ciscovpn完全配置指南.pdf

Cisco VPN 完全配置指南

PIX 和 ASA 连接的故障诊断与排除

一、 ISAKMP/IKE 阶段 1 连接

show isakmp sa [detail] 显示任何管理连接的状态

show [crypto] isakmp stats 显示管理连接的统计信息

show [crypto] isakmp ipsec-over-tcp stats 显示管理连接正在管理的任何 IPSec over

TCP 连接的统计信息

debug crypto isakmp 显示构建一个管理连接所采取的步骤，以及通过管理连接构建数

据连接所采取的步骤

个特定的管理连接。

1、show isakmp sa 命令

pix63(config)# show isakmp sa

Total : 1

Embryonic : 0

dst src state pending created

192.1.1.101 192.1.1.40 QM_IDLE 0 0

pix70(config-general)# show isakmp sa

Active SA: 1

Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during

建立连接时会显示 QM_IDLE ，而 FOS7. 中建立连接会显示 "MM_Active" 或 "AG_Active," ，

这主要取决于其采用的主模式还是积极模式构建管理连接。

2、debug crypto isakmp 命令

在 L2L 会话中，如下所示

IKEv1 DEBUG]: IP = 192.1.1.40, processing SA payload (1)

[IKEv1 DEBUG]: IP = 192.1.1.40, Oakley proposal is acceptable

output omitted

[IKEv1 DEBUG]: IP = 192.1.1.40, Received NAT-Traversal ver 03 VID (2)

output omitted

[IKEv1 DEBUG]: IP = 192.1.1.40, processing IKE SA (3)

[IKEv1 DEBUG]: IP = 192.1.1.40, IKE SA Proposal # 1, (4)

[IKEv1 DEBUG]: IP = 192.1.1.40, processing VID payload

[IKEv1 DEBUG]: IP = 192.1.1.40, Received DPD VID

[IKEv1 DEBUG]: IP = 192.1.1.40, processing VID payload

[IKEv1 DEBUG]: IP = 192.1.1.40, Processing IOS/PIX Vendor ID payload

(version: 1.0.0, capabilities: 0000077f)

[IKEv1 DEBUG]: IP = 192.1.1.40, processing VID payload

[IKEv1 DEBUG]: IP = 192.1.1.40, Received xauth V6 VID

[IKEv1 DEBUG]: IP = 192.1.1.40, constructing ke payload

[IKEv1 DEBUG]: IP = 192.1.1.40, constructing nonce payload

[IKEv1 DEBUG]: IP = 192.1.1.40, constructing Cisco Unity VID payload

[IKEv1 DEBUG]: IP = 192.1.1.40, constructing xauth V6 VID payload

[IKEv1 DEBUG]: IP = 192.1.1.40, Send IOS VID

[IKEv1 DEBUG]: IP = 192.1.1.40, Constructing ASA spoofing IOS Vendor

[IKEv1 DEBUG]: IP = 192.1.1.40, Send Altiga/Cisco

[IKEv1 DEBUG]: Group = 192.1.1.40, IP = 192.1.1.40, Generating keys

for Responder...

[IKEv1]: IP = 192.1.1.40, IKE DECODE SENDING Message (msgid=0) with

payloads : HDR + KE (4) + NONCE (10) + VENDOR (13) + VENDOR (13)

NOTIFY (11) + NONE (0) total length : 112

[IKEv1 DEBUG]: Group = 192.1.1.40, IP = 192.1.1.40, Processing ID (7)

[IKEv1 DEBUG]: Group = 192.1.1.40, IP = 192.1.1.40, computing hash

proposal=30/10 sec.

[IKEv1 DEBUG]: IP = 192.1.1.40, Starting IOS keepalive monitor:

80 sec.

[IKEv1]: IP = 192.1.1.40, Connection landed on tunnel_group

192.1.1.40

[IKEv1 DEBUG]: Group = 192.1.1.40, IP = 192.1.1.40, computing hash

[IKEv1 DEBUG]: Group = 192.1.1.40, IP = 192.1.1.40,

constructing dpd vid payload

output omitted

[IKEv1]: Group = 192.1.1.40, IP = 192.1.1.40, PHASE 1 COMPLETED (9)

[IKEv1]: IP = 192.1.1.40, Keep-alive type for this connection: DPD

[IKEv1 DEBUG]: Group = 192.1.1.40, IP = 192.1.1.40, Starting

phase 1 rekey timer: 82080000 (ms)

[IKEv1 DECODE]: IP = 192.1.1.40, IKE Responder starting QM:

msg id = 4a9a7c8b

[IKEv1]: IP = 192.1.1.40, IKE DECODE RECEIVED Message (10)

(msgid=4a9a7c8b) with payloads : HDR + HASH (8) + SA (1) +

output omitted

Proxy Subnet data in ID Payload: Address 192.168.0.0,

Mask 255.255.255.0, Protocol 0, Port 0

[IKEv1 DEBUG]: Group = 192.1.1.40, IP = 192.1.1.40, Processing ID

[IKEv1 DECODE]: ID_IPV4_ADDR_SUBNET ID received--