[es] - site2site Mikrotik <> Cisco PIX

S a l e
BGD

Član broj: 7457
Poruke: 1422

+8 Profil

^{19.01.2006. u 16:02 - pre 222 meseci}

Imam problem oko IPSec (site2site) konekcije izmedju Mikrotik i Cisco PIX. PC_A treba da komunicira sa PC_B preko te konekcije. PC_A ima private IP koju sam preko SRC-NAT "prebacio" u public IP (zbog mreze u kojoj je PC_B).

Status u MT logu je ovaj:

Code:
16:46:50 ipsec,ike,info received ISAKMP packet from [CISCO]:500, phase 2, Informational
16:46:50 ipsec,ike,info unexpected Informational exchange (remote unknown)
16:51:03 ipsec,ike,info queuing SA request, phase 1 with peer [CISCO] will be established first
16:51:03 ipsec,ike,info initiating phase 1, starting mode Identity Protection (local [MIKROTIK]:500) (remote unknown)
16:51:03 ipsec,info ipsec packet discarded: src=[PUB_IP_OF_PC_A] dst=[PC_B]
16:51:03 ipsec,ike,info received ISAKMP packet from [CISCO]:500, phase 1, Identity Protection
16:51:03 ipsec,ike,info received ISAKMP packet from [CISCO]:500, phase 1, Identity Protection
16:51:03 ipsec,ike,info received ISAKMP packet from [CISCO]:500, phase 1, Identity Protection
16:51:03 ipsec,ike,info packet has invalid ID payload (remote unknown)
16:51:03 ipsec,ike,info received ISAKMP packet from [CISCO]:500, phase 2, Informational
16:51:08 ipsec,info ipsec packet discarded: src=[PUB_IP_OF_PC_A] dst=[PC_B]
16:51:14 ipsec,info ipsec packet discarded: src=[PUB_IP_OF_PC_A] dst=[PC_B]
16:51:19 ipsec,info ipsec packet discarded: src=[PUB_IP_OF_PC_A] dst=[PC_B]
16:51:34 ipsec,ike,info dequeuing SA request to [CISCO], phase 1 wait timed out
16:52:03 ipsec,ike,info phase 1 negotiation timed out

Da li treba nesto da otvorim na firewall-u da bi mogao da se uspostavi IPSec?

_{[Ovu poruku je menjao S a l e dana 19.01.2006. u 17:11 GMT+1]}

Prikačeni fajlovi

status.png - 8.65k

Odgovor na temu

positive0

Član broj: 64952
Poruke: 143
217.75.207.*

Profil

Re: site2site Mikrotik <> Cisco PIX

^{25.01.2006. u 11:45 - pre 221 meseci}

Tesko je iz ovako malog dijela loga reci sta je konretan problem, ali evo dvije pretpostavke:

1. Izmedju 2 firewall-a imas NAT - u tom slucaju provjeri sta MT koristi kao NAT-transparency metod...pretpostavljam da je NAT-T s obzirom da je standard...nisam nikad radio sa MT-om pa ti to ne mogu reci... PIX, sa druge strane sigurno moze koristiti NAT over UDP (i TCP u 7.0) i NAT-T.
Kad ovo otkrijes, potrebno je da otvoris udp 500 u oba smijera, ip protokol 50 ili 51 (zavisi sta koristis: AH ili ESP) i udp 4500 u slucaju da se koristi NAT-T!

2. Host koji se natuje na internom segmentu nije ukljucen u crypto liste! Mada, ne vidim uopste razlog za njegovo natovanje...

Pozdrav

Sasa

---

Odgovor na temu