Помогите поднять VPN Через нат провайдера.
Имеем:
DI-804 c серым IP
(Firmware Version: V1.44, Fri, Nov 24 2006)
DFL - 800 белый IP
Firmware Version: 2.20.01.05-4840
Feb 8 2008

Настройки DI-804
VPN : Enabl
Max.tun: 2
Tunnel Name: gate61
Aggressive Mode: Disable
Local Subnet 192.168.61.0
Local Netmask 255.255.255.0
Remote Subnet 192.168.1.0
Remote Netmask 255.255.255.0
Remote Gateway 83.xxx.xxx.xxx
Preshare Key 1234567890
IPSec NAT Traversal Enable
Auto-reconnect Enable
Remote ID Type IP
Local ID Type IP
IKE Proporsal: Group2, 3DES, MD5, 28800 sec
IPSec Proporsal: DH None, ESP,3des,MD5, 3600 sec

Настройки DFL-800

Local Network: lannet
Remote Network:all-nets
Remote Endpoint: (None)

Encapsulation Mode: Tunnel

IKE Config Mode: None

Algorithms

IKE Algorithms:Medium
IKE Life Time seconds 28880

IPsec Algorithms: Medium
IPsec Life Time seconds 3660
IPsec Life Time kilobytes 0

Authentication
Pre-shared Key:1234567890
Local ID Type: Auto

XAutch: off

Routing
Dynamically add route to the remote network when a tunnel is established
Automatically pick the address of a local interface that corresponds to the local net

Main
DH Group 2
Aggressive off

Perfect Forward Secrecy NONE

Security Association:Per Net

NAT Traversa
On if supported and NATed

Dead Peer Detection off

Automatically add route for remote network: ON

======
В логах DFL
2009-07-20
14:38:30 Info IPSEC
1802708


ike_sa_destroyed
ike_sa_killed
ike_sa=" Initiator SPI ESP=0x03396744, AH=0xd3c6f9fc, IPComp=0x827a322"
2009-07-20
14:38:30 Warning IPSEC
1802022


ike_sa_failed
no_ike_sa
statusmsg="No proposal chosen" local_peer="83.xxx.xxx.xxx ID No Id" remote_peer="77.66.163.145 ID No Id" initiator_spi="ESP=0x03396744, AH=0xd3c6f9fc, IPComp=0x827a322f"
2009-07-20
14:38:30 Warning IPSEC
1802715


event_on_ike_sa

side=Responder msg="failed" int_severity=6
2009-07-20
14:38:30 Warning IPSEC
1800107


ike_invalid_proposal

local_ip=83.xxx.xxx.xxx remote_ip=77.66.163.145 cookies=03396744d3c6f9fc827a322f9ae7e839 reason="Could not find acceptable proposal"
2009-07-20
14:38:30 Notice IPSEC
1802300


rule_selection_failed

info="Peer IP address mismatch" int_severity=6
2009-07-20
14:38:30 Info IPSEC
1803001


failed_to_select_policy_rule


2009-07-20
14:38:30 Warning IPSEC
1802715


event_on_ike_sa

side=Responder msg="failed" int_severity=6
=============
В логах DI

14:47:45 IKED re-TX : INIT to 83.xxx.xxx.xxx
14:47:45 Receive IKE INFO : 83.xxx.xx.xxx --> 77.66.163.145
14:47:55 IKED re-TX : INIT to 83.xxx.xxx.xxx
14:47:55 Receive IKE INFO : 83.xxx.xxx.xxx --> 77.66.163.145
14:48:15 IKED re-TX : INIT to 83.xxx.xxx.xxx
14:48:15 Receive IKE INFO : 83.xxx.xxx.xxx --> 77.66.163.145
14:48:16 Send IKE (INFO) : delete 77.66.163.145 -> 83.xxx.xxx.xxx phase 1
14:48:16 IKE phase1 (ISAKMP SA) remove : 77.66.163.145 <-> 83.xxx.xxx.xxx
==========================================
Тунель не понднимается

Что у меня в настройках не так? чего не докрутил?

обновление прошивкм на 804 до Firmware Version: V1.51b10, Fri, Mar 27 2009
не решает проблему

Меня смущает для начала это несоответствие:

На DFL:


На DI-804:



И прошивку для DFL обновите до последней 2.25

_________________
DFL-860E (10.22.01.04), DFL-210 (2.27.08.03-22678), DGS-1210-20/ME/B1A (7-03-B043), DGS-3200-10 (2.21.B018), DES-3200-10 (4.38.B012), DWL-2100AP (250eu-rc358), DNS-323 (1.10), DI-824VUP (1.06b21), DSL-300T (2.00B01T01.EU.20071227)

3600
и
28800
соответственно

прошивку DFL обновил
картина всё таже и так же

А почему на DFL Remote Endpoint: (None) ?

динамический от того и ноне - здесь этот параметр обсуждался где-то ранее

А вы замените его на что-нибудь поприличнее, например all-nets.
А None означает, что второго конца туннеля у вас нет. Вообще.

ага пытаюсь поменять - вот тока после обновления не сохраняет конфигурацию... бьюсьтеперь и с этим...

800-тый перепрошил на раннюю версию.
на ди804 заново пересоздал правила.. с нуля...
помогло - стал ругаться на ике кешь.

вылечилось созданием короткого ключа до 8-ми символов.
до этого длина была в 22 символа - не понимали друг друга....
тему закрываем

Во первых при динимическом IPSec Automatically add route for remote network: надо отключать, впротивном случае у вас интерфейс IPSec станет маршрутом по умолчанию.

Во вторых, в DFL есть механизм ikesnoop доступный по ssh или консоли, задействуйте его и приведите вывод сюда.

_________________
Сообщения в PM игнорируются, задавайте вопросы на форуме.

то что вчера запустилось сегодня в ночь на отрез отказалось работать.
конфигурация не менялась.
всего 3 тунеля. последний динамический.
через некоторое время всё опять восстановилось

запрошенный вывод прилагается
вывод идёт в основном от соединения с di-lb604...с которым вроде всё нормально было

Ike snooping is active; snooping address *

2009-07-22 02:09:23: IkeSnoop: Received IKE packet from 85.175.133.31:500
Exchange type : Informational
Payloads:
HASH (Hash)
D (Delete)

2009-07-22 02:09:23: IkeSnoop: Received IKE packet from 85.175.133.31:500
Exchange type : Informational
Payloads:
HASH (Hash)
D (Delete)

2009-07-22 02:09:26: IkeSnoop: Received IKE packet from 85.175.133.31:500
Exchange type : Identity Protection (main mode)
Payloads:
SA (Security Association)

2009-07-22 02:09:26: IkeSnoop: Sending IKE packet to 85.175.133.31:500
Exchange type : Identity Protection (main mode)
Payloads:
SA (Security Association)
VID (Vendor ID)
VID (Vendor ID)
VID (Vendor ID)
VID (Vendor ID)
VID (Vendor ID)
VID (Vendor ID)
VID (Vendor ID)
VID (Vendor ID)
VID (Vendor ID)

2009-07-22 02:09:26: IkeSnoop: Received IKE packet from 85.175.133.31:500
Exchange type : Identity Protection (main mode)
Payloads:
KE (Key Exchange)
NONCE (Nonce)

2009-07-22 02:09:26: IkeSnoop: Sending IKE packet to 85.175.133.31:500
Exchange type : Identity Protection (main mode)
Payloads:
KE (Key Exchange)
NONCE (Nonce)

2009-07-22 02:09:26: IkeSnoop: Received IKE packet from 85.175.133.31:500
Exchange type : Identity Protection (main mode)
Payloads:
ID (Identification)
HASH (Hash)

2009-07-22 02:09:26: IkeSnoop: Sending IKE packet to 85.175.133.31:500
Exchange type : Identity Protection (main mode)
Payloads:
ID (Identification)
HASH (Hash)

2009-07-22 02:09:27: IkeSnoop: Received IKE packet from 85.175.133.31:500
Exchange type : Quick mode
Payloads:
HASH (Hash)
SA (Security Association)
NONCE (Nonce)
KE (Key Exchange)
ID (Identification)
ID (Identification)

2009-07-22 02:09:27: IkeSnoop: Sending IKE packet to 85.175.133.31:500
Exchange type : Quick mode
Payloads:
HASH (Hash)
SA (Security Association)
NONCE (Nonce)
KE (Key Exchange)
ID (Identification)
ID (Identification)

2009-07-22 02:09:27: IkeSnoop: Received IKE packet from 85.175.133.31:500
Exchange type : Quick mode
Payloads:
HASH (Hash)
2009-07-22 02:12:18: IkeSnoop: Received IKE packet from 85.175.133.31:500
Exchange type : Informational
Payloads:
HASH (Hash)
D (Delete)

2009-07-22 02:12:18: IkeSnoop: Received IKE packet from 85.175.133.31:500
Exchange type : Informational
Payloads:
HASH (Hash)
D (Delete)

2009-07-22 02:12:21: IkeSnoop: Received IKE packet from 85.175.133.31:500
Exchange type : Identity Protection (main mode)
Payloads:
SA (Security Association)

2009-07-22 02:12:21: IkeSnoop: Sending IKE packet to 85.175.133.31:500
Exchange type : Identity Protection (main mode)
Payloads:
SA (Security Association)
VID (Vendor ID)
VID (Vendor ID)
VID (Vendor ID)
VID (Vendor ID)
VID (Vendor ID)
VID (Vendor ID)
VID (Vendor ID)
VID (Vendor ID)
VID (Vendor ID)

2009-07-22 02:12:21: IkeSnoop: Received IKE packet from 85.175.133.31:500
Exchange type : Identity Protection (main mode)
Payloads:
KE (Key Exchange)
NONCE (Nonce)

2009-07-22 02:12:21: IkeSnoop: Sending IKE packet to 85.175.133.31:500
Exchange type : Identity Protection (main mode)
Payloads:
KE (Key Exchange)
NONCE (Nonce)

2009-07-22 02:12:21: IkeSnoop: Received IKE packet from 85.175.133.31:500
Exchange type : Identity Protection (main mode)
Payloads:
ID (Identification)
HASH (Hash)

2009-07-22 02:12:21: IkeSnoop: Sending IKE packet to 85.175.133.31:500
Exchange type : Identity Protection (main mode)
Payloads:
ID (Identification)
HASH (Hash)

2009-07-22 02:12:22: IkeSnoop: Received IKE packet from 85.175.133.31:500
Exchange type : Quick mode
Payloads:
HASH (Hash)
SA (Security Association)
NONCE (Nonce)
KE (Key Exchange)
ID (Identification)
ID (Identification)

2009-07-22 02:12:22: IkeSnoop: Sending IKE packet to 85.175.133.31:500
Exchange type : Quick mode
Payloads:
HASH (Hash)
SA (Security Association)
NONCE (Nonce)
KE (Key Exchange)
ID (Identification)
ID (Identification)

2009-07-22 02:12:22: IkeSnoop: Received IKE packet from 85.175.133.31:500
Exchange type : Quick mode
Payloads:
HASH (Hash)

2009-07-22 02:15:13: IkeSnoop: Received IKE packet from 85.175.133.31:500
Exchange type : Informational
Payloads:
HASH (Hash)
D (Delete)

2009-07-22 02:15:13: IkeSnoop: Received IKE packet from 85.175.133.31:500
Exchange type : Informational
Payloads:
HASH (Hash)
D (Delete)

2009-07-22 02:15:16: IkeSnoop: Received IKE packet from 85.175.133.31:500
Exchange type : Identity Protection (main mode)
Payloads:
SA (Security Association)

2009-07-22 02:15:16: IkeSnoop: Sending IKE packet to 85.175.133.31:500
Exchange type : Identity Protection (main mode)
Payloads:
SA (Security Association)
VID (Vendor ID)
VID (Vendor ID)
VID (Vendor ID)
VID (Vendor ID)
VID (Vendor ID)
VID (Vendor ID)
VID (Vendor ID)
VID (Vendor ID)
VID (Vendor ID)

2009-07-22 02:15:16: IkeSnoop: Received IKE packet from 85.175.133.31:500
Exchange type : Identity Protection (main mode)
Payloads:
KE (Key Exchange)
NONCE (Nonce)

2009-07-22 02:15:16: IkeSnoop: Sending IKE packet to 85.175.133.31:500
Exchange type : Identity Protection (main mode)
Payloads:
KE (Key Exchange)
NONCE (Nonce)

2009-07-22 02:15:17: IkeSnoop: Received IKE packet from 85.175.133.31:500
Exchange type : Identity Protection (main mode)
Payloads:
ID (Identification)
HASH (Hash)

2009-07-22 02:15:17: IkeSnoop: Sending IKE packet to 85.175.133.31:500
Exchange type : Identity Protection (main mode)
Payloads:
ID (Identification)
HASH (Hash)

2009-07-22 02:15:17: IkeSnoop: Received IKE packet from 85.175.133.31:500
Exchange type : Quick mode
Payloads:
HASH (Hash)
SA (Security Association)
NONCE (Nonce)
KE (Key Exchange)
ID (Identification)
ID (Identification)

2009-07-22 02:15:17: IkeSnoop: Sending IKE packet to 85.175.133.31:500
Exchange type : Quick mode
Payloads:
HASH (Hash)
SA (Security Association)
NONCE (Nonce)
KE (Key Exchange)
ID (Identification)
ID (Identification)

2009-07-22 02:15:17: IkeSnoop: Received IKE packet from 85.175.133.31:500
Exchange type : Quick mode
Payloads:
HASH (Hash)