在同一外部接口上配置站点到站点 IPSEC VPN 和远程访问 VLAN 的正确方法是什么？思科 891 中断服务程序

网络工程 思科 虚拟专用网 cisco-ios-15 cisco-isr 网络安全
2021-07-31 17:58:47

我很乐意发布配置或日志以供参考，但我无法让远程访问 VPN 在与站点到站点 IPSEC VPN 相同的界面上工作。我正在为远程访问 vpn 使用动态加密映射，但它似乎在尝试执行第一阶段失败。谁能给我一个简单的示例配置来解决？

编辑：

这是根据以下建议实施 ISAKMP 配置文件后失败的调试转储。系统提示我输入用户名和密码，但它超时了。看起来 isakmp 授权失败了。目前 isakmp 授权只是设置为本地用户列表。对你们来说，这似乎是问题吗？

Jul  3 16:40:44.297: ISAKMP/aaa: unique id = 29277
Jul  3 16:40:44.297: ISAKMP:(0):Proposed key length does not match policy
Jul  3 16:40:44.297: ISAKMP:(0):atts are not acceptable. Next payload is 3
Jul  3 16:40:44.313: ISAKMP:(0):ISAKMP/tunnel: setting up tunnel REMOTEACCESS pw request
Jul  3 16:40:44.313: ISAKMP:(0):ISAKMP/tunnel: Tunnel REMOTEACCESS PW Request successfully sent to AAA
Jul  3 16:40:44.317: ISAKMP:(0):ISAKMP/tunnel: received callback from AAA
AAA/AUTHOR/IKE: Processing AV tunnel-password
AAA/AUTHOR/IKE: Processing AV addr-pool
AAA/AUTHOR/IKE: Processing AV inacl
AAA/AUTHOR/IKE: Processing AV dns-servers
AAA/AUTHOR/IKE: Processing AV wins-servers
AAA/AUTHOR/IKE: Processing AV route-metric
Jul  3 16:40:44.317: ISAKMP/tunnel: received tunnel atts
Jul  3 16:40:44.341: ISAKMP AAA: Deleting old aaa_uid = 29277
Jul  3 16:40:44.341: ISAKMP AAA: NAS Port Id is already set to 174.98.136.27
Jul  3 16:40:44.341: ISAKMP:(0):AAA: Nas Port ID set to 174.98.136.27.
Jul  3 16:40:44.341: ISAKMP AAA: Allocated new aaa_uid = 29278
Jul  3 16:40:44.341: ISAKMP AAA: Accounting is not enabled
Jul  3 16:40:48.337: ISAKMP AAA: NAS Port Id is already set to 174.98.136.27
Jul  3 16:40:48.337: ISAKMP/Authen: unique id = 29278
Jul  3 16:40:48.337: ISAKMP:(2110):AAA Authen: setting up authen_request
Jul  3 16:40:48.337: ISAKMP:(2110):AAA Authen: Successfully sent authen info to AAA

Jul  3 16:40:48.337: ISAKMP:(2110):AAA Authen: Local Authentication or no RADIUS atts recvd
Jul  3 16:40:48.349: ISAKMP:(2110):ISAKMP/author: setting up the authorization request for REMOTEACCESS
Jul  3 16:40:48.349: ISAKMP:(0):ISAKMP/author: received callback from AAA
AAA/AUTHOR/IKE: Processing AV tunnel-password
AAA/AUTHOR/IKE: Processing AV addr-pool
AAA/AUTHOR/IKE: Processing AV inacl
AAA/AUTHOR/IKE: Processing AV dns-servers
Jul  3 16:40:48.349: 
AAA/AUTHOR/IKE: no DNS addresses
AAA/AUTHOR/IKE: Processing AV wins-servers
Jul  3 16:40:48.349: 
AAA/AUTHOR/IKE: no WINS addresses
AAA/AUTHOR/IKE: Processing AV route-metric
Jul  3 16:40:48.349: ISAKMP:(2110):ISAKMP/author: No Class attributes
Jul  3 16:40:48.349: ISAKMP:FSM error - Message from AAA grp/user.

当我调试 isakmp 和 ipsec 错误并拉取日志时，我也会看到这些错误：

Jul  3 16:32:33.949: insert of map into mapdb AVL failed, map + ace pair already exists on the mapdb
Jul  3 16:32:57.557: ISAKMP:(0):Proposed key length does not match policy
Jul  3 16:32:57.557: ISAKMP:(0):atts are not acceptable. Next payload is 3
Jul  3 16:33:00.637: ISAKMP:FSM error - Message from AAA grp/user.
3个回答

在这里在黑暗中拍摄，因为有很多你没有提到的变量。请更新问题以包括您正在使用的特定技术、您的当前网络配置以及您遇到的错误。但是，如果您使用例如 DMVPN + EZVPN，您可能必须使用密钥环和多个 ISAKMP 配置文件。既然你指出了第一阶段的问题，我会检查一下。以下链接提供了DMVPN 和 EZVPN和L2L+EZVPN 的参考配置。您应该能够进行修改以满足您的需求。

这是一些午餐时间阅读的ISAKMP 配置文件参考。

没有看到您的设置是什么，这个例子不会完全准确。然而，这里是我将如何配置站点 A。站点 B 将类似，减去远程 VPN 部分并反转站点 A 和站点 B 部分。括号中的任何内容都需要填写您自己的信息。

此外，对于此特定示例，远程 VPN 将通过 Cisco VPN Client 而不是 AnyConnect Client。ShrewSoft VPN 客户端也可以使用。

ip local pool pool-remote-access 10.250.0.1 10.250.0.254

crypto logging ezvpn
!
crypto isakmp policy 1
 encr aes
 authentication pre-share
 group 2

crypto isakmp key <pre-shared-site-to-site-key-here> address <site-b-ip>   no-xauth

!
crypto isakmp client configuration group Remote-Users-Group
 key <pre-shared-key-for-vpn-users>
 dns <internal-domain-dns-ip>
 domain <internal-domain-fqdn>
 pool pool-remote-access
 acl acl-remote-access
 split-dns <internal-domain-fqdn>
crypto isakmp profile Remote-Users-Profile
   description Remote VPN Clients
   match identity group Remote-Users-Group
   client authentication list <inset-aaa-group-for-remote-user-authentication>
   isakmp authorization list <inset-aaa-group-for-remote-user-authorization>
   client configuration address respond
!
!
crypto ipsec transform-set esp-aes-sha esp-aes esp-sha-hmac
crypto ipsec df-bit clear
!
!
!
crypto dynamic-map dynamic-vpn-map 1
 set transform-set esp-aes-sha 
 set isakmp-profile Remote-Users-Profile
 reverse-route
 qos pre-classify
!
!
crypto map vpn-map-all 1 ipsec-isakmp 
 description VPN to Site-B
 set peer <site-b-IP>
 set transform-set esp-aes-sha 
 match address acl-vpn-site-b
crypto map vpn-map-all 65535 ipsec-isakmp dynamic dynamic-vpn-map 

ip access-list extended acl-remote-access
 permit ip <site-a-subnet> 0.0.0.255 10.250.0.0 0.0.0.255

ip access-list extended acl-vpn-site-b
 permit ip <site-a-subnet> 0.0.0.255 <site-b-subnet> 0.0.0.255


interface <outside-interface>
 crypto map vpn-map-all

! These ports need to be open on the outside interface 
! permit udp any host <public-ip-of-outside-interface> eq non500-isakmp
! permit udp any host <public-ip-of-outside-interface> eq isakmp
! permit esp any host <public-ip-of-outside-interface>
! permit ahp any host <public-ip-of-outside-interface>

!
!If doing NAT... need to block VPN-VPN connections from being NAT'd
!The following is an example setup - not definitive
!



ip access-list extended acl-block-vpn
 deny   ip <site-a-subnet> 0.0.0.255 <site-b-subnet> 0.0.0.255  !Site-B
 deny   ip <site-a-subnet> 0.0.0.255 10.250.0.0 0.0.0.255       !Remote users 
 permit ip <site-a-subnet> 0.0.0.255 any

route-map rm-block-vpn-on-nat permit 1
 match ip address acl-block-vpn

ip nat inside source route-map rm-block-vpn-on-nat interface <overloaded-interface> overload

这是 DMVPN 的另一个优秀资源：

https://nwktimes.blogspot.com/search/label/DMVPN

其它你可能感兴趣的问题
上一篇为什么 iperf、scamper 和路径 MTU 发现数据包捕获在路径的 MTU 上不一致？ 下一篇VSS 配置中的 UDLD