Настраиваю VPN между DI-804HV и Windows 2003 Server (контроллер домена)

Выполняю все действия по инструкции (FAQ подключение DI-804HV к клиенту Window XP).

Пробую пинговать с компьютера с Windows 2003 Server сеть за DI-804HV - отвечает постоянно Negotiating IP Security.

В логах DI-804HV пишет:

12 мая 2004 г. 4:01:20 Receive IKE Q1(QINIT) : [192.168.100.2]-->[192.168.100.10]
12 мая 2004 г. 4:01:16 SPD Error : not found [192.168.100.2]<->[192.168.1.0] from peer IP address 192.168.100.2
12 мая 2004 г. 4:01:20 Receive IKE Q1(QINIT) : [192.168.100.2]-->[192.168.100.10]
12 мая 2004 г. 4:01:20 SPD Error : not found [192.168.100.2]<->[192.168.1.0] from peer IP address 192.168.100.2
12 мая 2004 г. 4:01:28 Receive IKE Q1(QINIT) : [192.168.100.2]-->[192.168.100.10]
12 мая 2004 г. 4:01:28 SPD Error : not found [192.168.100.2]<->[192.168.1.0] from peer IP address 192.168.100.2
12 мая 2004 г. 4:01:44 Receive IKE Q1(QINIT) : [192.168.100.2]-->[192.168.100.10]
12 мая 2004 г. 4:01:44 SPD Error : not found [192.168.100.2]<->[192.168.1.0] from peer IP address 192.168.100.2


Помогите все таки поднять VPN?

Проверьте внимательно настройки туннеля. адреса сетей, гейтов, параметры обоих фаз. Особенно параметры первой фазы.

_________________
С уважением -- Александр Шебаронин.

Собственно говоря я все сделал по инструкции, и сообщение в форуме оставил после того, как неоднократно все перепроверил.

Есть ли какие-то различия между настройкой Windows 2003 server и Windows XP? Возможно проблема в том что компьютер еще и контроллер домена, т.е. поднята ActiveDirectory.

Помогите разобраться как настроить.

Сообщения из лога DI-804 я оставил на форуме.

А вот кусок лога из Windows

2-04: 12:24:12:406:4e8 Sending: SA = 0x00146248 to 192.168.100.10:Type 2.500
2-04: 12:24:12:406:4e8 ISAKMP Header: (V1.0), len = 292
2-04: 12:24:12:406:4e8 I-COOKIE 5373591d967592a0
2-04: 12:24:12:406:4e8 R-COOKIE 8096d3fc7052e978
2-04: 12:24:12:406:4e8 exchange: Oakley Quick Mode
2-04: 12:24:12:406:4e8 flags: 1 ( encrypted )
2-04: 12:24:12:406:4e8 next payload: HASH
2-04: 12:24:12:406:4e8 message ID: b60778b5
2-04: 12:24:12:406:4e8 Ports S:f401 D:f401
2-04: 12:24:44:406:4e8 retransmit exhausted: sa = 00146248 centry 000F13E8, count = 6
2-04: 12:24:44:406:4e8 Reinit in NOMM case. OakleyFlags 8
2-04: 12:24:44:406:4e8 SA Dead. sa:00146248 status:35f0
2-04: 12:24:44:406:4e8 CE Dead. sa:00146248 ce:000F13E8 status:35f0
2-04: 12:24:44:406:4e8 Data Protection Mode (Quick Mode)
2-04: 12:24:44:406:4e8 Source IP Address 192.168.100.2 Source IP Address Mask 255.255.255.255 Destination IP Address 192.168.1.0 Destination IP Address Mask 255.255.255.0 Protocol 0 Source Port 0 Destination Port 0 IKE Local Addr 192.168.100.2 IKE Peer Addr 192.168.100.10 IKE Source Port 500 IKE Destination Port 500 Peer Private Addr
2-04: 12:24:44:406:4e8 Preshared key ID. Peer IP Address: 192.168.100.10
2-04: 12:24:44:406:4e8 Me
2-04: 12:24:44:406:4e8 IKE SA deleted before establishment completed
2-04: 12:24:44:406:4e8 Processed third (ID) payload Initiator. Delta Time 63 0x0 0x0
2-04: 12:24:44:406:4e8 isadb_set_status sa:00146248 centry:000F13E8 status 35f0
2-04: 12:24:44:406:4e8 Re-initiating SA SRC=264a8c0 DST=1a8c0
2-04: 12:24:44:406:4e8 Internal Acquire: op=0000000C src=192.168.100.2.0 dst=192.168.1.0.0 proto = 0, SrcMask=255.255.255.255, DstMask=255.255.255.0, Tunnel 1, TunnelEndpt=192.168.100.10 Inbound TunnelEndpt=192.168.100.2, InitiateEvent=00000000, IKE SrcPort=500 IKE DstPort=500
2-04: 12:24:44:406:4e8 isadb_set_status sa:00146248 centry:00000000 status 35f0
2-04: 12:24:44:406:4e8 constructing ISAKMP Header
2-04: 12:24:44:406:4e8 constructing HASH (null)
2-04: 12:24:44:406:4e8 constructing DELETE. MM 00146248
2-04: 12:24:44:406:4e8 constructing HASH (Notify/Delete)
2-04: 12:24:44:406:4e8 Not setting retransmit to downlevel client. SA 00146248 Centry 00000000
2-04: 12:24:44:406:4e8
2-04: 12:24:44:406:4e8 Sending: SA = 0x00146248 to 192.168.100.10:Type 1.500
2-04: 12:24:44:406:4e8 ISAKMP Header: (V1.0), len = 84
2-04: 12:24:44:406:4e8 I-COOKIE 5373591d967592a0
2-04: 12:24:44:406:4e8 R-COOKIE 8096d3fc7052e978
2-04: 12:24:44:406:4e8 exchange: ISAKMP Informational Exchange
2-04: 12:24:44:406:4e8 flags: 1 ( encrypted )
2-04: 12:24:44:406:4e8 next payload: HASH
2-04: 12:24:44:406:4e8 message ID: 1711ff70
2-04: 12:24:44:406:4e8 Ports S:f401 D:f401
2-04: 12:24:44:406:cb0 Filter to match: Src 192.168.100.10 Dst 192.168.100.2
2-04: 12:24:44:406:cb0 MM PolicyName: 1
2-04: 12:24:44:406:cb0 MMPolicy dwFlags 2 SoftSAExpireTime 28800
2-04: 12:24:44:406:cb0 MMOffer[0] LifetimeSec 28800 QMLimit 0 DHGroup 2
2-04: 12:24:44:406:cb0 MMOffer[0] Encrypt: Triple DES CBC Hash: SHA
2-04: 12:24:44:406:cb0 MMOffer[1] LifetimeSec 28800 QMLimit 0 DHGroup 2
2-04: 12:24:44:406:cb0 MMOffer[1] Encrypt: Triple DES CBC Hash: MD5
2-04: 12:24:44:406:cb0 MMOffer[2] LifetimeSec 28800 QMLimit 0 DHGroup 1
2-04: 12:24:44:406:cb0 MMOffer[2] Encrypt: DES CBC Hash: SHA
2-04: 12:24:44:406:cb0 MMOffer[3] LifetimeSec 28800 QMLimit 0 DHGroup 1
2-04: 12:24:44:406:cb0 MMOffer[3] Encrypt: DES CBC Hash: MD5
2-04: 12:24:44:406:cb0 Auth[0]:PresharedKey KeyLen 24
2-04: 12:24:44:406:cb0 QM PolicyName: Require Security dwFlags 1
2-04: 12:24:44:406:cb0 QMOffer[0] LifetimeKBytes 100000 LifetimeSec 900
2-04: 12:24:44:406:cb0 QMOffer[0] dwFlags 0 dwPFSGroup 0
2-04: 12:24:44:406:cb0 Algo[0] Operation: ESP Algo: Triple DES CBC HMAC: SHA
2-04: 12:24:44:406:cb0 QMOffer[1] LifetimeKBytes 100000 LifetimeSec 900
2-04: 12:24:44:406:cb0 QMOffer[1] dwFlags 0 dwPFSGroup 0
2-04: 12:24:44:406:cb0 Algo[0] Operation: ESP Algo: Triple DES CBC HMAC: MD5
2-04: 12:24:44:406:cb0 QMOffer[2] LifetimeKBytes 100000 LifetimeSec 900
2-04: 12:24:44:406:cb0 QMOffer[2] dwFlags 0 dwPFSGroup 0
2-04: 12:24:44:406:cb0 Algo[0] Operation: ESP Algo: DES CBC HMAC: SHA
2-04: 12:24:44:406:cb0 QMOffer[3] LifetimeKBytes 100000 LifetimeSec 900
2-04: 12:24:44:406:cb0 QMOffer[3] dwFlags 0 dwPFSGroup 0
2-04: 12:24:44:406:cb0 Algo[0] Operation: ESP Algo: DES CBC HMAC: MD5
2-04: 12:24:44:406:cb0 Starting Negotiation: src = 192.168.100.2.0500, dst = 192.168.100.10.0500, proto = 00, context = 0000000C, ProxySrc = 192.168.100.2.0000, ProxyDst = 192.168.1.0.0000 SrcMask = 255.255.255.255 DstMask = 255.255.255.0
2-04: 12:24:44:406:cb0 constructing ISAKMP Header
2-04: 12:24:44:406:cb0 constructing SA (ISAKMP)
2-04: 12:24:44:406:cb0 Constructing Vendor MS NT5 ISAKMPOAKLEY
2-04: 12:24:44:406:cb0 Constructing Vendor FRAGMENTATION
2-04: 12:24:44:406:cb0 Constructing Vendor draft-ietf-ipsec-nat-t-ike-02
2-04: 12:24:44:406:cb0
2-04: 12:24:44:406:cb0 Sending: SA = 0x00145810 to 192.168.100.10:Type 2.500
2-04: 12:24:44:406:cb0 ISAKMP Header: (V1.0), len = 256
2-04: 12:24:44:406:cb0 I-COOKIE 074c8b45caca76b3
2-04: 12:24:44:406:cb0 R-COOKIE 0000000000000000
2-04: 12:24:44:406:cb0 exchange: Oakley Main Mode
2-04: 12:24:44:406:cb0 flags: 0
2-04: 12:24:44:406:cb0 next payload: SA
2-04: 12:24:44:406:cb0 message ID: 00000000
2-04: 12:24:44:406:cb0 Ports S:f401 D:f401
2-04: 12:24:44:593:cb0
2-04: 12:24:44:593:cb0 Receive: (get) SA = 0x00145810 from 192.168.100.10.500
2-04: 12:24:44:593:cb0 ISAKMP Header: (V1.0), len = 84
2-04: 12:24:44:593:cb0 I-COOKIE 074c8b45caca76b3
2-04: 12:24:44:593:cb0 R-COOKIE 4e415b6c62a5529d
2-04: 12:24:44:593:cb0 exchange: Oakley Main Mode
2-04: 12:24:44:593:cb0 flags: 0
2-04: 12:24:44:593:cb0 next payload: SA
2-04: 12:24:44:593:cb0 message ID: 00000000
2-04: 12:24:44:593:cb0 processing payload SA
2-04: 12:24:44:593:cb0 Received Phase 1 Transform 1
2-04: 12:24:44:593:cb0 Encryption Alg Triple DES CBC(5)
2-04: 12:24:44:593:cb0 Hash Alg SHA(2)
2-04: 12:24:44:593:cb0 Auth Method Preshared Key(1)
2-04: 12:24:44:593:cb0 Oakley Group 2
2-04: 12:24:44:593:cb0 Life type in Seconds
2-04: 12:24:44:593:cb0 Life duration of 28800
2-04: 12:24:44:593:cb0 Phase 1 SA accepted: transform=1
2-04: 12:24:44:593:cb0 SA - Oakley proposal accepted
2-04: 12:24:44:593:cb0 ClearFragList
2-04: 12:24:44:593:cb0 constructing ISAKMP Header
2-04: 12:24:44:625:cb0 constructing KE
2-04: 12:24:44:625:cb0 constructing NONCE (ISAKMP)
2-04: 12:24:44:625:cb0
2-04: 12:24:44:625:cb0 Sending: SA = 0x00145810 to 192.168.100.10:Type 2.500
2-04: 12:24:44:625:cb0 ISAKMP Header: (V1.0), len = 184
2-04: 12:24:44:625:cb0 I-COOKIE 074c8b45caca76b3
2-04: 12:24:44:625:cb0 R-COOKIE 4e415b6c62a5529d
2-04: 12:24:44:625:cb0 exchange: Oakley Main Mode
2-04: 12:24:44:625:cb0 flags: 0
2-04: 12:24:44:625:cb0 next payload: KE
2-04: 12:24:44:625:cb0 message ID: 00000000
2-04: 12:24:44:625:cb0 Ports S:f401 D:f401
2-04: 12:24:44:671:cb0
2-04: 12:24:44:671:cb0 Receive: (get) SA = 0x00145810 from 192.168.100.10.500
2-04: 12:24:44:671:cb0 ISAKMP Header: (V1.0), len = 184
2-04: 12:24:44:671:cb0 I-COOKIE 074c8b45caca76b3
2-04: 12:24:44:671:cb0 R-COOKIE 4e415b6c62a5529d
2-04: 12:24:44:671:cb0 exchange: Oakley Main Mode
2-04: 12:24:44:671:cb0 flags: 0
2-04: 12:24:44:671:cb0 next payload: KE
2-04: 12:24:44:671:cb0 message ID: 00000000
2-04: 12:24:44:671:cb0 processing payload KE
2-04: 12:24:44:687:cb0 processing payload NONCE
2-04: 12:24:44:687:cb0 ClearFragList
2-04: 12:24:44:687:cb0 constructing ISAKMP Header
2-04: 12:24:44:687:cb0 constructing ID
2-04: 12:24:44:687:cb0 MM ID Type 1
2-04: 12:24:44:687:cb0 MM ID c0a86402
2-04: 12:24:44:687:cb0 constructing HASH
2-04: 12:24:44:687:cb0
2-04: 12:24:44:687:cb0 Sending: SA = 0x00145810 to 192.168.100.10:Type 2.500
2-04: 12:24:44:687:cb0 ISAKMP Header: (V1.0), len = 68
2-04: 12:24:44:687:cb0 I-COOKIE 074c8b45caca76b3
2-04: 12:24:44:687:cb0 R-COOKIE 4e415b6c62a5529d
2-04: 12:24:44:687:cb0 exchange: Oakley Main Mode
2-04: 12:24:44:687:cb0 flags: 1 ( encrypted )
2-04: 12:24:44:687:cb0 next payload: ID
2-04: 12:24:44:687:cb0 message ID: 00000000
2-04: 12:24:44:687:cb0 Ports S:f401 D:f401
2-04: 12:24:44:875:cb0
2-04: 12:24:44:875:cb0 Receive: (get) SA = 0x00145810 from 192.168.100.10.500
2-04: 12:24:44:875:cb0 ISAKMP Header: (V1.0), len = 68
2-04: 12:24:44:875:cb0 I-COOKIE 074c8b45caca76b3
2-04: 12:24:44:875:cb0 R-COOKIE 4e415b6c62a5529d
2-04: 12:24:44:875:cb0 exchange: Oakley Main Mode
2-04: 12:24:44:875:cb0 flags: 1 ( encrypted )
2-04: 12:24:44:875:cb0 next payload: ID
2-04: 12:24:44:875:cb0 message ID: 00000000
2-04: 12:24:44:875:cb0 processing payload ID
2-04: 12:24:44:875:cb0 processing payload HASH
2-04: 12:24:44:875:cb0 AUTH: Phase I authentication accepted
2-04: 12:24:44:875:cb0 ClearFragList
2-04: 12:24:44:875:cb0 MM established. SA: 00145810
2-04: 12:24:44:875:cb0 QM PolicyName: Require Security dwFlags 1
2-04: 12:24:44:875:cb0 QMOffer[0] LifetimeKBytes 100000 LifetimeSec 900
2-04: 12:24:44:875:cb0 QMOffer[0] dwFlags 0 dwPFSGroup 0
2-04: 12:24:44:875:cb0 Algo[0] Operation: ESP Algo: Triple DES CBC HMAC: SHA
2-04: 12:24:44:875:cb0 QMOffer[1] LifetimeKBytes 100000 LifetimeSec 900
2-04: 12:24:44:875:cb0 QMOffer[1] dwFlags 0 dwPFSGroup 0
2-04: 12:24:44:875:cb0 Algo[0] Operation: ESP Algo: Triple DES CBC HMAC: MD5
2-04: 12:24:44:875:cb0 QMOffer[2] LifetimeKBytes 100000 LifetimeSec 900
2-04: 12:24:44:875:cb0 QMOffer[2] dwFlags 0 dwPFSGroup 0
2-04: 12:24:44:875:cb0 Algo[0] Operation: ESP Algo: DES CBC HMAC: SHA
2-04: 12:24:44:875:cb0 QMOffer[3] LifetimeKBytes 100000 LifetimeSec 900
2-04: 12:24:44:875:cb0 QMOffer[3] dwFlags 0 dwPFSGroup 0
2-04: 12:24:44:875:cb0 Algo[0] Operation: ESP Algo: DES CBC HMAC: MD5
2-04: 12:24:44:890:cb0 GetSpi: src = 192.168.1.0.0000, dst = 192.168.100.2.0000, proto = 00, context = 0000000C, srcMask = 255.255.255.0, destMask = 255.255.255.255, TunnelFilter 1
2-04: 12:24:44:890:cb0 Setting SPI 1188301875
2-04: 12:24:44:890:cb0 constructing ISAKMP Header
2-04: 12:24:44:890:cb0 constructing HASH (null)
2-04: 12:24:44:890:cb0 constructing SA (IPSEC)
2-04: 12:24:44:890:cb0 constructing NONCE (IPSEC)
2-04: 12:24:44:890:cb0 constructing ID (proxy)
2-04: 12:24:44:890:cb0 constructing ID (proxy)
2-04: 12:24:44:890:cb0 constructing HASH (QM)
2-04: 12:24:44:890:cb0
2-04: 12:24:44:890:cb0 Sending: SA = 0x00145810 to 192.168.100.10:Type 2.500
2-04: 12:24:44:890:cb0 ISAKMP Header: (V1.0), len = 292
2-04: 12:24:44:890:cb0 I-COOKIE 074c8b45caca76b3
2-04: 12:24:44:890:cb0 R-COOKIE 4e415b6c62a5529d
2-04: 12:24:44:890:cb0 exchange: Oakley Quick Mode
2-04: 12:24:44:890:cb0 flags: 1 ( encrypted )
2-04: 12:24:44:890:cb0 next payload: HASH
2-04: 12:24:44:890:cb0 message ID: 0aab18e7
2-04: 12:24:44:890:cb0 Ports S:f401 D:f401
2-04: 12:24:45:406:4e8 retransmit: sa = 00145810 centry 000F1040 , count = 1
2-04: 12:24:45:406:4e8
2-04: 12:24:45:406:4e8 Sending: SA = 0x00145810 to 192.168.100.10:Type 2.500
2-04: 12:24:45:406:4e8 ISAKMP Header: (V1.0), len = 292
2-04: 12:24:45:406:4e8 I-COOKIE 074c8b45caca76b3
2-04: 12:24:45:406:4e8 R-COOKIE 4e415b6c62a5529d
2-04: 12:24:45:406:4e8 exchange: Oakley Quick Mode
2-04: 12:24:45:406:4e8 flags: 1 ( encrypted )
2-04: 12:24:45:406:4e8 next payload: HASH
2-04: 12:24:45:406:4e8 message ID: 0aab18e7
2-04: 12:24:45:406:4e8 Ports S:f401 D:f401
2-04: 12:24:47:406:4e8 retransmit: sa = 00145810 centry 000F1040 , count = 2
2-04: 12:24:47:406:4e8
2-04: 12:24:47:406:4e8 Sending: SA = 0x00145810 to 192.168.100.10:Type 2.500
2-04: 12:24:47:406:4e8 ISAKMP Header: (V1.0), len = 292
2-04: 12:24:47:406:4e8 I-COOKIE 074c8b45caca76b3
2-04: 12:24:47:406:4e8 R-COOKIE 4e415b6c62a5529d
2-04: 12:24:47:406:4e8 exchange: Oakley Quick Mode
2-04: 12:24:47:406:4e8 flags: 1 ( encrypted )
2-04: 12:24:47:406:4e8 next payload: HASH
2-04: 12:24:47:406:4e8 message ID: 0aab18e7
2-04: 12:24:47:406:4e8 Ports S:f401 D:f401
2-04: 12:24:48:546:cb0 ClearFragList
2-04: 12:24:51:406:4e8 retransmit: sa = 00145810 centry 000F1040 , count = 3
2-04: 12:24:51:406:4e8
2-04: 12:24:51:406:4e8 Sending: SA = 0x00145810 to 192.168.100.10:Type 2.500
2-04: 12:24:51:406:4e8 ISAKMP Header: (V1.0), len = 292
2-04: 12:24:51:406:4e8 I-COOKIE 074c8b45caca76b3
2-04: 12:24:51:406:4e8 R-COOKIE 4e415b6c62a5529d
2-04: 12:24:51:406:4e8 exchange: Oakley Quick Mode
2-04: 12:24:51:406:4e8 flags: 1 ( encrypted )
2-04: 12:24:51:406:4e8 next payload: HASH
2-04: 12:24:51:406:4e8 message ID: 0aab18e7
2-04: 12:24:51:406:4e8 Ports S:f401 D:f401
2-04: 12:24:59:406:4e8 retransmit: sa = 00145810 centry 000F1040 , count = 4
2-04: 12:24:59:406:4e8
2-04: 12:24:59:406:4e8 Sending: SA = 0x00145810 to 192.168.100.10:Type 2.500
2-04: 12:24:59:406:4e8 ISAKMP Header: (V1.0), len = 292
2-04: 12:24:59:406:4e8 I-COOKIE 074c8b45caca76b3
2-04: 12:24:59:406:4e8 R-COOKIE 4e415b6c62a5529d
2-04: 12:24:59:406:4e8 exchange: Oakley Quick Mode
2-04: 12:24:59:406:4e8 flags: 1 ( encrypted )
2-04: 12:24:59:406:4e8 next payload: HASH
2-04: 12:24:59:406:4e8 message ID: 0aab18e7
2-04: 12:24:59:406:4e8 Ports S:f401 D:f401
2-04: 12:25:15:406:4e8 retransmit: sa = 00145810 centry 000F1040 , count = 5
2-04: 12:25:15:406:4e8
2-04: 12:25:15:406:4e8 Sending: SA = 0x00145810 to 192.168.100.10:Type 2.500
2-04: 12:25:15:406:4e8 ISAKMP Header: (V1.0), len = 292
2-04: 12:25:15:406:4e8 I-COOKIE 074c8b45caca76b3
2-04: 12:25:15:406:4e8 R-COOKIE 4e415b6c62a5529d
2-04: 12:25:15:406:4e8 exchange: Oakley Quick Mode
2-04: 12:25:15:406:4e8 flags: 1 ( encrypted )
2-04: 12:25:15:406:4e8 next payload: HASH
2-04: 12:25:15:406:4e8 message ID: 0aab18e7
2-04: 12:25:15:406:4e8 Ports S:f401 D:f401
2-04: 12:25:41:828:4e0 Acquire from driver: op=0000000D src=192.168.100.2.0 dst=192.168.1.254.0 proto = 0, SrcMask=255.255.255.255, DstMask=255.255.255.0, Tunnel 1, TunnelEndpt=192.168.100.10 Inbound TunnelEndpt=192.168.100.2
2-04: 12:25:41:828:cb0 Starting Negotiation: src = 192.168.100.2.0500, dst = 192.168.100.10.0500, proto = 00, context = 0000000D, ProxySrc = 192.168.100.2.0000, ProxyDst = 192.168.1.0.0000 SrcMask = 255.255.255.255 DstMask = 255.255.255.0
2-04: 12:25:41:828:cb0 QM PolicyName: Require Security dwFlags 1
2-04: 12:25:41:828:cb0 QMOffer[0] LifetimeKBytes 100000 LifetimeSec 900
2-04: 12:25:41:828:cb0 QMOffer[0] dwFlags 0 dwPFSGroup 0
2-04: 12:25:41:828:cb0 Algo[0] Operation: ESP Algo: Triple DES CBC HMAC: SHA
2-04: 12:25:41:828:cb0 QMOffer[1] LifetimeKBytes 100000 LifetimeSec 900
2-04: 12:25:41:828:cb0 QMOffer[1] dwFlags 0 dwPFSGroup 0
2-04: 12:25:41:828:cb0 Algo[0] Operation: ESP Algo: Triple DES CBC HMAC: MD5
2-04: 12:25:41:828:cb0 QMOffer[2] LifetimeKBytes 100000 LifetimeSec 900
2-04: 12:25:41:828:cb0 QMOffer[2] dwFlags 0 dwPFSGroup 0
2-04: 12:25:41:828:cb0 Algo[0] Operation: ESP Algo: DES CBC HMAC: SHA
2-04: 12:25:41:828:cb0 QMOffer[3] LifetimeKBytes 100000 LifetimeSec 900
2-04: 12:25:41:828:cb0 QMOffer[3] dwFlags 0 dwPFSGroup 0
2-04: 12:25:41:828:cb0 Algo[0] Operation: ESP Algo: DES CBC HMAC: MD5
2-04: 12:25:41:828:cb0 GetSpi: src = 192.168.1.0.0000, dst = 192.168.100.2.0000, proto = 00, context = 0000000D, srcMask = 255.255.255.0, destMask = 255.255.255.255, TunnelFilter 1
2-04: 12:25:41:828:cb0 Setting SPI 1306174866
2-04: 12:25:41:828:cb0 constructing ISAKMP Header
2-04: 12:25:41:828:cb0 constructing HASH (null)
2-04: 12:25:41:828:cb0 constructing SA (IPSEC)
2-04: 12:25:41:828:cb0 constructing NONCE (IPSEC)
2-04: 12:25:41:828:cb0 constructing ID (proxy)
2-04: 12:25:41:828:cb0 constructing ID (proxy)
2-04: 12:25:41:828:cb0 constructing HASH (QM)
2-04: 12:25:41:828:cb0
2-04: 12:25:41:828:cb0 Sending: SA = 0x00145810 to 192.168.100.10:Type 2.500
2-04: 12:25:41:828:cb0 ISAKMP Header: (V1.0), len = 292
2-04: 12:25:41:828:cb0 I-COOKIE 074c8b45caca76b3
2-04: 12:25:41:828:cb0 R-COOKIE 4e415b6c62a5529d
2-04: 12:25:41:828:cb0 exchange: Oakley Quick Mode
2-04: 12:25:41:828:cb0 flags: 1 ( encrypted )
2-04: 12:25:41:828:cb0 next payload: HASH
2-04: 12:25:41:828:cb0 message ID: 86dff418
2-04: 12:25:41:828:cb0 Ports S:f401 D:f401
2-04: 12:25:42:406:4e8 retransmit: sa = 00145810 centry 000F0F08 , count = 1
2-04: 12:25:42:406:4e8
2-04: 12:25:42:406:4e8 Sending: SA = 0x00145810 to 192.168.100.10:Type 2.500
2-04: 12:25:42:406:4e8 ISAKMP Header: (V1.0), len = 292
2-04: 12:25:42:406:4e8 I-COOKIE 074c8b45caca76b3
2-04: 12:25:42:406:4e8 R-COOKIE 4e415b6c62a5529d
2-04: 12:25:42:406:4e8 exchange: Oakley Quick Mode
2-04: 12:25:42:406:4e8 flags: 1 ( encrypted )
2-04: 12:25:42:406:4e8 next payload: HASH
2-04: 12:25:42:406:4e8 message ID: 86dff418
2-04: 12:25:42:406:4e8 Ports S:f401 D:f401
2-04: 12:25:44:406:4e8 retransmit: sa = 00145810 centry 000F0F08 , count = 2
2-04: 12:25:44:406:4e8
2-04: 12:25:44:406:4e8 Sending: SA = 0x00145810 to 192.168.100.10:Type 2.500
2-04: 12:25:44:406:4e8 ISAKMP Header: (V1.0), len = 292
2-04: 12:25:44:406:4e8 I-COOKIE 074c8b45caca76b3
2-04: 12:25:44:406:4e8 R-COOKIE 4e415b6c62a5529d
2-04: 12:25:44:406:4e8 exchange: Oakley Quick Mode
2-04: 12:25:44:406:4e8 flags: 1 ( encrypted )
2-04: 12:25:44:406:4e8 next payload: HASH
2-04: 12:25:44:406:4e8 message ID: 86dff418
2-04: 12:25:44:406:4e8 Ports S:f401 D:f401
2-04: 12:25:47:406:4e8 retransmit exhausted: sa = 00145810 centry 000F1040, count = 6
2-04: 12:25:47:406:4e8 Data Protection Mode (Quick Mode)
2-04: 12:25:47:406:4e8 Source IP Address 192.168.100.2 Source IP Address Mask 255.255.255.255 Destination IP Address 192.168.1.0 Destination IP Address Mask 255.255.255.0 Protocol 0 Source Port 0 Destination Port 0 IKE Local Addr 192.168.100.2 IKE Peer Addr 192.168.100.10 IKE Source Port 500 IKE Destination Port 500 Peer Private Addr
2-04: 12:25:47:406:4e8 Preshared key ID. Peer IP Address: 192.168.100.10
2-04: 12:25:47:406:4e8 Me
2-04: 12:25:47:406:4e8 Negotiation timed out
2-04: 12:25:47:406:4e8 Processed third (ID) payload Initiator(Internal). Delta Time 63 0x0 0x0
2-04: 12:25:47:406:4e8 isadb_set_status sa:00145810 centry:000F1040 status 35ed
2-04: 12:25:48:406:4e8 retransmit: sa = 00145810 centry 000F0F08 , count = 3
2-04: 12:25:48:406:4e8
2-04: 12:25:48:406:4e8 Sending: SA = 0x00145810 to 192.168.100.10:Type 2.500
2-04: 12:25:48:406:4e8 ISAKMP Header: (V1.0), len = 292
2-04: 12:25:48:406:4e8 I-COOKIE 074c8b45caca76b3
2-04: 12:25:48:406:4e8 R-COOKIE 4e415b6c62a5529d
2-04: 12:25:48:406:4e8 exchange: Oakley Quick Mode
2-04: 12:25:48:406:4e8 flags: 1 ( encrypted )
2-04: 12:25:48:406:4e8 next payload: HASH
2-04: 12:25:48:406:4e8 message ID: 86dff418
2-04: 12:25:48:406:4e8 Ports S:f401 D:f401
2-04: 12:25:56:406:4e8 retransmit: sa = 00145810 centry 000F0F08 , count = 4
2-04: 12:25:56:406:4e8
2-04: 12:25:56:406:4e8 Sending: SA = 0x00145810 to 192.168.100.10:Type 2.500
2-04: 12:25:56:406:4e8 ISAKMP Header: (V1.0), len = 292
2-04: 12:25:56:406:4e8 I-COOKIE 074c8b45caca76b3
2-04: 12:25:56:406:4e8 R-COOKIE 4e415b6c62a5529d
2-04: 12:25:56:406:4e8 exchange: Oakley Quick Mode
2-04: 12:25:56:406:4e8 flags: 1 ( encrypted )
2-04: 12:25:56:406:4e8 next payload: HASH
2-04: 12:25:56:406:4e8 message ID: 86dff418
2-04: 12:25:56:406:4e8 Ports S:f401 D:f401

боюсь, Вам все же не сюда, а к ребятам из Microsoft

_________________
С уважением, Карагезов Владислав

В общем канал теперь поднимается, DI-804 пишит состояние IKE established, тип тунеля ESP. Проблема была в том, что на сервере был еще один интерфейс, с другой подсетью.

Однако пинги не проходят. При попытке пинговать тунель поднимается, однако пинг пишет превышен интервал ожидания.

Судя по логу в сетевом мониторе Windows 2003 покеты пробегают только в одну сторону на том интерфесе, после которого стоит DI-804. т.е. после того как тунель поднялся, пакеты от Windows к DI-804HV идет, а отклика на них нет никакого

В логах DI-804 пишет

16 мая 2004 г. 0:45:15 Try to match with MODE:Tunnel PROTOCAL:ESP-3DES AUTH:SHA1 HASH:Others PFS(Group):Others
16 мая 2004 г. 0:45:15 Try to match with MODE:Tunnel PROTOCAL:ESP-3DES AUTH:MD5 HASH:Others PFS(Group):Others
16 мая 2004 г. 0:45:15 IKE Q1 : 192.168.100.2 -> 192.168.1.0 no pfs support
16 мая 2004 г. 0:45:15 Send IKE Q2(QRESP) : 192.168.1.0 --> 192.168.100.2
16 мая 2004 г. 0:45:18 IKE phase2 (IPSec SA) remove : 192.168.1.0 <-> 192.168.0.0
16 мая 2004 г. 0:45:18 inbound SPI = 0x73020010, outbound SPI = 0x0
16 мая 2004 г. 0:45:20 Receive IKE Q3(QHASH) : [192.168.100.2|192.168.100.2]-->[192.168.100.10|192.168.1.0]
16 мая 2004 г. 0:45:20 IKE Phase2 (IPSEC SA) established : [192.168.100.2|192.168.100.2]<->[192.168.100.10|192.168.1.0]
16 мая 2004 г. 0:45:20 inbound SPI = 0x75020010, outbound SPI = 0x3b93720
16 мая 2004 г. 0:47:33 Send IKE Q1(QINIT) : 192.168.1.0 --> 192.168.0.0
16 мая 2004 г. 0:48:24 IKE phase2 (IPSec SA) remove : 192.168.1.0 <-> 192.168.0.0
16 мая 2004 г. 0:48:24 inbound SPI = 0x76020010, outbound SPI = 0x0
16 мая 2004 г. 0:48:25 Send IKE Q1(QINIT) : 192.168.1.0 --> 192.168.0.0
16 мая 2004 г. 0:49:16 Send IKE (INFO) : 192.168.100.10 --> 192.168.100.2
16 мая 2004 г. 0:49:16 IKE phase2 (IPSec SA) remove : 192.168.1.0 <-> 192.168.0.0
16 мая 2004 г. 0:49:16 inbound SPI = 0x77020010, outbound SPI = 0x0

Пять копеек: Chap

MS Chap не поддерживается. Как и версия 2.

_________________


"Вы хотите поставить нас в тупик своими вопросами? А мы поставим Вас в тупик своими ответами!"

Мимо кассы
Речь идёт об IPSec, там этого просто нет.

Может прошивку залить. Там стоит 1.37.

Однако два DI-804HV таких же между собой вяжуться.

Блин, захотел клиенту денег сэкономить - мол в центральном офисе можно терминировать виндой, теперь парюсь.

Кто знает как отключить PFS. А то в логах DI-804HV пишет:

16 мая 2004 г. 4:41:06 IKE Q1 : 192.168.0.0 -> 192.168.1.0 no pfs support


Вообще это на стороне Windows иди DI-804HV проблема?

на DI-804HV PFS задается в установках DH Group на IPSec proposal

_________________
С уважением, Карагезов Владислав

В общем проблему я решил.

В сегменте сети, к которой был подключен WAN-интерфейс сервера Windows 2003 было два маршрутизатора. Один - маршрутизатор по умолчанию, другой маршрутизатор для заданной сети. В общем на уровне IPSec были проигнорированы настройки маршрутизации, выполненные из командной строки командой route add и все пакети валились на маршрутизатор по умолчанию, а не на тот, на который было нужно.