RE: [fw-wiz] Pix to Checkpoint VPN Connectivity
mlists_at_tdbnetworks.org
Date: 05/10/04
- Previous message: Bret Watson: "Re: [fw-wiz] Worms, Air Gaps and Responsibility"
- Maybe in reply to: Richard Worwood: "[fw-wiz] Pix to Checkpoint VPN Connectivity"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
To: "'Hartman, Darren'" <dhartman@icsalabs.com> Date: Mon, 10 May 2004 15:38:12 +0100
Thanks to Darrens help I seem to have got a little further but true to form
have hit another brick wall.
ISAKMP (0): beginning Main Mode exchange
crypto_isakmp_process_block:src:x.x.19.139, dest:x.x.4.83 spt:500 dpt:500
OAK_MM exchange
ISAKMP (0): processing SA payload. message ID = 0
ISAKMP (0): Checking ISAKMP transform 1 against priority 10 policy
ISAKMP: encryption 3DES-CBC
ISAKMP: hash SHA
ISAKMP: default group 2
ISAKMP: auth pre-share
ISAKMP: life type in seconds
ISAKMP: life duration (VPI) of 0x0 0x1 0x51 0x80
ISAKMP (0): atts are not acceptable. Next payload is 0
ISAKMP (0): Checking ISAKMP transform 1 against priority 30 policy
ISAKMP: encryption 3DES-CBC
ISAKMP: hash SHA
ISAKMP: default group 2
ISAKMP: auth pre-share
ISAKMP: life type in seconds
ISAKMP: life duration (VPI) of 0x0 0x1 0x51 0x80
ISAKMP (0): atts are not acceptable. Next payload is 0
ISAKMP (0): Checking ISAKMP transform 1 against priority 40 policy
ISAKMP: encryption 3DES-CBC
ISAKMP: hash SHA
ISAKMP: default group 2
ISAKMP: auth pre-share
ISAKMP: life type in seconds
ISAKMP: life duration (VPI) of 0x0 0x1 0x51 0x80
ISAKMP (0): atts are not acceptable. Next payload is 0
ISAKMP (0): Checking ISAKMP transform 1 against priority 50 policy
ISAKMP: encryption 3DES-CBC
ISAKMP: hash SHA
ISAKMP: default group 2
ISAKMP: auth pre-share
ISAKMP: life type in seconds
ISAKMP: life duration (VPI) of 0x0 0x1 0x51 0x80
ISAKMP (0): atts are acceptable. Next payload is 0
ISAKMP (0): SA is doing pre-shared key authentication using id type
ID_IPV4_ADDR
return status is IKMP_NO_ERROR
crypto_isakmp_process_block:src:x.x.19.139, dest:x.x.4.83 spt:500 dpt:500
OAK_MM exchange
ISAKMP (0): processing KE payload. message ID = 0
ISAKMP (0): processing NONCE payload. message ID = 0
ISAKMP (0): ID payload
next-payload : 8
type : 1
protocol : 17
port : 500
length : 8
ISAKMP (0): Total payload length: 12
return status is IKMP_NO_ERROR
crypto_isakmp_process_block:src:x.x.19.139, dest:x.x.4.83 spt:500 dpt:500
OAK_MM exchange
ISAKMP (0): processing ID payload. message ID = 0
ISAKMP (0): processing HASH payload. message ID = 0
ISAKMP (0): SA has been authenticated
ISAKMP (0): beginning Quick Mode exchange, M-ID of
-2067221398:84c8b46aIPSEC(key_engine): got a queue event...
IPSEC(spi_response): getting spi 0x36c44056(918831190) for SA
from x.x.19.139 to x.x.4.83 for prot 3
return status is IKMP_NO_ERROR
crypto_isakmp_process_block:src:x.x.19.139, dest:x.x.4.83 spt:500 dpt:500
ISAKMP: reserved not zero on payload 5!
ISAKMP: malformed payload
crypto_isakmp_process_block:src:x.x.19.139, dest:x.x.4.83 spt:500 dpt:500
ISAKMP: reserved not zero on payload 5!
ISAKMP: malformed payload
crypto_isakmp_process_block:src:x.x.19.139, dest:x.x.4.83 spt:500 dpt:500
OAK_QM exchange
oakley_process_quick_mode:
OAK_QM_IDLE
ISAKMP (0): processing SA payload. message ID = 2227745898
ISAKMP : Checking IPSec proposal 1
ISAKMP: transform 1, ESP_3DES
ISAKMP: attributes in transform:
ISAKMP: encaps is 1
ISAKMP: SA life type in seconds
ISAKMP: SA life duration (basic) of 28800
ISAKMP: SA life type in kilobytes
ISAKMP: SA life duration (VPI) of 0x0 0x46 0x50 0x0
ISAKMP: authenticator is HMAC-SHA
ISAKMP: group is 2
ISAKMP (0): atts are acceptable.IPSEC(validate_proposal_request): proposal
part #1,
(key eng. msg.) dest= x.x.19.139, src= x.x.4.83,
dest_proxy= x.x.19.65/255.255.255.255/0/0 (type=1),
src_proxy= x.x.0.253/255.255.255.255/0/0 (type=1),
protocol= ESP, transform= esp-3des esp-sha-hmac ,
lifedur= 0s and 0kb,
spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x24
ISAKMP (0): processing NONCE payload. message ID = 2227745898
ISAKMP (0): processing KE payload. message ID = 2227745898
ISAKMP (0): processing ID payload. message ID = 2227745898
ISAKMP (0): processing ID payload. message ID = 2227745898map_alloc_entry:
allocating entry 3
map_alloc_entry: allocating entry 4
ISAKMP (0): Creating IPSec SAs
inbound SA from x.x.19.139 to x.x.4.83 (proxy
x.x.19.65 to x.x.0.253)
has spi 918831190 and conn_id 3 and flags 25
lifetime of 28800 seconds
lifetime of 4608000 kilobytes
outbound SA from x.x.4.83 to x.x.19.139 (proxy x.x.0.253
to x.x.19.65)
has spi 3145190809 and conn_id 4 and flags 25
lifetime of 28800 seconds
lifetime of 4608000 kilobytesIPSEC(key_engine): got a queue event...
IPSEC(initialize_sas): ,
(key eng. msg.) dest= x.x.4.83, src= x.x.19.139,
dest_proxy= x.x.0.253/255.255.255.255/0/0 (type=1),
src_proxy= x.x.19.65/255.255.255.255/0/0 (type=1),
protocol= ESP, transform= esp-3des esp-sha-hmac ,
lifedur= 28800s and 4608000kb,
spi= 0x36c44056(918831190), conn_id= 3, keysize= 0, flags= 0x25
IPSEC(initialize_sas): ,
(key eng. msg.) src= x.x.4.83, dest= x.x.19.139,
src_proxy= x.x.0.253/255.255.255.255/0/0 (type=1),
dest_proxy= x.x.19.65/255.255.255.255/0/0 (type=1),
protocol= ESP, transform= esp-3des esp-sha-hmac ,
lifedur= 28800s and 4608000kb,
spi= 0xbb77cd99(3145190809), conn_id= 4, keysize= 0, flags= 0x25
VPN Peer: IPSEC: Peer Info not found during IPSEC addition: Peer
ip:x.x.19.139/500
VPN Peer: IPSEC: Peer Info not found during IPSEC addition: Peer
ip:x.x.19.139/500
return status is IKMP_NO_ERROR
VPN Peer: ISAKMP: Added new peer: ip:x.x.19.139/500 Total VPN Peers:2
VPN Peer: ISAKMP: Peer ip:x.x.19.139/500 Ref cnt incremented to:1 Total VPN
Peers:2
crypto_isakmp_process_block:src:x.x.19.139, dest:x.x.4.83 spt:500 dpt:500
OAK_QM exchange
oakley_process_quick_mode:
OAK_QM_IDLE
ISAKMP (0): processing SA payload. message ID = 3319682682
ISAKMP : Checking IPSec proposal 1
ISAKMP: transform 1, ESP_3DES
ISAKMP: attributes in transform:
ISAKMP: group is 1
ISAKMP: SA life type in seconds
ISAKMP: SA life duration (VPI) of 0x0 0x0 0xe 0x10
ISAKMP: authenticator is HMAC-SHA
ISAKMP: encaps is 1IPSEC(validate_proposal): invalid transform proposal
flags -- 0x14
ISAKMP (0): atts not acceptable. Next payload is 0
ISAKMP (0): SA not acceptable!
ISAKMP (0): sending NOTIFY message 14 protocol 0
return status is IKMP_ERR_NO_RETRANS
crypto_isakmp_process_block:src:4.24.220.6, dest:x.x.4.83 spt:500 dpt:500
OAK_MM exchange
ISAKMP (0): processing SA payload. message ID = 0
ISAKMP (0): Checking ISAKMP transform 1 against priority 10 policy
ISAKMP: encryption DES-CBC
ISAKMP: hash SHA
ISAKMP: default group 1
ISAKMP: auth pre-share
ISAKMP (0): atts are not acceptable. Next payload is 0
ISAKMP (0): Checking ISAKMP transform 1 against priority 30 policy
ISAKMP: encryption DES-CBC
ISAKMP: hash SHA
ISAKMP: default group 1
ISAKMP: auth pre-share
ISAKMP (0): atts are acceptable. Next payload is 0
ISAKMP (0): SA is doing pre-shared key authentication using id type
ID_IPV4_ADDR
return status is IKMP_NO_ERROR
crypto_isakmp_process_block:src:4.24.220.6, dest:x.x.4.83 spt:500 dpt:500
OAK_MM exchange
ISAKMP (0): processing KE payload. message ID = 0
ISAKMP (0): processing NONCE payload. message ID = 0
ISAKMP: no pre-shared key for 4.24.220.6
ISAKMP (0): processing vendor id payload
ISAKMP (0): speaking to another IOS box!
return status is IKMP_NO_ERROR
crypto_isakmp_process_block:src:x.x.19.139, dest:x.x.4.83 spt:500 dpt:500
ISAKMP: phase 2 packet is a duplicate of a previous packet
ISAKMP: resending last response
crypto_isakmp_process_block:src:4.24.220.6, dest:x.x.4.83 spt:500 dpt:500
ISAKMP: reserved not zero on payload 5!
ISAKMP: malformed payload
crypto_isakmp_process_block:src:x.x.19.139, dest:x.x.4.83 spt:500 dpt:500
ISAKMP: phase 2 packet is a duplicate of a previous packet
ISAKMP: resending last response
crypto_isakmp_process_block:src:x.x.19.139, dest:x.x.4.83 spt:500 dpt:500
ISAKMP: phase 2 packet is a duplicate of a previous packet
ISAKMP: resending last response
crypto_isakmp_process_block:src:x.x.19.139, dest:x.x.4.83 spt:500 dpt:500
ISAKMP: phase 2 packet is a duplicate of a previous packet
ISAKMP: resending last response
crypto_isakmp_process_block:src:x.x.19.139, dest:x.x.4.83 spt:500 dpt:500
ISAKMP: phase 2 packet is a duplicate of a previous packet
ISAKMP: resending last response
crypto_isakmp_process_block:src:x.x.19.139, dest:x.x.4.83 spt:500 dpt:500
ISAKMP: phase 2 packet is a duplicate of a previous packet
ISAKMP: resending last response
crypto_isakmp_process_block:src:4.24.220.6, dest:x.x.4.83 spt:500 dpt:500
ISAKMP: reserved not zero on payload 5!
ISAKMP: malformed payload
crypto_isakmp_process_block:src:x.x.19.139, dest:x.x.4.83 spt:500 dpt:500
ISAKMP: phase 2 packet is a duplicate of a previous packet
ISAKMP: resending last response
tdb-fw01#
tdb-fw01#
tdb-fw01#
crypto_isakmp_process_block:src:x.x.19.139, dest:x.x.4.83 spt:500 dpt:500
ISAKMP: phase 2 packet is a duplicate of a previous packet
ISAKMP: resending last response
crypto_isakmp_process_block:src:4.24.220.6, dest:x.x.4.83 spt:500 dpt:500
ISAKMP: reserved not zero on payload 5!
ISAKMP: malformed payload
crypto_isakmp_process_block:src:x.x.19.139, dest:x.x.4.83 spt:500 dpt:500
ISAKMP: phase 2 packet is a duplicate of a previous packet
ISAKMP: resending last response
ISAKMP (0): beginning Quick Mode exchange, M-ID of
1680169563:64255a5bIPSEC(key_engine): got a queue event...
IPSEC(spi_response): getting spi 0xe2569566(3797325158) for SA
from x.x.4.84 to x.x.4.83 for prot 3
crypto_isakmp_process_block:src:x.x.4.84, dest:x.x.4.83 spt:500 dpt:500
OAK_QM exchange
oakley_process_quick_mode:
OAK_QM_IDLE
ISAKMP (0): processing SA payload. message ID = 1680169563
ISAKMP : Checking IPSec proposal 1
ISAKMP: transform 1, ESP_3DES
ISAKMP: attributes in transform:
ISAKMP: encaps is 1
ISAKMP: SA life type in seconds
ISAKMP: SA life duration (basic) of 28800
ISAKMP: SA life type in kilobytes
ISAKMP: SA life duration (VPI) of 0x0 0x46 0x50 0x0
ISAKMP: authenticator is HMAC-MD5
ISAKMP (0): atts are acceptable.IPSEC(validate_proposal_request): proposal
part #1,
(key eng. msg.) dest= x.x.4.84, src= x.x.4.83,
dest_proxy= x.x.0.252/255.255.255.255/0/0 (type=1),
src_proxy= x.x.0.0/255.255.255.0/0/0 (type=4),
protocol= ESP, transform= esp-3des esp-md5-hmac ,
lifedur= 0s and 0kb,
spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x4
ISAKMP (0): processing NONCE payload. message ID = 1680169563
ISAKMP (0): processing ID payload. message ID = 1680169563
ISAKMP (0): processing ID payload. message ID = 1680169563map_alloc_entry:
allocating entry 5
map_alloc_entry: allocating entry 6
ISAKMP (0): Creating IPSec SAs
inbound SA from x.x.4.84 to x.x.4.83 (proxy x.x.0.252
to x.x.0.0)
has spi 3797325158 and conn_id 5 and flags 4
lifetime of 28800 seconds
lifetime of 4608000 kilobytes
outbound SA from x.x.4.83 to x.x.4.84 (proxy
x.x.0.0 to x.x.0.252)
has spi 4148531421 and conn_id 6 and flags 4
lifetime of 28800 seconds
lifetime of 4608000 kilobytesIPSEC(key_engine): got a queue event...
IPSEC(initialize_sas): ,
(key eng. msg.) dest= x.x.4.83, src= x.x.4.84,
dest_proxy= x.x.0.0/255.255.255.0/0/0 (type=4),
src_proxy= x.x.0.252/255.255.255.255/0/0 (type=1),
protocol= ESP, transform= esp-3des esp-md5-hmac ,
lifedur= 28800s and 4608000kb,
spi= 0xe2569566(3797325158), conn_id= 5, keysize= 0, flags= 0x4
IPSEC(initialize_sas): ,
(key eng. msg.) src= x.x.4.83, dest= x.x.4.84,
src_proxy= x.x.0.0/255.255.255.0/0/0 (type=4),
dest_proxy= x.x.0.252/255.255.255.255/0/0 (type=1),
protocol= ESP, transform= esp-3des esp-md5-hmac ,
lifedur= 28800s and 4608000kb,
spi= 0xf74590dd(4148531421), conn_id= 6, keysize= 0, flags= 0x4
VPN Peer: IPSEC: Peer ip:x.x.4.84/500 Ref cnt incremented to:4 Total VPN
Peers:2
VPN Peer: IPSEC: Peer ip:x.x.4.84/500 Ref cnt incremented to:5 Total VPN
Peers:2
return status is IKMP_NO_ERROR
crypto_isakmp_process_block:src:x.x.19.139, dest:x.x.4.83 spt:500 dpt:500
ISAKMP: phase 2 packet is a duplicate of a previous packet
ISAKMP: resending last response
crypto_isakmp_process_block:src:x.x.19.139, dest:x.x.4.83 spt:500 dpt:500
ISAKMP: phase 2 packet is a duplicate of a previous packet
ISAKMP: resending last response
crypto_isakmp_process_block:src:4.24.220.6, dest:x.x.4.83 spt:500 dpt:500
ISAKMP: reserved not zero on payload 5!
ISAKMP: malformed payload
crypto_isakmp_process_block:src:4.24.220.6, dest:x.x.4.83 spt:500 dpt:500
ISAKMP: reserved not zero on payload 5!
ISAKMP: malformed payload
ISAKMP (0): deleting SA: src 4.24.220.6, dst x.x.4.83
ISAKMP (0): retransmitting phase 2 (0/0)... mess_id 0xc5de567a
ISADB: reaper checking SA 0x11b78b4, conn_id = 0
ISADB: reaper checking SA 0x124ccbc, conn_id = 0
ISADB: reaper checking SA 0x1257fc4, conn_id = 0 DELETE IT!
VPN Peer:ISAKMP: Peer Info for 4.24.220.6/500 not found - peers:2
ISADB: reaper checking SA 0x11b78b4, conn_id = 0
ISADB: reaper checking SA 0x124ccbc, conn_id = 0
crypto_isakmp_process_block:src:4.24.220.6, dest:x.x.4.83 spt:500 dpt:500
ISAKMP: sa not found for ike msg
Richard
________________________________________________________
Richard Worwood, TDB Networks
4 High Street, Twyford, Berkshire RG10 9AE
Office: +44 (0) 118 934 0056
Mobile: +44 (0) 7771 662880
Email: richardw@tdbnetworks.com
Web: www.tdbnetworks.com
-----Original Message-----
From: Hartman, Darren [mailto:dhartman@icsalabs.com]
Sent: 10 May 2004 14:22
To: Richard Worwood
Subject: RE: [fw-wiz] Pix to Checkpoint VPN Connectivity
Possible problem:
From the debug info:
dest_proxy= x.x.0.253/255.255.255.255/0/0 (type=1),
src_proxy= x.x.19.65/255.255.255.255/0/0 (type=1),
local_proxy= x.x.0.253/255.255.255.255/1/0 (type=1),
remote_proxy= x.x.19.65/255.255.255.255/1/0 (type=1)
It looks like the peer is configured for "ANY" (0/0) protocol/port for
traffic selectors, but the PIX is configured for "ICMP" (1/0).
From your config, the crypto-map references the ACL which permits only
ICMP:
"crypto map internal-vpn-tunnel 90 match address
x.x.19.65-us-ftp-vpn-traffic"
"access-list x.x.19.65-us-ftp-vpn-traffic permit icmp host x.x.0.253 host
x.x.19.65"
To troubleshoot, try using your other ACL in the "match address" line, which
should match the 0/0 traffic selectors: "access-list vpn_connect permit ip
host x.x.0.253 host x.x.19.65"
Good Luck,
Darren Hartman
Sr. Lab Analyst
ICSA Labs
1000 Bent Creek Blvd, Suite 200
Mechanicsburg PA 17050
Phone: 717.790.8123
Fax: 717.790.8170
www.icsalabs.com
-----Original Message-----
From: firewall-wizards-admin@honor.icsalabs.com
[mailto:firewall-wizards-admin@honor.icsalabs.com] On Behalf Of Richard
Worwood
Sent: Monday, May 10, 2004 2:41 AM
To: firewall-wizards@honor.icsalabs.com
Subject: [fw-wiz] Pix to Checkpoint VPN Connectivity
I'm in the process of trying to setup a vpn connection between our Pix 515
and a supplier who have a checkpoint firewall but not having an awful lot of
luck. It looks to me as from the debugs I've captured as if the VPN is
establishing successfully but for some reason is unable to establish a
credible proxy relationship to allow communications to flow. I've include
copies of the debug capture and the config of my firewall for review as I
suspect I'm just doing something stupid but as ever any help will be
gratefully received.
Regards
Richard
Pix Debug Log
ISAKMP (0): beginning Quick Mode exchange, M-ID of
-1779604032:95ed65c0IPSEC(key_engine): got a queue event...
IPSEC(spi_response): getting spi 0xd7e65927(3622197543) for SA
from x.x.19.139 to x.x.4.83 for prot 3
crypto_isakmp_process_block:src:x.x.19.139, dest:x.x.4.83 spt:500 dpt:500
OAK_QM exchange
oakley_process_quick_mode:
OAK_QM_IDLE
ISAKMP (0): processing SA payload. message ID = 2515363264
ISAKMP : Checking IPSec proposal 1
ISAKMP: transform 1, ESP_3DES
ISAKMP: attributes in transform:
ISAKMP: encaps is 1
ISAKMP: SA life type in seconds
ISAKMP: SA life duration (basic) of 28800
ISAKMP: SA life type in kilobytes
ISAKMP: SA life duration (VPI) of 0x0 0x46 0x50 0x0
ISAKMP: authenticator is HMAC-SHA
ISAKMP: group is 2
ISAKMP (0): atts are acceptable.IPSEC(validate_proposal_request):
proposal part #1,
(key eng. msg.) dest= x.x.19.139, src= x.x.4.83,
dest_proxy= x.x.19.65/255.255.255.255/0/0 (type=1),
src_proxy= x.x.0.253/255.255.255.255/0/0 (type=1),
protocol= ESP, transform= esp-3des esp-sha-hmac ,
lifedur= 0s and 0kb,
spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x24
IPSEC(validate_transform_proposal): proxy identities not supported
IPSEC(validate_proposal_request): proposal part #1,
(key eng. msg.) dest= x.x.19.139, src= x.x.4.83,
dest_proxy= x.x.0.253/255.255.255.255/0/0 (type=1),
src_proxy= x.x.19.65/255.255.255.255/0/0 (type=1),
protocol= ESP, transform= esp-3des esp-sha-hmac ,
lifedur= 0s and 0kb,
spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x24
IPSEC(validate_transform_proposal): proxy identities not supported
ISAKMP: IPSec policy invalidated proposal ISAKMP (0): SA not acceptable!
ISAKMP (0): sending NOTIFY message 14 protocol 3 return status is
IKMP_ERR_NO_RETRANSIPSEC(key_engine): request timer fired: count = 1,
(identity) local= x.x.4.83, remote= x.x.19.139,
local_proxy= x.x.0.253/255.255.255.255/1/0 (type=1),
remote_proxy= x.x.19.65/255.255.255.255/1/0 (type=1)
ISAKMP (0): beginning Quick Mode exchange, M-ID of
52913619:32765d3IPSEC(key_engine): got a queue event...
IPSEC(spi_response): getting spi 0x3985d33c(965071676) for SA
from x.x.19.139 to x.x.4.83 for prot 3
crypto_isakmp_process_block:src:x.x.19.139, dest:x.x.4.83 spt:500 dpt:500
OAK_QM exchange
oakley_process_quick_mode:
OAK_QM_IDLE
ISAKMP (0): processing SA payload. message ID = 52913619
ISAKMP : Checking IPSec proposal 1
ISAKMP: transform 1, ESP_3DES
ISAKMP: attributes in transform:
ISAKMP: encaps is 1
ISAKMP: SA life type in seconds
ISAKMP: SA life duration (basic) of 28800
ISAKMP: SA life type in kilobytes
ISAKMP: SA life duration (VPI) of 0x0 0x46 0x50 0x0
ISAKMP: authenticator is HMAC-SHA
ISAKMP: group is 2
ISAKMP (0): atts are acceptable.IPSEC(validate_proposal_request):
proposal part #1,
(key eng. msg.) dest= x.x.19.139, src= x.x.4.83,
dest_proxy= x.x.19.65/255.255.255.255/0/0 (type=1),
src_proxy= x.x.0.253/255.255.255.255/0/0 (type=1),
protocol= ESP, transform= esp-3des esp-sha-hmac ,
lifedur= 0s and 0kb,
spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x24
IPSEC(validate_transform_proposal): proxy identities not supported
IPSEC(validate_proposal_request): proposal part #1,
(key eng. msg.) dest= x.x.19.139, src= x.x.4.83,
dest_proxy= x.x.0.253/255.255.255.255/0/0 (type=1),
src_proxy= x.x.19.65/255.255.255.255/0/0 (type=1),
protocol= ESP, transform= esp-3des esp-sha-hmac ,
lifedur= 0s and 0kb,
spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x24
IPSEC(validate_transform_proposal): proxy identities not supported
ISAKMP: IPSec policy invalidated proposal ISAKMP (0): SA not acceptable!
ISAKMP (0): sending NOTIFY message 14 protocol 3 return status is
IKMP_ERR_NO_RETRANSIPSEC(key_engine): request timer fired: count = 2,
(identity) local= x.x.4.83, remote= x.x.19.139,
local_proxy= x.x.0.253/255.255.255.255/1/0 (type=1),
remote_proxy= x.x.19.65/255.255.255.255/1/0 (type=1)
Config file
PIX Version 6.3(2)
interface ethernet0 auto
interface ethernet1 auto
interface ethernet2 auto shutdown
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 tdb-vpn security10
enable password xxxxxxxxxxxxxxxx
passwd xxxxxxxxxxxxxxxx
hostname fw01
domain-name tester.com
clock timezone GMT/BST 0
clock summer-time GMT/BDT recurring last Sun Mar 1:00 last Sun Oct 2:00
fixup protocol dns maximum-length 512 fixup protocol ftp 21 fixup protocol
h323 h225 1720 fixup protocol h323 ras 1718-1719 fixup protocol http 80
fixup protocol ils 389 fixup protocol pptp 1723 fixup protocol rsh 514 fixup
protocol rtsp 554 fixup protocol sip 5060 fixup protocol sip udp 5060 fixup
protocol skinny 2000 fixup protocol smtp 25 fixup protocol sqlnet 1521 fixup
protocol tftp 69
access-list inbound-acl permit icmp any any echo-reply access-list
inbound-acl permit icmp any any unreachable access-list inbound-acl permit
icmp any any time-exceeded access-list inbound-acl permit udp any eq domain
any access-list vpn_connect permit ip host x.x.0.253 host x.x.19.65
access-list x.x.19.65-us-ftp-vpn-traffic permit icmp host x.x.0.253 host
x.x.19.65 access-list x.x.19.65-us-ftp-vpn-traffic permit tcp host x.x.0.253
host x.x.19.65 eq ftp-data access-list x.x.19.65-us-ftp-vpn-traffic permit
tcp host x.x.0.253 host x.x.19.65 eq ftp pager lines 25 logging on logging
console warnings logging buffered warnings logging trap notifications
logging history warnings logging facility 22 logging queue 0 logging host
inside x.x.0.251 logging host inside x.x.0.15 mtu outside 1500 mtu inside
1500 mtu tdb-vpn 1500 ip address outside x.x.4.83 255.255.255.248 ip address
inside x.x.0.254 255.255.255.0 ip address tdb-vpn 127.0.0.1 255.255.255.248
ip verify reverse-path interface outside ip audit name Anal attack action
drop ip audit name Anal_Info info action alarm ip audit interface outside
Anal_Info ip audit interface outside Anal ip audit info action alarm ip
audit attack action alarm ip audit signature 2000 disable ip audit signature
2001 disable ip audit signature 2002 disable ip audit signature 2003 disable
ip audit signature 2004 disable ip audit signature 2005 disable ip audit
signature 2006 disable ip audit signature 2007 disable ip audit signature
2008 disable ip audit signature 2009 disable ip audit signature 2010 disable
ip audit signature 2011 disable ip audit signature 2012 disable pdm location
x.x.0.0 255.255.255.0 inside pdm logging errors 100 pdm history enable arp
timeout 14400 global (outside) 17 interface nat (inside) 0 access-list
vpn_connect nat (inside) 17 0.0.0.0 0.0.0.0 0 0 access-group inbound-acl in
interface outside router ospf 1
network x.x.0.0 255.255.255.0 area 0
log-adj-changes
redistribute static
route outside 0.0.0.0 0.0.0.0 x.x.4.86 1 timeout xlate 3:00:00 timeout conn
1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00 timeout
h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00 timeout uauth
0:05:00 absolute aaa-server TACACS+ protocol tacacs+ aaa-server RADIUS
protocol radius aaa-server LOCAL protocol local aaa-server AuthInbound
protocol radius aaa-server AuthInbound (inside) host x.x.0.253 cisco timeout
10 floodguard enable sysopt connection permit-ipsec crypto ipsec
transform-set ESP-3DES-SHA esp-3des esp-sha-hmac crypto map
internal-vpn-tunnel 90 ipsec-isakmp crypto map internal-vpn-tunnel 90 match
address x.x.19.65-us-ftp-vpn-traffic crypto map internal-vpn-tunnel 90 set
pfs group2 crypto map internal-vpn-tunnel 90 set peer x.x.19.139 crypto map
internal-vpn-tunnel 90 set transform-set ESP-3DES-SHA crypto map
internal-vpn-tunnel interface outside isakmp enable outside isakmp key
<Private Key> address x.x.19.139 netmask 255.255.255.255 no-xauth
no-config-mode
isakmp identity address
isakmp policy 10 authentication pre-share isakmp policy 10 encryption 3des
isakmp policy 10 hash md5 isakmp policy 10 group 1 isakmp policy 10 lifetime
28800 isakmp policy 30 authentication pre-share isakmp policy 30 encryption
des isakmp policy 30 hash sha isakmp policy 30 group 1 isakmp policy 30
lifetime 86400 isakmp policy 40 authentication pre-share isakmp policy 40
encryption 3des isakmp policy 40 hash md5 isakmp policy 40 group 2 isakmp
policy 40 lifetime 3600 isakmp policy 50 authentication pre-share isakmp
policy 50 encryption 3des isakmp policy 50 hash sha isakmp policy 50 group 2
isakmp policy 50 lifetime 86400 console timeout 10 terminal width 80 banner
exec
************************************************************************
****
***
banner exec *************************** Private Computer System
***************************
banner exec
************************************************************************
****
***
banner exec The data held on this TDB Networks Ltd. host system is PRIVATE
PROPERTY.Access banner exec to the data is only available for authorised
users and purposes. Unauthorised banner exec entry contravenes the Computer
Misuse Act 1990 and may incur criminal penalties banner exec as well as
damages. Please proceed if you are an authorised user.
_______________________________________________
firewall-wizards mailing list firewall-wizards@honor.icsalabs.com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards
***********************************************************************
This message is intended only for the use of the intended recipient and may
contain information that is PRIVILEGED and/or CONFIDENTIAL. If you are not
the intended recipient, you are hereby notified that any use, dissemination,
disclosure or copying of this communication is strictly prohibited. If you
have received this communication in error, please destroy all copies of this
message and its attachments and notify us immediately.
***********************************************************************
_______________________________________________
firewall-wizards mailing list
firewall-wizards@honor.icsalabs.com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards
- Previous message: Bret Watson: "Re: [fw-wiz] Worms, Air Gaps and Responsibility"
- Maybe in reply to: Richard Worwood: "[fw-wiz] Pix to Checkpoint VPN Connectivity"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
