VPN mit Cisco - Router (Virtual Private Network)

VPN mit Cisco - IPSec (Verschlüsselung) und Tunnelmodus (Transport)

Einleitung

Cisco-Router-Beispiel und Aufbau (Skizze)

Wie werden verschlüsselte Pakete ausgetauscht?

Welche Hard- und Software wurde im Beispiel benutzt?

Einrichtung der Tunnelverbindung

=> Test der Tunnelverbindung mit und ohne aufgebauten Tunnel

Konfiguration der Cisco - Router mit Tunnel und IPSec (AES 256 Bit - Verschlüsselung)

=> Verbindungsanfrage / Tunnelaufbau von Router_D nach Router_A und debuggen im Router_A

Test: IPSec - ESP (Observer-Bild)

Test: IPSec - SA Austausch (Observer - Bild)

MTU - Größe und Einfluss auf eine Verbindung

Einleitung:

Um Kosten zu sparen werden meist Gateways zur Verschlüsselung der Daten eingesetzt. Das hier beschriebene Beispiel dient des Überblicks und der Konfiguration von Cisco-Routern. Es wird der Tunnelmodus (GRE) zwischen mehreren Netzen und dessen Verschlüsselung (IPSec) der zu transportierenden Daten aufgezeigt. Auf die Befehle selbst, Optimierungen der einzelnen Router und deren Absicherung (z.B. Paketfirewall) wird nicht eingegangen. Router die Ver- und Entschlüsseln werden als Peer-Encrypting-Router (Peer = gleichberechtigter Gegenüber) bezeichnet.

Cisco Befehle werden grün dargestellt.

Cisco-Router-Beispiel:

Im folgenden Beispiel soll eine gesicherte Kommunikation in einem privaten Netz erfolgen.

Zu den Netzen 10.10.10.0 / 24 und 10.19.13.0 / 24 soll eine starke Gateway-Verschlüsselung aufgebaut werden. Zu den Netzen 10.19.240.0 / 24 und 10.19.241.0 / 24 brauch keine Verschlüsselung der Daten stattfinden.

Aufbau Beispiel (Skizze):

...Beispiel eines VPNs mit Cisco Router...

Wie werden verschlüsselte Pakete ausgetauscht?

Auf die verwendeten Protokolle (GRE, ISAKMP u. IPSec) wird hier nicht eingegangen, bitte seht dazu in unserem Inhalt auf www.datahelp.de nach.

Verschlüsselte Pakete können nur ausgetauscht werden, wenn vorher eine verschlüsselte Sitzung aufgebaut wurde. Wenn die Sitzung abgelaufen ist (nach einer bestimmten Zeit oder nach einer Übertragungskapazitätsgröße), muss eine neue Sitzung eingerichtet werden, bevor wieder verschlüsselter Verkehr stattfinden kann.

Befehlsbeispiel:

Router_A# show crypto ipsec security-association

Security association lifetime: 4608000 kilobytes/3600 seconds

Welche Hard- und Software wurde im Beispiel benutzt?

Router_A# show version

Cisco Internetwork Operating System Software

IOS (tm) C1700 Software (C1700-K9SY7-M), Version 12.2(13)ZF, EARLY DEPLOYMENT RELEASE SOFTWARE (fc1)

Synched to technology version 12.2(13.1u)T

TAC Support: http://www.cisco.com/tac

Compiled Thu 06-Mar-03 04:34 by ealyon

Image text-base: 0x80008120, data-base: 0x80FD2950

ROM: System Bootstrap, Version 12.2(7r)XM1, RELEASE SOFTWARE (fc1)

ROM: C1700 Software (C1700-K9SY7-M), Version 12.2(13)ZF, EARLY DEPLOYMENT RELEASE SOFTWARE (fc1)

Router_A uptime is 2 hours, 25 minutes

System returned to ROM by power-on

System image file is "flash:c1700-k9sy7-mz.122-13.ZF.bin"

cisco 1721 (MPC860P) processor (revision 0x100) with 43903K/5249K bytes of memory.

Processor board ID FOC072209CV (4167091738), with hardware revision 0000

MPC860P processor: part number 5, mask 2

Bridging software.

X.25 software, Version 3.0.0.

1 FastEthernet/IEEE 802.3 interface(s)

1 Serial(sync/async) network interface(s)

32K bytes of non-volatile configuration memory.

16384K bytes of processor board System flash (Read/Write)

Configuration register is 0x2102

Router_A#

Einrichtung der Tunnelverbindung

Was eine Tunnelverbindung ist bzw. wie diese mit Cisco – Routern eingerichtet wird haben wir schon in einem gesonderten Beitrag beschrieben. Die Darstellung hier ist nur als Zusammenfassung zu betrachten bzw. als erster Schritt bei der Programmierung mit IPSec zu verstehen. Der Testablauf im Tunnelmodus wird aber nochmals mit Beispielen erläutert und aufgezeigt.

Test der Tunnel-Verbindung:

Trace wenn nur eine Default-Route gesetzt ist (ohne Tunnel):

=> ip route 10.0.0.0 255.0.0.0 10.1.1.2

Router_A# trace 10.19.13.105

Type escape sequence to abort.

Tracing the route to 10.19.13.105

1 10.1.1.2 16 msec 12 msec 12 msec

2 10.2.2.1 16 msec 16 msec 16 msec

3 *

10.19.13.105 16 msec 16 msec

Router_A#

Trace wenn eine dedizierte Route über das Tunnel-Interface gesetzt ist:

=> ip route 10.19.13.0 255.255.255.0 Tunnel0

Router_A# trace 10.19.13.105

Type escape sequence to abort.

Tracing the route to 10.19.13.105

1 192.168.10.2 20 msec 16 msec 20 msec

2 10.19.13.105 16 msec 16 msec 16 msec

Router_A#

Konfiguration der Cisco - Router

Wie oben schon beschrieben wird nicht auf die einzelnen Befehle und ihre Bedeutung eingegangen. Hier wird eine Verschlüsselung von 256 Bit mit Pre-Share-Keys eingestellt.

Konfiguration Router_A:

Router_A#sh ru Building configuration... Current configuration : 1910 bytes ! version 12.2 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname Router_A ! enable secret 5 ... ! ip subnet-zero no ip source-route ! ! no ip domain lookup ! ! ! ! ! crypto isakmp policy 10 encr aes 256 hash md5 authentication pre-share group 5 crypto isakmp key cisco address 10.19.135.3 crypto isakmp key cisco address 10.19.135.2 ! ! crypto ipsec transform-set TUNNEL ah-md5-hmac esp-aes 256 esp-md5-hmac ! crypto map tunnel local-address Loopback0 crypto map tunnel 1 ipsec-isakmp description *** Crypto_Map zum Router_B *** set peer 10.19.135.2 set transform-set TUNNEL match address 101 crypto map tunnel 2 ipsec-isakmp description *** Crypto_Map zum Router_D *** set peer 10.19.135.3 set transform-set TUNNEL match address 102 ! ! ! ! interface Loopback0 ip address 10.19.135.1 255.255.255.255 ! interface Tunnel0 description *** Verbindung zum Router_B *** ip address 192.168.10.1 255.255.255.252 ip mtu 1476 tunnel source Loopback0 tunnel destination 10.19.135.2 crypto map tunnel ! interface Tunnel1 description *** Verbindung zum Router_D *** ip address 192.168.10.6 255.255.255.252 ip mtu 1476 tunnel source Loopback0 tunnel destination 10.19.135.3 crypto map tunnel ! interface FastEthernet0 ip address 10.19.131.157 255.255.255.0 speed auto no cdp enable ! interface Serial0 ip address 10.1.1.1 255.255.255.252 fair-queue no cdp enable crypto map tunnel ! ip classless ip route 10.0.0.0 255.0.0.0 10.1.1.2 ip route 10.10.10.0 255.255.255.0 Tunnel1 ip route 10.19.13.0 255.255.255.0 Tunnel0 no ip http server no ip http secure-server ! ! access-list 101 permit gre host 10.19.135.1 host 10.19.135.2 access-list 102 permit gre host 10.19.135.1 host 10.19.135.3 no cdp run ! alias exec u unde all ! line con 0 line aux 0 line vty 0 4 password ..... login ! ! end Router_A#

Konfiguration Router_B:

Router_B#sh ru Building configuration... Current configuration : 1368 bytes ! version 12.2 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname Router_B ! enable secret 5 ... ! ip subnet-zero no ip source-route ! ! no ip domain lookup ! ! ! ! ! crypto isakmp policy 10 encr aes 256 hash md5 authentication pre-share group 5 crypto isakmp key cisco address 10.19.135.1 ! ! crypto ipsec transform-set TUNNEL ah-md5-hmac esp-aes 256 esp-md5-hmac ! crypto map tunnel local-address Loopback0 crypto map tunnel 1 ipsec-isakmp description *** Crypto_Map zum Router_A *** set peer 10.19.135.1 set transform-set TUNNEL match address 101 ! ! ! ! interface Loopback0 ip address 10.19.135.2 255.255.255.255 ! interface Tunnel0 description *** Verbindung zum Router_A *** ip address 192.168.10.2 255.255.255.252 ip mtu 1476 tunnel source Loopback0 tunnel destination 10.19.135.1 crypto map tunnel ! interface FastEthernet0 ip address 10.19.13.254 255.255.255.0 speed auto ! interface Serial0 ip address 10.2.2.1 255.255.255.252 crypto map tunnel ! ip classless ip route 10.0.0.0 255.0.0.0 10.2.2.2 ip route 10.19.131.0 255.255.255.0 Tunnel0 no ip http server no ip http secure-server ! ! access-list 101 permit gre host 10.19.135.2 host 10.19.135.1 ! ! line con 0 line aux 0 line vty 0 4 password .... login ! no scheduler allocate ! end Router_B#

Konfiguration Router_C (Backbone-Router):

Router_C#sh ru Building configuration... Current configuration: ! version 12.0 service timestamps debug uptime service timestamps log uptime no service password-encryption ! hostname Router_C ! enable secret 5 ... ! ip subnet-zero no ip finger no ip domain-lookup ! ! ! ! interface Ethernet0/0 ip address 10.19.240.1 255.255.255.0 no ip directed-broadcast ! interface Ethernet0/1 ip address 10.19.241.1 255.255.255.0 no ip directed-broadcast ! ! interface Serial2/0 description *** Verbindung zum Router_A *** ip address 10.1.1.2 255.255.255.252 no ip directed-broadcast ! interface Serial2/1 description *** Verbindung zum Router_B *** ip address 10.2.2.2 255.255.255.252 no ip directed-broadcast ! interface Serial2/2 description *** Verbindung zum Router_D *** ip address 10.3.3.2 255.255.255.252 no ip directed-broadcast ! ! ip classless ip route 10.10.10.0 255.255.255.0 10.3.3.1 ip route 10.19.13.0 255.255.255.0 10.2.2.1 ip route 10.19.131.0 255.255.255.0 10.1.1.1 ip route 10.19.135.1 255.255.255.255 10.1.1.1 ip route 10.19.135.2 255.255.255.255 10.2.2.1 ip route 10.19.135.3 255.255.255.255 10.3.3.1 no ip http server ! alias exec u unde all ! line con 0 transport input none line aux 0 line vty 0 4 password ... login ! end Router_C#

Konfiguration Router_D:

Router_D#sh ru Building configuration... Current configuration : 1346 bytes ! version 12.2 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname Router_D ! enable secret 5 ... ! ip subnet-zero no ip source-route ! ! no ip domain lookup ! ! ! ! ! crypto isakmp policy 10 encr aes 256 hash md5 authentication pre-share group 5 crypto isakmp key cisco address 10.19.135.1 ! ! crypto ipsec transform-set TUNNEL ah-md5-hmac esp-aes 256 esp-md5-hmac ! crypto map tunnel local-address Loopback0 crypto map tunnel 1 ipsec-isakmp description *** Crypto_Map zum Router_A *** set peer 10.19.135.1 set transform-set TUNNEL match address 101 ! ! ! ! interface Loopback0 ip address 10.19.135.3 255.255.255.255 ! interface Tunnel0 description *** Verbindung zum Router_A *** ip address 192.168.10.5 255.255.255.252 ip mtu 1476 tunnel source Loopback0 tunnel destination 10.19.135.1 crypto map tunnel ! interface FastEthernet0 ip address 10.10.10.254 255.255.255.0 speed auto ! interface Serial0 ip address 10.3.3.1 255.255.255.252 crypto map tunnel ! ip classless ip route 10.0.0.0 255.0.0.0 10.3.3.2 ip route 10.19.131.0 255.255.255.0 Tunnel0 no ip http server no ip http secure-server ! ! access-list 101 permit gre host 10.19.135.3 host 10.19.135.1 ! ! line con 0 line aux 0 line vty 0 4 password ... login ! ! end Router_D#

Verbindungsanfrage / Tunnelaufbau von Router_D nach Router_A und debuggen im Router_A

Router_A# debug crypto ipsec

Crypto IPSEC debugging is on

Router_A# debug crypto isakmp

Crypto ISAKMP debugging is on

Router_A# debug crypto engine

Crypto Engine debugging is on

Router_A#

*Mar 1 00:26:00.367: ISAKMP (0:1): received packet from 10.19.135.3 dport 500 sport 500 Global (I) QM_IDLE

*Mar 1 00:26:00.367: ISAKMP: set new node -1186279550 to QM_IDLE

*Mar 1 00:26:00.371: CryptoEngine0: generate hmac context for conn id 1

*Mar 1 00:26:00.371: ISAKMP (0:1): processing HASH payload. message ID = -1186279550

*Mar 1 00:26:00.371: ISAKMP (0:1): processing SA payload. message ID = -1186279550

*Mar 1 00:26:00.371: ISAKMP (0:1): Checking IPSec proposal 1

*Mar 1 00:26:00.371: ISAKMP: transform 1, ESP_AES

*Mar 1 00:26:00.371: ISAKMP: attributes in transform:

*Mar 1 00:26:00.371: ISAKMP: encaps is 1

*Mar 1 00:26:00.371: ISAKMP: SA life type in seconds

*Mar 1 00:26:00.371: ISAKMP: SA life duration (basic) of 3600

*Mar 1 00:26:00.371: ISAKMP: SA life type in kilobytes

*Mar 1 00:26:00.371: ISAKMP: SA life duration (VPI) of 0x0 0x46 0x50 0x0

*Mar 1 00:26:00.371: ISAKMP: authenticator is HMAC-MD5

*Mar 1 00:26:00.371: ISAKMP: key length is 256

*Mar 1 00:26:00.375: CryptoEngine0: validate proposal

*Mar 1 00:26:00.375: ISAKMP (0:1): atts are acceptable.

*Mar 1 00:26:00.375: IPSEC(validate_proposal_request): proposal part #1,

(key eng. msg.) INBOUND local= 10.19.135.1, remote= 10.19.135.3,

local_proxy= 10.19.135.1/255.255.255.255/47/0 (type=1),

remote_proxy= 10.19.135.3/255.255.255.255/47/0 (type=1),

protocol= ESP, transform= esp-aes 256 esp-md5-hmac ,

lifedur= 0s and 0kb,

spi= 0x0(0), conn_id= 0, keysize= 256, flags= 0x2

*Mar 1 00:26:00.375: CryptoEngine0: validate proposal request

*Mar 1 00:26:00.375: IPSEC(kei_proxy): head = tunnel, map->ivrf = , kei->ivrf =

*Mar 1 00:26:00.379: ISAKMP (0:1): processing NONCE payload. message ID = -1186279550

*Mar 1 00:26:00.379: ISAKMP (0:1): processing ID payload. message ID = -1186279550

*Mar 1 00:26:00.379: ISAKMP (0:1): asking for 1 spis from ipsec

*Mar 1 00:26:00.379: ISAKMP (0:1): Node -1186279550, Input = IKE_MESG_FROM_PEER, IKE_QM_EXCH

*Mar 1 00:26:00.379: ISAKMP (0:1): Old State = IKE_QM_READY New State = IKE_QM_SPI_STARVE

*Mar 1 00:26:00.379: IPSEC(key_engine): got a queue event...

*Mar 1 00:26:00.379: IPSEC(spi_response): getting spi 2716071845 for SA

from 10.19.135.1 to 10.19.135.3 for prot 3

*Mar 1 00:26:00.383: ISAKMP: received ke message (2/1)

*Mar 1 00:26:00.631: CryptoEngine0: generate hmac context for conn id 1

*Mar 1 00:26:00.631: ISAKMP (0:1): sending packet to 10.19.135.3 my_port 500 peer_port 500 (I) QM_IDLE

*Mar 1 00:26:00.631: ISAKMP (0:1): Node -1186279550, Input = IKE_MESG_FROM_IPSEC, IKE_SPI_REPLY

*Mar 1 00:26:00.631: ISAKMP (0:1): Old State = IKE_QM_SPI_STARVE New State = IKE_QM_R_QM2

*Mar 1 00:26:00.683: ISAKMP (0:1): received packet from 10.19.135.3 dport 500 sport 500 Global (I) QM_IDLE

*Mar 1 00:26:00.687: CryptoEngine0: generate hmac context for conn id 1

*Mar 1 00:26:00.687: CryptoEngine0: ipsec allocate flow

*Mar 1 00:26:00.691: ISAKMP (0:1): Creating IPSec SAs

*Mar 1 00:26:00.691: inbound SA from 10.19.135.3 to 10.19.135.1 (f/i) 0/ 0

(proxy 10.19.135.3 to 10.19.135.1)

*Mar 1 00:26:00.691: has spi 0xA1E3F7A5 and conn_id 2000 and flags 2

*Mar 1 00:26:00.691: lifetime of 3600 seconds

*Mar 1 00:26:00.691: lifetime of 4608000 kilobytes

*Mar 1 00:26:00.691: has client flags 0x0

*Mar 1 00:26:00.691: outbound SA from 10.19.135.1 to 10.19.135.3 (f/i) 0/ 0

(proxy 10.19.135.1 to 10.19.135.3 )

*Mar 1 00:26:00.695: has spi -1743711033 and conn_id 2001 and flags A

*Mar 1 00:26:00.695: lifetime of 3600 seconds

*Mar 1 00:26:00.695: lifetime of 4608000 kilobytes

*Mar 1 00:26:00.695: has client flags 0x0

*Mar 1 00:26:00.695: ISAKMP (0:1): deleting node -1186279550 error FALSE reason

"quick mode done (await)"

*Mar 1 00:26:00.695: ISAKMP (0:1): Node -1186279550, Input = IKE_MESG_FROM_PEER, IKE_QM_EXCH

*Mar 1 00:26:00.695: ISAKMP (0:1): Old State = IKE_QM_R_QM2 New State = IKE_QM_PHASE2_COMPLETE

*Mar 1 00:26:00.695: IPSEC(key_engine): got a queue event...

*Mar 1 00:26:00.695: IPSEC(initialize_sas): ,

(key eng. msg.) INBOUND local= 10.19.135.1, remote= 10.19.135.3,

local_proxy= 10.19.135.1/0.0.0.0/47/0 (type=1),

remote_proxy= 10.19.135.3/0.0.0.0/47/0 (type=1),

protocol= ESP, transform= esp-aes 256 esp-md5-hmac ,

lifedur= 3600s and 4608000kb,

spi= 0xA1E3F7A5(2716071845), conn_id= 2000, keysize= 256, flags= 0x2

*Mar 1 00:26:00.699: IPSEC(initialize_sas): ,

(key eng. msg.) OUTBOUND local= 10.19.135.1, remote= 10.19.135.3,

local_proxy= 10.19.135.1/0.0.0.0/47/0 (type=1),

remote_proxy= 10.19.135.3/0.0.0.0/47/0 (type=1),

protocol= ESP, transform= esp-aes 256 esp-md5-hmac ,

lifedur= 3600s and 4608000kb,

spi= 0x981114C7(2551256263), conn_id= 2001, keysize= 256, flags= 0xA

*Mar 1 00:26:00.699: IPSEC(kei_proxy): head = tunnel, map->ivrf = , kei->ivrf =

*Mar 1 00:26:00.699: IPSEC(add mtree): src 10.19.135.1, dest 10.19.135.3, dest_port 0

*Mar 1 00:26:00.699: IPSEC(create_sa): sa created,

(sa) sa_dest= 10.19.135.1, sa_prot= 50,

sa_spi= 0xA1E3F7A5(2716071845),

sa_trans= esp-aes 256 esp-md5-hmac , sa_conn_id= 2000

*Mar 1 00:26:00.703: IPSEC(create_sa): sa created,

(sa) sa_dest= 10.19.135.3, sa_prot= 50,

sa_spi= 0x981114C7(2551256263),

sa_trans= esp-aes 256 esp-md5-hmac , sa_conn_id= 2001

Router_A# debug crypto engine

Crypto Engine debugging is on

Router_A#

*Mar 1 00:35:45.495: CryptoEngine0: generate hmac context for conn id 1

*Mar 1 00:35:45.495: CryptoEngine0: validate proposal

*Mar 1 00:35:45.495: CryptoEngine0: validate proposal request

*Mar 1 00:35:45.751: CryptoEngine0: generate hmac context for conn id 1

*Mar 1 00:35:45.803: CryptoEngine0: generate hmac context for conn id 1

*Mar 1 00:35:45.803: CryptoEngine0: ipsec allocate flow

*Mar 1 00:35:45.807: CryptoEngine0: ipsec allocate flow

Router_A#

Router_A# debug crypto ipsec

Crypto IPSEC debugging is on

Router_A#

*Mar 1 00:36:57.703: IPSEC(validate_proposal_request): proposal part #1,

(key eng. msg.) INBOUND local= 10.19.135.1, remote= 10.19.135.3,

local_proxy= 10.19.135.1/255.255.255.255/47/0 (type=1),

remote_proxy= 10.19.135.3/255.255.255.255/47/0 (type=1),

protocol= ESP, transform= esp-aes 256 esp-md5-hmac ,

lifedur= 0s and 0kb,

spi= 0x0(0), conn_id= 0, keysize= 256, flags= 0x2

*Mar 1 00:36:57.703: IPSEC(kei_proxy): head = tunnel, map->ivrf = , kei->ivrf =

*Mar 1 00:36:57.707: IPSEC(key_engine): got a queue event...

*Mar 1 00:36:57.707: IPSEC(spi_response): getting spi 2545082454 for SA

from 10.19.135.1 to 10.19.135.3 for prot 3

*Mar 1 00:36:58.015: IPSEC(key_engine): got a queue event...

*Mar 1 00:36:58.015: IPSEC(initialize_sas): ,

(key eng. msg.) INBOUND local= 10.19.135.1, remote= 10.19.135.3,

local_proxy= 10.19.135.1/0.0.0.0/47/0 (type=1),

remote_proxy= 10.19.135.3/0.0.0.0/47/0 (type=1),

protocol= ESP, transform= esp-aes 256 esp-md5-hmac ,

lifedur= 3600s and 4608000kb,

spi= 0x97B2E056(2545082454), conn_id= 2000, keysize= 256, flags= 0x2

*Mar 1 00:36:58.019: IPSEC(initialize_sas): ,

(key eng. msg.) OUTBOUND local= 10.19.135.1, remote= 10.19.135.3,

local_proxy= 10.19.135.1/0.0.0.0/47/0 (type=1),

remote_proxy= 10.19.135.3/0.0.0.0/47/0 (type=1),

protocol= ESP, transform= esp-aes 256 esp-md5-hmac ,

lifedur= 3600s and 4608000kb,

spi= 0x3F31449B(1060193435), conn_id= 2001, keysize= 256, flags= 0xA

*Mar 1 00:36:58.019: IPSEC(kei_proxy): head = tunnel, map->ivrf = , kei->ivrf =

*Mar 1 00:36:58.019: IPSEC(add mtree): src 10.19.135.1, dest 10.19.135.3, dest_port 0

*Mar 1 00:36:58.019: IPSEC(create_sa): sa created,

(sa) sa_dest= 10.19.135.1, sa_prot= 50,

sa_spi= 0x97B2E056(2545082454),

sa_trans= esp-aes 256 esp-md5-hmac , sa_conn_id= 2000

*Mar 1 00:36:58.023: IPSEC(create_sa): sa created,

(sa) sa_dest= 10.19.135.3, sa_prot= 50,

sa_spi= 0x3F31449B(1060193435),

sa_trans= esp-aes 256 esp-md5-hmac , sa_conn_id= 2001

Router_A#

Router_A# debug crypto isakmp

Crypto ISAKMP debugging is on

Router_A#

*Mar 1 00:38:25.779: ISAKMP (0:1): received packet from 10.19.135.3 dport 500 sport 500 Global (I) QM_IDLE

*Mar 1 00:38:25.779: ISAKMP: set new node -685084535 to QM_IDLE

*Mar 1 00:38:25.783: ISAKMP (0:1): processing HASH payload. message ID = -685084535

*Mar 1 00:38:25.783: ISAKMP (0:1): processing SA payload. message ID = -685084535

*Mar 1 00:38:25.783: ISAKMP (0:1): Checking IPSec proposal 1

*Mar 1 00:38:25.783: ISAKMP: transform 1, ESP_AES

*Mar 1 00:38:25.783: ISAKMP: attributes in transform:

*Mar 1 00:38:25.783: ISAKMP: encaps is 1

*Mar 1 00:38:25.783: ISAKMP: SA life type in seconds

*Mar 1 00:38:25.783: ISAKMP: SA life duration (basic) of 3600

*Mar 1 00:38:25.787: ISAKMP: SA life type in kilobytes

*Mar 1 00:38:25.787: ISAKMP: SA life duration (VPI) of 0x0 0x46 0x50 0x0

*Mar 1 00:38:25.787: ISAKMP: authenticator is HMAC-MD5

*Mar 1 00:38:25.787: ISAKMP: key length is 256

*Mar 1 00:38:25.787: ISAKMP (0:1): atts are acceptable.

*Mar 1 00:38:25.787: ISAKMP (0:1): processing NONCE payload. message ID = -685084535

*Mar 1 00:38:25.787: ISAKMP (0:1): processing ID payload. message ID = -685084535

*Mar 1 00:38:25.791: ISAKMP (0:1): asking for 1 spis from ipsec

*Mar 1 00:38:25.791: ISAKMP (0:1): Node -685084535, Input = IKE_MESG_FROM_PEER, IKE_QM_EXCH

*Mar 1 00:38:25.791: ISAKMP (0:1): Old State = IKE_QM_READY New State = IKE_QM_SPI_STARVE

*Mar 1 00:38:25.791: ISAKMP: received ke message (2/1)

*Mar 1 00:38:26.043: ISAKMP (0:1): sending packet to 10.19.135.3 my_port 500 peer_port 500 (I) QM_IDLE

*Mar 1 00:38:26.043: ISAKMP (0:1): Node -685084535, Input = IKE_MESG_FROM_IPSEC, IKE_SPI_REPLY

*Mar 1 00:38:26.043: ISAKMP (0:1): Old State = IKE_QM_SPI_STARVE New State = IKE_QM_R_QM2

*Mar 1 00:38:26.095: ISAKMP (0:1): received packet from 10.19.135.3 dport 500 sport 500 Global (I) QM_IDLE

*Mar 1 00:38:26.099: ISAKMP (0:1): Creating IPSec SAs

*Mar 1 00:38:26.099: inbound SA from 10.19.135.3 to 10.19.135.1 (f/i) 0/ 0

(proxy 10.19.135.3 to 10.19.135.1)

*Mar 1 00:38:26.103: has spi 0xFC0448D4 and conn_id 2000 and flags 2

*Mar 1 00:38:26.103: lifetime of 3600 seconds

*Mar 1 00:38:26.103: lifetime of 4608000 kilobytes

*Mar 1 00:38:26.103: has client flags 0x0

*Mar 1 00:38:26.103: outbound SA from 10.19.135.1 to 10.19.135.3 (f/i) 0/ 0

(proxy 10.19.135.1 to 10.19.135.3 )

*Mar 1 00:38:26.103: has spi -1667326370 and conn_id 2001 and flags A

*Mar 1 00:38:26.103: lifetime of 3600 seconds

*Mar 1 00:38:26.103: lifetime of 4608000 kilobytes

*Mar 1 00:38:26.103: has client flags 0x0

*Mar 1 00:38:26.103: ISAKMP (0:1): deleting node -685084535 error FALSE reason

"quick mode done (await)"

*Mar 1 00:38:26.103: ISAKMP (0:1): Node -685084535, Input = IKE_MESG_FROM_PEER, IKE_QM_EXCH

*Mar 1 00:38:26.107: ISAKMP (0:1): Old State = IKE_QM_R_QM2 New State = IKE_QM_PHASE2_COMPLETE

Router_A#

Router_A# debug crypto mib

Crypto IPSec Mgmt Entity debugging is on

Router_A#scmIpSecTunnelCreated (IKE SA:1)

...new ipsidx:7

Router_A#

Router_A# sh crypto engine connect active

ID Interface IP-Address State Algorithm Encrypt Decrypt

1 Serial0 10.1.1.1 set HMAC_MD5+AES_256_C 0 0

2000 Tunnel0 192.168.10.1 set HMAC_MD5 0 69

2001 Tunnel0 192.168.10.1 set HMAC_MD5 69 0

2002 Tunnel0 192.168.10.1 set HMAC_MD5+AES_256_C 0 69

2003 Tunnel0 192.168.10.1 set HMAC_MD5+AES_256_C 69 0

Router_A#

Test: IPSec - ESP (Observer-Bild)

...Beispiel...ISAKMP...

Test: IPSec - SA Austausch (Observer - Bild)

....Beispiel..IPSec...

MTU - Größe und Einfluss auf eine Verbindung

Auf die Bedeutung der MTU (Maximum Transmission Unit) wird gesondert auf www.datahelp.de eingegangen. Es kann unter Umständen sinnvoll sein den Wert zu verkleinern bzw. zu vergrößern (z.B. mtu 1500).

Weitere Informationen unter dem Punkt: Cisco und Netz: LAN+WAN im Inhalt !

Suche nach Literatur (hier klicken und im Suchfeld das Wort CISCO eintragen)!

Unsere Seiten nach weiteren Informationen durchsuchen!

Literatur / Quellennachweis:

Web: www.cisco.com

Verlag Markt & Technik: Cisco IOS 12.0 Network Security

Letzte Bearbeitung: 09 / 2004 - Bitte beachten Sie das Copyright und die Hinweise im Inhalt unter www.datahelp.de

Modifizierung oder Weitergabe an Dritte nur mit Einverständnis des Autors gestattet !