISAKMP: SA life duration (basic) of 3600
> 2d23h: ISAKMP: encaps is 1 (Tunnel)
> 2d23h: ISAKMP:(0:21:SW:1):atts are acceptable.
> 2d23h: ISAKMP:(0:21:SW:1):Checking IPSec proposal 1
> 2d23h: ISAKMP: transform 4, ESP_3DES
> 2d23h: ISAKMP: attributes in transform:
> 2d23h: ISAKMP: authenticator is HMAC-SHA
> 2d23h: ISAKMP: SA life type in seconds
> 2d23h: ISAKMP: SA life duration (basic) of 3600
> 2d23h: ISAKMP: encaps is 1 (Tunnel)
> 2d23h: ISAKMP:(0:21:SW:1):atts are acceptable.
> 2d23h: ISAKMP:(0:21:SW:1):Checking IPSec proposal 1
> 2d23h: ISAKMP: unknown ESP transform!
> 2d23h: ISAKMP: attributes in transform:
> 2d23h: ISAKMP: authenticator is HMAC-MD5
> 2d23h: ISAKMP: SA life type in seconds
> 2d23h: ISAKMP: SA life duration (basic) of 3600
> 2d23h: ISAKMP: encaps is 1 (Tunnel)
> 2d23h: ISAKMP:(0:21:SW:1):atts are acceptable.
> 2d23h: ISAKMP:(0:21:SW:1):Checking IPSec proposal 1
> 2d23h: ISAKMP: unknown ESP transform!
> 2d23h: ISAKMP: attributes in transform:
> 2d23h: ISAKMP: authenticator is HMAC-SHA
> 2d23h: ISAKMP: SA life type in seconds
> 2d23h: ISAKMP: SA life duration (basic) of 3600
> 2d23h: ISAKMP: encaps is 1 (Tunnel)
> 2d23h: ISAKMP:(0:21:SW:1):atts are acceptable.
> 2d23h: ISAKMP:(0:21:SW:1):Checking IPSec proposal 1
> 2d23h: ISAKMP: unknown ESP transform!
> 2d23h: ISAKMP: attributes in transform:
> 2d23h: ISAKMP: key length is 128
> 2d23h: ISAKMP: authenticator is HMAC-MD5
> 2d23h: ISAKMP: SA life type in seconds
> 2d23h: ISAKMP: SA life duration (basic) of 3600
> 2d23h: ISAKMP: encaps is 1 (Tunnel)
> 2d23h: ISAKMP:(0:21:SW:1):atts are acceptable.
> 2d23h: ISAKMP:(0:21:SW:1):Checking IPSec proposal 1
> 2d23h: ISAKMP: unknown ESP transform!
> 2d23h: ISAKMP: attributes in transform:
> 2d23h: ISAKMP: key length is 128
> 2d23h: ISAKMP: authenticator is HMAC-SHA
> 2d23h: ISAKMP: SA life type in seconds
> 2d23h: ISAKMP: SA life duration (basic) of 3600
> 2d23h: ISAKMP: encaps is 1 (Tunnel)
> 2d23h: ISAKMP:(0:21:SW:1):atts are acceptable.
> 2d23h: ISAKMP:(0:21:SW:1):Checking IPSec proposal 1
> 2d23h: ISAKMP: unknown ESP transform!
> 2d23h: ISAKMP: attributes in transform:
> 2d23h: ISAKMP: key length is 128
> 2d23h: ISAKMP: authenticator is HMAC-MD5
> 2d23h: ISAKMP: SA life type in seconds
> 2d23h: ISAKMP: SA life duration (basic) of 3600
> 2d23h: ISAKMP: encaps is 1 (Tunnel)
> 2d23h: ISAKMP:(0:21:SW:1):atts are acceptable.
> 2d23h: ISAKMP:(0:21:SW:1):Checking IPSec proposal 1
> 2d23h: ISAKMP: unknown ESP transform!
> 2d23h: ISAKMP: attributes in transform:
> 2d23h: ISAKMP: key length is 128
> 2d23h: ISAKMP: authenticator is HMAC-SHA
> 2d23h: ISAKMP: SA life type in seconds
> 2d23h: ISAKMP: SA life duration (basic) of 3600
> 2d23h: ISAKMP: encaps is 1 (Tunnel)
> 2d23h: ISAKMP:(0:21:SW:1):atts are acceptable.
> 2d23h: ISAKMP:(0:21:SW:1): IPSec policy invalidated proposal
> 2d23h: ISAKMP:(0:21:SW:1): IPSec policy invalidated proposal
> 2d23h: ISAKMP:(0:21:SW:1): IPSec policy invalidated proposal
> 2d23h: ISAKMP:(0:21:SW:1): IPSec policy invalidated proposal
> 2d23h: ISAKMP:(0:21:SW:1): IPSec policy invalidated proposal
> 2d23h: ISAKMP:(0:21:SW:1): IPSec policy invalidated proposal
> 2d23h: ISAKMP:(0:21:SW:1): IPSec policy invalidated proposal
> 2d23h: ISAKMP:(0:21:SW:1): IPSec policy invalidated proposal
> 2d23h: ISAKMP:(0:21:SW:1): IPSec policy invalidated proposal
> 2d23h: ISAKMP:(0:21:SW:1): IPSec policy invalidated proposal
> 2d23h: ISAKMP:(0:21:SW:1): phase 2 SA policy not acceptable! (local 82.x.x.x
> remote 217.x.x.x)
> 2d23h: ISAKMP: set new node 326922217 to QM_IDLE
> 2d23h: ISAKMP:(0:21:SW:1):Sending NOTIFY PROPOSAL_NOT_CHOSEN protocol 3
> spi 1691668640, message ID = 326922217
> 2d23h: ISAKMP:(0:21:SW:1): sending packet to 217.x.x.x my_port 500 peer_port
> 500 (R) QM_IDLE
> 2d23h: ISAKMP:(0:21:SW:1):purging node 326922217
> 2d23h: ISAKMP:(0:21:SW:1):deleting node -1473959992 error TRUE reason "QM
> rejected"
> 2d23h: ISAKMP (0:134217749): Unknown Input IKE_MESG_FROM_PEER, IKE_QM_EXCH:
> for node -1473959992: state = IKE_QM_READY
> 2d23h: ISAKMP:(0:21:SW:1):Node -1473959992, Input = IKE_MESG_FROM_PEER,
> IKE_QM_EXCH
> 2d23h: ISAKMP:(0:21:SW:1):Old State = IKE_QM_READY New State = IKE_QM_READY
> 2d23h: ISAKMP:(0:22:SW:1):purging node 124919870
>
> cisco config
>
> crypto isakmp policy 1
> encr aes
> hash md5
> authentication pre-share
> group 2
> lifetime 28800
> crypto isakmp key 123456 address 217.x.x.x no-xauth
> crypto isakmp key 123456 address 85.x.x.x no-xauth
> crypto isakmp aggressive-mode disable
> !
> !
> crypto ipsec transform-set VPN esp-aes
> !
> crypto map xxx 10 ipsec-isakmp
> set peer 217.x.x.x
> set transform-set VPN
> match address 111
> crypto map eon 20 ipsec-isakmp
> set peer 85.x.x.x
> set transform-set VPN-EON
> match address 112
> !
> ----//----
>
> xxx#sh crypto map tag xxx
> Crypto Map "xxx" 10 ipsec-isakmp
> Peer = 217.x.x.x
> Extended IP access list 111
> access-list 111 permit ip 192.168.200.0 0.0.0.255 192.168.0.0
> 0.0.0.255
> Current peer: 217.x.x.x
> Security association lifetime: 4608000 kilobytes/3600 seconds
> PFS (Y/N): N
> Transform sets={
> VPN,
> }
> Crypto Map "xxx" 20 ipsec-isakmp
> Peer = 85.x.x.x
> Extended IP access list 112
> access-list 112 permit ip 192.168.200.0 0.0.0.255 192.168.96.0
> 0.0.7.255
> Current peer: 85.x.x.x
> Security association lifetime: 4608000 kilobytes/3600 seconds
> PFS (Y/N): N
> Transform sets={
> VPN,
> }
> Interfaces using crypto map xxx:
> FastEthernet0/1
>
> ---//---
>
> the dlink is a dfl-1600
>
> any ideas? hammer is not possible because the dlink box is on the other side
> of the ocean :)
>
> mac
> 2008/12/12 Mario Spinthiras <spinthiras.mario at gmail.com>
>
>> How about the actual problem so we can help there? Logs , errors?
>>
> _______________________________________________
> cisco-nsp mailing list cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
More information about the cisco-nsp
mailing list