|
Goons, A shiney plat or archives if anyone can solve this as it's rapidly driving me insane. I'm trying to set up a PIX 515 to PIX 506e IPSEC VPN. The first PIX (vpn-01) is sat in our collocated data centre (which has access to our entire 10.0.0.0 network) and the second (vpn-02) is in a remote office. The aim of the VPN is to allow the users in the remote office access to 10.0.0.0/255.0.0.0 and visa-versa. Currently it looks like this: [vpn-02] attached network 10.160.0.0 inside 10.160.2.8 outside 82.*.*.37 <-- Internet --> [vpn-01] attached network 10.0.0.0 inside 10.10.2.90 outside 192.168.10.90 (NATed from 85.*.*.72) I've been toiling with it on and off for about a week now but am pretty much stuck. I've managed to get phase 1 to complete but phase 2 stops with: "IPSEC(validate_transform_proposal): proxy identities not supported" Everything I've found related to this error points to a mismatch in the ACLs between the hub and spoke PIX's. However as it's an EasyVPN setup, as far as understand from my Cisco book and Cisco website docs, you don't set a ACL on the spoke PIX as it's unneccessary. The configs that I have are as follows: vpn-01 (collocation hub): PIX Version 6.3(5) interface ethernet0 auto interface ethernet1 auto nameif ethernet0 outside security0 nameif ethernet1 inside security100 enable password GRePyfvSUgEmkwRU encrypted passwd GRePyfvSUgEmkwRU encrypted hostname vpn-01 domain-name hoarelea.local fixup protocol dns maximum-length 512 fixup protocol ftp 21 fixup protocol h323 h225 1720 fixup protocol h323 ras 1718-1719 fixup protocol http 80 fixup protocol rsh 514 fixup protocol rtsp 554 fixup protocol sip 5060 fixup protocol sip udp 5060 fixup protocol skinny 2000 fixup protocol smtp 25 fixup protocol sqlnet 1521 fixup protocol tftp 69 names access-list remoteofficeAllowAllInternal permit ip 10.0.0.0 255.0.0.0 10.160.0.0 255.255.0.0 access-list remoteofficeAllowSplitTunnel permit ip 10.0.0.0 255.0.0.0 10.160.0.0 255.255.0.0 pager lines 24 logging on logging timestamp logging standby logging buffered informational logging trap errors logging facility 19 logging host inside *.*.*.* icmp permit any echo outside icmp permit any echo-reply outside mtu outside 1500 mtu inside 1500 ip address outside 192.168.10.90 255.255.255.0 ip address inside 10.10.2.90 255.255.255.0 ip audit info action alarm ip audit attack action alarm pdm logging informational 100 pdm history enable arp timeout 14400 route outside 0.0.0.0 0.0.0.0 192.168.10.8 2 route inside 10.0.0.0 255.0.0.0 10.10.2.8 1 timeout xlate 0:05:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00 timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00 timeout sip-disconnect 0:02:00 sip-invite 0:03:00 timeout uauth 0:05:00 absolute aaa-server TACACS+ protocol tacacs+ aaa-server TACACS+ max-failed-attempts 3 aaa-server TACACS+ deadtime 10 aaa-server RADIUS protocol radius aaa-server RADIUS max-failed-attempts 3 aaa-server RADIUS deadtime 10 aaa-server LOCAL protocol local http server enable http 10.0.0.0 255.0.0.0 inside snmp-server host inside 10.10.2.26 snmp-server location collocation no snmp-server contact snmp-server community ******* snmp-server enable traps floodguard enable sysopt connection permit-ipsec crypto ipsec transform-set remoteofficetrmset1 esp-aes-256 esp-sha-hmac crypto map map1 10 ipsec-isakmp crypto map map1 10 match address remoteofficeAllowSplitTunnel crypto map map1 10 set peer 82.*.*.37 crypto map map1 10 set transform-set remoteofficetrmset1 crypto map map1 client authentication LOCAL crypto map map1 interface outside isakmp enable outside isakmp identity address isakmp nat-traversal 10 isakmp policy 10 authentication pre-share isakmp policy 10 encryption aes-256 isakmp policy 10 hash sha isakmp policy 10 group 2 isakmp policy 10 lifetime 86400 vpngroup remoteofficegroup dns-server 10.10.2.3 vpngroup remoteofficegroup wins-server 10.10.2.3 vpngroup remoteofficegroup default-domain ******.local vpngroup remoteofficegroup idle-time 1800 vpngroup remoteofficegroup password ******** telnet 10.0.0.0 255.0.0.0 inside telnet timeout 10 ssh timeout 5 console timeout 15 username remoteoffice password DjuV6qUmVH8HCPlZ encrypted privilege 2 terminal width 80 and the remote office PIX (vpn-02 spoke): PIX Version 6.3(5) interface ethernet0 auto interface ethernet1 auto nameif ethernet0 outside security0 nameif ethernet1 inside security100 enable password GRePyfvSUgEmkwRU encrypted passwd GRePyfvSUgEmkwRU encrypted hostname vpn-02 domain-name *******.local fixup protocol dns maximum-length 512 fixup protocol ftp 21 fixup protocol h323 h225 1720 fixup protocol h323 ras 1718-1719 fixup protocol http 80 fixup protocol rsh 514 fixup protocol rtsp 554 fixup protocol sip 5060 fixup protocol sip udp 5060 fixup protocol skinny 2000 fixup protocol smtp 25 fixup protocol sqlnet 1521 fixup protocol tftp 69 names pager lines 24 mtu outside 1500 mtu inside 1500 ip address outside 82.*.*.37 255.255.255.240 ip address inside 10.160.2.8 255.255.0.0 ip audit info action alarm ip audit attack action alarm pdm history enable arp timeout 14400 global (outside) 1 interface nat (inside) 1 0.0.0.0 0.0.0.0 0 0 conduit permit icmp any any echo-reply route outside 0.0.0.0 0.0.0.0 82.*.*.33 1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00 timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00 timeout sip-disconnect 0:02:00 sip-invite 0:03:00 timeout uauth 0:05:00 absolute aaa-server TACACS+ protocol tacacs+ aaa-server TACACS+ max-failed-attempts 3 aaa-server TACACS+ deadtime 10 aaa-server RADIUS protocol radius aaa-server RADIUS max-failed-attempts 3 aaa-server RADIUS deadtime 10 aaa-server LOCAL protocol local http 10.160.0.0 255.255.0.0 inside no snmp-server location no snmp-server contact snmp-server community public no snmp-server enable traps floodguard enable telnet 10.0.0.0 255.0.0.0 inside telnet timeout 15 ssh timeout 5 console timeout 15 username remoteoffice password DjuV6qUmVH8HCPlZ encrypted privilege 2 vpnclient server 85.*.*.72 vpnclient mode network-extension-mode vpnclient vpngroup remoteofficegroup password ******** vpnclient username remoteoffice password ******** vpnclient enable terminal width 80 As mentioned, phase 1 is ok: vpn-01# sh cry isakmp sa Total : 1 Embryonic : 0 dst src state pending created 192.168.10.90 82.*.*.37 QM_IDLE 0 0 but phase two debug output is this: IPSEC(validate_proposal_request): proposal part #1, (key eng. msg.) dest= 192.168.10.90, src= 82.211.81.37, dest_proxy= 0.0.0.0/0.0.0.0/0/0 (type=4), src_proxy= 10.160.0.0/255.255.0.0/0/0 (type=4), protocol= ESP, transform= esp-aes-256 esp-sha-hmac , lifedur= 0s and 0kb, spi= 0x0(0), conn_id= 0, keysize= 256, flags= 0x400 IPSEC(validate_transform_proposal): proxy identities not supported IPSEC(validate_proposal_request): proposal part #1, (key eng. msg.) dest= 192.168.10.90, src= 82.211.81.37, dest_proxy= 10.160.0.0/255.255.0.0/0/0 (type=4), src_proxy= 0.0.0.0/0.0.0.0/0/0 (type=4), protocol= ESP, transform= esp-aes-256 esp-sha-hmac , lifedur= 0s and 0kb, spi= 0x0(0), conn_id= 0, keysize= 256, flags= 0x400 IPSEC(validate_transform_proposal): proxy identities not supported IPSEC(validate_proposal): transform proposal (prot 3, trans 12, hmac_alg 1) not supported IPSEC(validate_proposal): transform proposal (prot 3, trans 12, hmac_alg 2) not supported IPSEC(validate_proposal): transform proposal (prot 3, trans 12, hmac_alg 1) not supported IPSEC(validate_proposal): transform proposal (prot 3, trans 12, hmac_alg 2) not supported IPSEC(validate_proposal): transform proposal (prot 3, trans 12, hmac_alg 1) not supported IPSEC(validate_proposal): transform proposal (prot 3, trans 3, hmac_alg 2) not supported IPSEC(validate_proposal): transform proposal (prot 3, trans 3, hmac_alg 1) not supported IPSEC(validate_proposal): transform proposal (prot 3, trans 2, hmac_alg 1) not supported IPSEC(validate_proposal): transform proposal (prot 3, trans 11, hmac_alg 1) not supported IPSEC(validate_proposal): transform proposal (prot 3, trans 11, hmac_alg 2) not supported Apologies for all the text. I thought it best to include everything. The only thing I can think of that might be causing a problem is the fact that the outside address on vpn-01 is NATed and that the NATed address is shown in the 'sh crypto isakmp sa' output rather than the real public IP. I thought nat-traversal would take care of that though. Or perhaps it's something to do with the hub PIX being on a 10.0.0.0 /8 network which the 10.160.0.0 subnet is essentially part of. I've not been able to find any examples of people doing this - only people creating VPN tunnels between clearly defined /24's but I'd think it would work... All this is fairly new to me as I've recently been promoted in my job and had to teach myself from a Cisco book in a hurry, so any help would be greatly appreciated. I did try abandoning EasyVPN and following a LAN2LAN example but got even less far with that. Brinx fucked around with this message at 13:49 on May 29, 2007 |
#
¿
May 29, 2007 13:43
|
|
|
|
| # ¿ May 4, 2024 17:54 |
|
|
Herv posted:I do not think it would be possible to create a phase 2 sa when network 1 is a subnet of network 2. (e.g. 10.10.1.0/24 to a 10.0.0.0/8) Great, thanks. That's set me in the right direction. Phase 2 completes now so hopefully just a bit of fiddling with the routing at the far end and it'll be up and running. Appreciate the help.
|
|
#
¿
May 30, 2007 20:35
|
|