• If this is your first visit, be sure to check out the FAQ by clicking the link above. You may have to register before you can post: click the register link above to proceed. To start viewing messages, select the forum that you want to visit from the selection below.
Xin chào ! Nếu đây là lần đầu tiên bạn đến với diễn đàn, xin vui lòng danh ra một phút bấm vào đây để đăng kí và tham gia thảo luận cùng VnPro.

Announcement

Collapse
No announcement yet.

Lỗi VPN Site-To-Site

Collapse
X
Collapse
 
  • Page of 1
  • Filter
  • Time
  • Show
Clear All
new posts
Previous template Next
  • #1

    Lỗi VPN Site-To-Site

    Hiện tại em gặp cái lỗi này không biết tại sao nữa.
    *Aug 27 09:53:30.075: %CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd packet not an IPSEC packet. (ip) vrf/dest_addr= /192.168.1.255, src_addr= 192.168.1.22, prot= 17
    *Aug 27 09:54:30.895: %CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd packet not an IPSEC packet. (ip) vrf/dest_addr= /192.168.1.255, src_addr= 192.168.1.58, prot= 17
    *Aug 27 09:55:43.819: %CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd packet not an IPSEC packet. (ip) vrf/dest_addr= /192.168.1.255, src_addr= 192.168.1.41, prot= 17
    *Aug 27 09:57:06.907: %CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd packet not an IPSEC packet. (ip) vrf/dest_addr= /192.168.1.255, src_addr= 192.168.1.22, prot= 17


    Cấu hình;

    R-2901:
    Building configuration...

    Current configuration : 2789 bytes
    !
    ! Last configuration change at 08:31:59 UTC Wed Aug 26 2015
    !
    version 15.4
    service timestamps debug datetime msec
    service timestamps log datetime msec
    service password-encryption
    !
    hostname TrungTam
    !
    boot-start-marker
    boot-end-marker
    !
    !
    enable secret 5 $1$lrsk$MucpwJgQHm0xX1jdFORKK.
    !
    no aaa new-model
    !
    !
    !
    !
    !
    !
    !
    ip cef
    no ipv6 cef
    !
    multilink bundle-name authenticated
    !
    !
    !
    !
    !
    !
    username KCN password 7 05202521011D1C5A59
    !
    redundancy
    !
    !
    !
    !
    !
    !
    !
    crypto isakmp policy 10
    encr 3des
    hash md5
    authentication pre-share
    group 2
    crypto isakmp key KCN address 0.0.0.0
    !
    !
    crypto ipsec transform-set MYSET esp-3des esp-md5-hmac
    mode tunnel
    !
    !
    !
    crypto dynamic-map TT-VPN 10
    set security-association lifetime seconds 86400
    set transform-set MYSET
    match address VPN-CongNgheCao
    crypto dynamic-map TT-VPN 11
    set security-association lifetime seconds 86400
    set transform-set MYSET
    match address VPN-LinhTrung1
    !
    !
    crypto map VPN 1 ipsec-isakmp dynamic TT-VPN
    !
    !
    !
    !
    !
    interface Embedded-Service-Engine0/0
    no ip address
    shutdown
    !
    interface GigabitEthernet0/0
    description "Connect ISP"
    ip address dhcp
    ip nat outside
    ip virtual-reassembly in
    duplex auto
    speed auto
    pppoe enable group global
    pppoe-client dial-pool-number 1
    crypto map VPN
    !
    interface GigabitEthernet0/1
    description "Connec LAN"
    ip address 192.168.21.1 255.255.255.0
    ip nat inside
    ip virtual-reassembly in
    duplex auto
    speed auto
    !
    interface Dialer1
    mtu 1492
    ip address xxxxxxxxxx
    ip nat outside
    ip virtual-reassembly in
    encapsulation ppp
    dialer pool 1
    dialer-group 1
    ppp authentication pap chap callin
    ppp chap hostname xxxxx
    ppp chap password 7 010102145C06111B3654
    ppp pap sent-username xxxx password 7 06140B314B431E0D120F
    crypto map VPN
    !
    ip forward-protocol nd
    !
    no ip http server
    no ip http secure-server
    !
    ip nat inside source list 99 interface Dialer1 overload
    ip route 0.0.0.0 0.0.0.0 Dialer1
    ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0
    !
    ip access-list extended VPN-CongNgheCao
    permit ip 192.168.21.0 0.0.0.255 192.168.1.0 0.0.0.255
    permit ip any any
    ip access-list extended VPN-LinhTrung1
    permit ip 192.168.21.0 0.0.0.255 192.168.2.0 0.0.0.255
    ip access-list extended VPN1
    !
    !
    !
    access-list 99 permit 192.168.21.0 0.0.0.255 log
    access-list 99 permit any
    !
    control-plane
    !
    !
    !
    line con 0
    line aux 0
    line 2
    no activation-character
    no exec
    transport preferred none
    transport output pad telnet rlogin lapb-ta mop udptn v120 ssh
    stopbits 1
    line vty 0 4
    access-class 99 in
    password 7 062D2C0F6C1F5B4A
    login
    transport input telnet ssh
    !
    scheduler allocate 20000 1000
    !
    !
    pnp profile pnp_profile
    transport http host pnpserver.Home port 80 source GigabitEthernet0/0
    end



    R-867

    Building configuration...

    Current configuration : 1557 bytes
    !
    ! Last configuration change at 02:42:29 UTC Wed Aug 26 2015
    version 15.2
    no service pad
    service timestamps debug datetime msec
    service timestamps log datetime msec
    no service password-encryption
    !
    hostname KhuCongNgheCao
    !
    boot-start-marker
    boot-end-marker
    !
    !
    enable password KCN@123
    !
    no aaa new-model
    wan mode dsl
    !
    !
    !
    !
    !
    !
    ip cef
    no ipv6 cef
    !
    !
    !
    !
    !
    !
    !
    !
    !
    controller VDSL 0
    !
    !
    !
    !
    !
    !
    crypto isakmp policy 10
    encr 3des
    hash md5
    authentication pre-share
    group 2
    crypto isakmp key KCN address 113.161.38.137
    !
    !
    crypto ipsec transform-set MYSET esp-3des esp-md5-hmac
    mode tunnel
    !
    !
    !
    crypto map VPN-TO-TT 10 ipsec-isakmp
    set peer 113.161.38.137
    set transform-set MYSET
    match address VPN
    !
    !
    !
    !
    !
    interface ATM0
    no ip address
    shutdown
    no atm ilmi-keepalive
    !
    interface Ethernet0
    no ip address
    shutdown
    !
    interface FastEthernet0
    no ip address
    !
    interface FastEthernet1
    no ip address
    !
    interface FastEthernet2
    no ip address
    !
    interface FastEthernet3
    no ip address
    !
    interface GigabitEthernet0
    no ip address
    !
    interface GigabitEthernet1
    no ip address
    shutdown
    duplex auto
    speed auto
    !
    interface Vlan1
    ip address 192.168.1.10 255.255.255.0
    crypto map VPN-TO-TT
    !
    ip forward-protocol nd
    no ip http server
    no ip http secure-server
    !
    !
    ip route 0.0.0.0 0.0.0.0 192.168.1.1
    !
    ip access-list extended VPN
    permit ip any 192.168.21.0 0.0.0.255
    !
    mac-address-table aging-time 15
    !
    !
    line con 0
    no modem enable
    line aux 0
    line vty 0 4
    password KCN@123
    login
    transport input telnet ssh
    !
    scheduler allocate 60000 1000
    !
    end
    Tags: None
  • #2
    Log đổ về


    Tram1#ping 192.168.21.1 source 192.168.1.51
    Type escape sequence to abort.
    Sending 5, 100-byte ICMP Echos to 192.168.21.1, timeout is 2 seconds:
    Packet sent with a source address of 192.168.1.51

    *Aug 27 10:33:02.147: ISAKMP:(0): SA request profile is (NULL)
    *Aug 27 10:33:02.147: ISAKMP: Created a peer struct for 113.161.38.137, peer port 500
    *Aug 27 10:33:02.147: ISAKMP: New peer created peer = 0x84E13250 peer_handle = 0x80000005
    *Aug 27 10:33:02.147: ISAKMP: Locking peer struct 0x84E13250, refcount 1 for isakmp_initiator
    *Aug 27 10:33:02.147: ISAKMP: local port 500, remote port 500
    *Aug 27 10:33:02.147: ISAKMP: set new node 0 to QM_IDLE
    *Aug 27 10:33:02.147: ISAKMP:(0):insert sa successfully sa = 874CE540
    *Aug 27 10:33:02.147: ISAKMP:(0):Can not start Aggressive mode, trying Main mode.
    *Aug 27 10:33:02.147: ISAKMP:(0):found peer pre-shared key matching 113.161.38.137
    *Aug 27 10:33:02.147: ISAKMP:(0): constructed NAT-T vendor-rfc3947 ID
    *Aug 27 10:33:02.147: ISAKMP:(0): constructed NAT-T vendor-07 ID
    *Aug 27 10:33:02.147: ISAKMP:(0): constructed NAT-T vendor-03 ID
    *Aug 27 10:33:02.147: ISAKMP:(0): constructed NAT-T vendor-02 ID
    *Aug 27 10:33:02.147: ISAKMP:(0):Input = IKE_MESG_FROM_IPSEC, IKE_SA_REQ_MM
    *Aug 27 10:33:02.147: ISAKMP:(0):Old State = IKE_READY New State = IKE_I_MM1

    *Aug 27 10:33:02.147: ISAKMP:(0): beginning Main Mode exchange
    *Aug 27 10:33:02.147: ISAKMP:(0): sending packet to 113.161.38.137 my_port 500 peer_port 500 (I) MM_NO_STATE
    *Aug 27 10:33:02.147: ISAKMP:(0):Sending an IKE IPv4 Packet......
    Success rate is 0 percent (0/5)
    Tram1#
    *Aug 27 10:33:12.147: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE...
    *Aug 27 10:33:12.147: ISAKMP (0): incrementing error counter on sa, attempt 1 of 5: retransmit phase 1
    *Aug 27 10:33:12.147: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE
    *Aug 27 10:33:12.147: ISAKMP:(0): sending packet to 113.161.38.137 my_port 500 peer_port 500 (I) MM_NO_STATE
    *Aug 27 10:33:12.147: ISAKMP:(0):Sending an IKE IPv4 Packet.
    *Aug 27 10:33:12.547: %CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd packet not an IPSEC packet. (ip) vrf/dest_addr= /224.0.0.252, src_addr= 192.168.1.38, prot= 17
    *Aug 27 10:33:22.147: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE...
    *Aug 27 10:33:22.147: ISAKMP (0): incrementing error counter on sa, attempt 2 of 5: retransmit phase 1
    *Aug 27 10:33:22.147: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE
    *Aug 27 10:33:22.147: ISAKMP:(0): sending packet to 113.161.38.137 my_port 500 peer_port 500 (I) MM_NO_STATE
    *Aug 27 10:33:22.147: ISAKMP:(0):Sending an IKE IPv4 Packet.
    *Aug 27 10:33:32.147: ISAKMP: set new node 0 to QM_IDLE
    *Aug 27 10:33:32.147: ISAKMP:(0):SA is still budding. Attached new ipsec request to it. (local 192.168.1.51, remote 113.161.38.137)
    *Aug 27 10:33:32.147: ISAKMP: Error while processing SA request: Failed to initialize SA
    *Aug 27 10:33:32.147: ISAKMP: Error while processing KMI message 0, error 2.
    *Aug 27 10:33:32.147: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE...
    *Aug 27 10:33:32.147: ISAKMP (0): incrementing error counter on sa, attempt 3 of 5: retransmit phase 1
    *Aug 27 10:33:32.147: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE
    *Aug 27 10:33:32.147: ISAKMP:(0): sending packet to 113.161.38.137 my_port 500 peer_port 500 (I) MM_NO_STATE
    *Aug 27 10:33:32.147: ISAKMP:(0):Sending an IKE IPv4 Packet.
    *Aug 27 10:33:42.147: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE...
    *Aug 27 10:33:42.147: ISAKMP (0): incrementing error counter on sa, attempt 4 of 5: retransmit phase 1
    *Aug 27 10:33:42.147: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE
    *Aug 27 10:33:42.147: ISAKMP:(0): sending packet to 113.161.38.137 my_port 500 peer_port 500 (I) MM_NO_STATE
    *Aug 27 10:33:42.147: ISAKMP:(0):Sending an IKE IPv4 Packet.
    *Aug 27 10:33:52.147: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE...
    *Aug 27 10:33:52.147: ISAKMP (0): incrementing error counter on sa, attempt 5 of 5: retransmit phase 1
    *Aug 27 10:33:52.147: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE
    *Aug 27 10:33:52.147: ISAKMP:(0): sending packet to 113.161.38.137 my_port 500 peer_port 500 (I) MM_NO_STATE
    *Aug 27 10:33:52.147: ISAKMP:(0):Sending an IKE IPv4 Packet.
    *Aug 27 10:34:02.147: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE...
    *Aug 27 10:34:02.147: ISAKMP:(0):peer does not do paranoid keepalives.

    *Aug 27 10:34:02.147: ISAKMP:(0):deleting SA reason "Death by retransmission P1" state (I) MM_NO_STATE (peer 113.161.38.137)
    *Aug 27 10:34:02.147: ISAKMP:(0):deleting SA reason "Death by retransmission P1" state (I) MM_NO_STATE (peer 113.161.38.137)
    *Aug 27 10:34:02.147: ISAKMP: Unlocking peer struct 0x84E13250 for isadb_mark_sa_deleted(), count 0
    *Aug 27 10:34:02.147: ISAKMP: Deleting peer node by peer_reap for 113.161.38.137: 84E13250
    *Aug 27 10:34:02.147: ISAKMP:(0):deleting node 1797047820 error FALSE reason "IKE deleted"
    *Aug 27 10:34:02.147: ISAKMP:(0):deleting node 1219673663 error FALSE reason "IKE deleted"
    *Aug 27 10:34:02.147: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PHASE1_DEL
    *Aug 27 10:34:02.147: ISAKMP:(0):Old State = IKE_I_MM1 New State = IKE_DEST_SA

    *Aug 27 10:34:27.095: %CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd packet not an IPSEC packet. (ip) vrf/dest_addr= /224.0.0.252, src_addr= 192.168.1.38, prot= 17
    *Aug 27 10:34:52.147: ISAKMP:(0):purging node 1797047820
    *Aug 27 10:34:52.147: ISAKMP:(0):purging node 1219673663

    Comment

    • #3
      lỗi này là do crypto access list ở hai đầu chưa "match" hoặc là cấu hình routing chưa chính xác.

      User receives the error message "%CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd packet not an IPSEC packet.(ip) dest_addr= [IP_address], src_addr= [IP_address], prot= [dec]."
      https://supportforums.cisco.com/document/15966/user-receives-error-message-crypto-4-recvdpktnotipsec-recd-packet-not-ipsec-packetip
      Core issue A packet is received that matches the encryption (crypto) map access control list (ACL), but is not IPsec-encapsulated. The IPsec peer sends unencapsulated packets. This condition can be caused by a policy setup error on the peer, or it might be considered a hostile event. This error mess...

      Đặng Quang Minh, CCIEx2#11897 (Enterprise Infrastructure, Wireless), DEVNET, CCSI#31417

      Email : dangquangminh@vnpro.org
      https://www.facebook.com/groups/vietprofessional/

      Comment

      • #4
        theo như cấu hình của em ở trên thì em thấy đúng mà ta.
        lúc ping tới thì nó báo phase không thiết lập đc bị lỗi =.=

        Comment

        Previous template Next
        Working...
        X