LinuxForum.Fans
Тема

Cisco vpn ipsec allow

Автор: slonokot 1 сообщений 2118 просмотров
18.08.2011 17:47 · отредактировано #185486

Всем привет.
У моей конторы есть партнер. Они предоставляют Cisco VPN к своей сети. Со стороны клиента требуется только логин пароль и программа-клиент. Из дома у меня все нормально работает: клиент с настройками портов в режиме транспорт работает нормально.
В нашей организации есть фаервол на дебиан сквиз. Есть подсеть реальными IP назовем ее DMZ и LAN - локальная сетка за NAT-ом.
У роутера соответственно три адреса и VLAN интерфейса:
extip +extif
lan_ip + lanif
dmz_ip + dmzif

Проблема заключатся в том, что когда я пытаюсь с машины имеющей реальный IP подключиться к VPN-сети соединение обрывается с моей стороны. На фаерволе разрешен весь трафик между сервером-впн и хостом с реальным IP.
Вот лог tcp-dump:

Показать
text

firewall:/etc/ferm# tcpdump host cisco.vpn.server.ip
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
11:39:03.109128 IP cisco.vpn.client.ip.1195 > cisco.vpn.server.ip.36520: Flags [s], seq 16802519, win 65535, length 0
11:39:03.109159 IP cisco.vpn.client.ip.1195 > cisco.vpn.server.ip.36520: Flags [s], seq 16802519, win 65535, length 0
11:39:03.164329 IP cisco.vpn.server.ip.36520 > cisco.vpn.client.ip.1195: Flags [S.], seq 131513246, ack 16802520, win 8192, options [mss 536], length 0
11:39:03.164341 IP cisco.vpn.server.ip.36520 > cisco.vpn.client.ip.1195: Flags [S.], seq 131513246, ack 16802520, win 8192, options [mss 536], length 0
11:39:03.164837 IP cisco.vpn.client.ip.1195 > cisco.vpn.server.ip.36520: Flags [.], ack 1, win 65535, length 0
11:39:03.164841 IP cisco.vpn.client.ip.1195 > cisco.vpn.server.ip.36520: Flags [.], ack 1, win 65535, length 0
11:39:04.177195 IP cisco.vpn.client.ip.1195 > cisco.vpn.server.ip.36520: Flags [.], seq 1:883, ack 1, win 65535, length 882
11:39:04.177203 IP cisco.vpn.client.ip.1195 > cisco.vpn.server.ip.36520: Flags [.], seq 1:883, ack 1, win 65535, length 882
11:39:04.234909 IP cisco.vpn.server.ip.36520 > cisco.vpn.client.ip.1195: Flags [.], seq 1:397, ack 883, win 65535, length 396
11:39:04.234917 IP cisco.vpn.server.ip.36520 > cisco.vpn.client.ip.1195: Flags [.], seq 1:397, ack 883, win 65535, length 396
11:39:09.657261 IP cisco.vpn.client.ip.1195 > cisco.vpn.server.ip.36520: Flags [.], seq 883:1765, ack 1, win 65535, length 882
11:39:09.657269 IP cisco.vpn.client.ip.1195 > cisco.vpn.server.ip.36520: Flags [.], seq 883:1765, ack 1, win 65535, length 882
11:39:09.713726 IP cisco.vpn.server.ip.36520 > cisco.vpn.client.ip.1195: Flags [.], seq 397:793, ack 1765, win 65535, length 396
11:39:09.713733 IP cisco.vpn.server.ip.36520 > cisco.vpn.client.ip.1195: Flags [.], seq 397:793, ack 1765, win 65535, length 396
11:39:14.656879 IP cisco.vpn.client.ip.1195 > cisco.vpn.server.ip.36520: Flags [.], seq 1765:2647, ack 1, win 65535, length 882
11:39:14.656887 IP cisco.vpn.client.ip.1195 > cisco.vpn.server.ip.36520: Flags [.], seq 1765:2647, ack 1, win 65535, length 882
11:39:14.715599 IP cisco.vpn.server.ip.36520 > cisco.vpn.client.ip.1195: Flags [.], seq 793:1189, ack 2647, win 65535, length 396
11:39:14.715605 IP cisco.vpn.server.ip.36520 > cisco.vpn.client.ip.1195: Flags [.], seq 793:1189, ack 2647, win 65535, length 396
11:39:19.656749 IP cisco.vpn.client.ip.1195 > cisco.vpn.server.ip.36520: Flags [.], seq 2647:3529, ack 1, win 65535, length 882
11:39:19.656764 IP cisco.vpn.client.ip.1195 > cisco.vpn.server.ip.36520: Flags [.], seq 2647:3529, ack 1, win 65535, length 882
11:39:19.712962 IP cisco.vpn.server.36520 > cisco.vpn.client.ip.1195: Flags [.], seq 1189:1585, ack 3529, win 65535, length 396
11:39:19.712970 IP cisco.vpn.server.ip.36520 > cisco.vpn.client.ip.1195: Flags [.], seq 1189:1585, ack 3529, win 65535, length 396
11:39:25.659736 IP cisco.vpn.client.ip.1195 > cisco.vpn.server.ip.36520: Flags [R], seq 16806048, win 65535, length 0
11:39:25.659744 IP cisco.vpn.client.ip.1195 > cisco.vpn.server.ip.36520: Flags [R], seq 16806048, win 65535, length 0
^C
24 packets captured
42 packets received by filter
0 packets dropped by kernel

И вот подробный лог с клиента:

Показать
text

157    11:40:07.676  07/07/11  Sev=Info/4    CM/0x63100002
Begin connection process

158    11:40:07.676  07/07/11  Sev=Info/4    CM/0x63100004
Establish secure connection


159    11:40:07.676  07/07/11  Sev=Info/4    CM/0x63100024
Attempt connection with server "cisco.vpn.server.dns"


160    11:40:07.676  07/07/11  Sev=Info/6    CM/0x6310002F
Allocated local TCP port 1195 for TCP connection.


161    11:40:07.739  07/07/11  Sev=Info/4    IPSEC/0x63700008
IPSec driver successfully started


162    11:40:07.739  07/07/11  Sev=Info/4    IPSEC/0x63700014
Deleted all keys


163    11:40:07.739  07/07/11  Sev=Info/6    IPSEC/0x6370002C
Sent 4 packets, 0 were fragmented.


164    11:40:07.739  07/07/11  Sev=Info/6    IPSEC/0x63700020
TCP SYN sent to cisco.vpn.server.ip, src port 1195, dst port 36520


165    11:40:08.239  07/07/11  Sev=Info/6    IPSEC/0x6370001C
TCP SYN-ACK received from cisco.vpn.server.ip, src port 36520, dst port 1195


166    11:40:08.239  07/07/11  Sev=Info/6    IPSEC/0x63700021
TCP ACK sent to cisco.vpn.server.ip, src port 1195, dst port 36520


167    11:40:08.239  07/07/11  Sev=Info/4    CM/0x63100029
TCP connection established on port 36520 with server " cisco.vpn.server.dns”


168    11:40:08.739  07/07/11  Sev=Info/4    CM/0x63100024
Attempt connection with server " cisco.vpn.server.dns "


169    11:40:08.739  07/07/11  Sev=Info/6    IKE/0x6300003B
Attempting to establish a connection with cisco.vpn.server.ip.


170    11:40:08.739  07/07/11  Sev=Info/4    IKE/0x63000001
Starting IKE Phase 1 Negotiation


171    11:40:08.754  07/07/11  Sev=Info/4    IKE/0x63000013
SENDING >>> ISAKMP OAK AG (SA, KE, NON, ID, VID(Xauth), VID(dpd), VID(Frag), VID(Unity)) to cisco.vpn.server.ip


172    11:40:09.739  07/07/11  Sev=Info/6    IPSEC/0x63700024
CNIReceiveComplete: Invalid TCP checksum


173    11:40:09.739  07/07/11  Sev=Warning/3    IPSEC/0xA370001C
Bad cTCP trailer, Rsvd 0, Magic# 0h, trailer len 0, MajorVer 0, MinorVer 0


174    11:40:14.239  07/07/11  Sev=Info/4    IKE/0x63000021
Retransmitting last packet!


175    11:40:14.239  07/07/11  Sev=Info/4    IKE/0x63000013
SENDING >>> ISAKMP OAK AG (Retransmission) to cisco.vpn.server.ip


176    11:40:14.739  07/07/11  Sev=Info/6    IPSEC/0x63700024
CNIReceiveComplete: Invalid TCP checksum


177    11:40:14.739  07/07/11  Sev=Warning/3    IPSEC/0xA370001C
Bad cTCP trailer, Rsvd 0, Magic# 0h, trailer len 0, MajorVer 0, MinorVer 0


178    11:40:19.239  07/07/11  Sev=Info/4    IKE/0x63000021
Retransmitting last packet!


179    11:40:19.239  07/07/11  Sev=Info/4    IKE/0x63000013
SENDING >>> ISAKMP OAK AG (Retransmission) to cisco.vpn.server.ip


180    11:40:19.739  07/07/11  Sev=Info/6    IPSEC/0x63700024
CNIReceiveComplete: Invalid TCP checksum


181    11:40:19.739  07/07/11  Sev=Warning/3    IPSEC/0xA370001C
Bad cTCP trailer, Rsvd 0, Magic# 0h, trailer len 0, MajorVer 0, MinorVer 0


182    11:40:24.239  07/07/11  Sev=Info/4    IKE/0x63000021
Retransmitting last packet!


183    11:40:24.239  07/07/11  Sev=Info/4    IKE/0x63000013
SENDING >>> ISAKMP OAK AG (Retransmission) to cisco.vpn.server.ip


184    11:40:24.739  07/07/11  Sev=Info/6    IPSEC/0x63700024
CNIReceiveComplete: Invalid TCP checksum


185    11:40:24.739  07/07/11  Sev=Warning/3    IPSEC/0xA370001C
Bad cTCP trailer, Rsvd 0, Magic# 0h, trailer len 0, MajorVer 0, MinorVer 0


186    11:40:29.738  07/07/11  Sev=Info/4    IKE/0x63000017
Marking IKE SA for deletion  (I_Cookie=93F8D02646310202 R_Cookie=0000000000000000) reason = DEL_REASON_PEER_NOT_RESPONDING


187    11:40:30.238  07/07/11  Sev=Info/4    IKE/0x6300004B
Discarding IKE SA negotiation (I_Cookie=93F8D02646310202 R_Cookie=0000000000000000) reason = DEL_REASON_PEER_NOT_RESPONDING


188    11:40:30.238  07/07/11  Sev=Info/4    CM/0x63100014
Unable to establish Phase 1 SA with server " cisco.vpn.server.dns” because of "DEL_REASON_PEER_NOT_RESPONDING"


189    11:40:30.238  07/07/11  Sev=Info/5    CM/0x63100025
Initializing CVPNDrv


190    11:40:30.238  07/07/11  Sev=Info/4    CM/0x6310002D
Resetting TCP connection on port 36520


191    11:40:30.238  07/07/11  Sev=Info/6    CM/0x63100030
Removed local TCP port 1195 for TCP connection.


192    11:40:30.238  07/07/11  Sev=Info/6    CM/0x63100046
Set tunnel established flag in registry to 0.


193    11:40:30.238  07/07/11  Sev=Info/4    IKE/0x63000001
IKE received signal to terminate VPN connection


194    11:40:30.738  07/07/11  Sev=Info/6    IPSEC/0x63700023
TCP RST sent to cisco.vpn.server.ip, src port 1195, dst port 36520


195    11:40:30.738  07/07/11  Sev=Info/4    IPSEC/0x63700014
Deleted all keys


196    11:40:30.738  07/07/11  Sev=Info/4    IPSEC/0x63700014
Deleted all keys


197    11:40:30.738  07/07/11  Sev=Info/4    IPSEC/0x63700014
Deleted all keys


198    11:40:30.738  07/07/11  Sev=Info/4    IPSEC/0x6370000A
IPSec driver successfully stopped

Скажите плз, чего почитать, или может кто знает какие-то модули надо на фаерволе подключить?

Войдите или зарегистрируйтесь, чтобы ответить.