我有一个CISCO 3662再上面配置了PPTP 和IPSEC VPN拨入,PPTP拨入没有问题,但是使用CISCO VPN CLIENT 4.01 始终拨不上去,提示:
SEVURE VPN CONNECTION TERMINATED LOCALLY BY THE CLIENT REASON:THE REMOTE PEER IS NO LONGER RESPONDING
下面是CISCO 3662 配置 :
cisco3662-1>en
welcome to you !!please input your password:
cisco3662-1#show runn
Building configuration...
Current configuration : 2441 bytes
!
version 12.4
service timestamps debug uptime
service timestamps log uptime
service password-encryption
!
hostname cisco3662-1
!
boot-start-marker
boot system tftp c3660-ik9s-mz.124-1a.bin 10.1.14.200
boot-end-marker
!
enable secret 5 $1$gqa0$FpG7mXkuYK3/DZfHRrqyP/
enable password 7 070C294540081506184259
!
aaa new-model
!
!
aaa authentication password-prompt "welcome to you !!please input your password:"
aaa authentication username-prompt "welcome to you !!please input your uasernam:"
aaa authentication login default local-case enable
!
aaa session-id common
!
resource policy
!
ip subnet-zero
!
!
ip cef
no ip domain lookup
no ip dhcp use vrf connected
!
!
vpdn enable
vpdn ip udp ignore checksum
!
vpdn-group 1
! Default PPTP VPDN group
accept-dialin
protocol pptp
virtual-template 1
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
username chalco password 7 02050C5A0705007115
!
!
!
crypto isakmp policy 1
authentication pre-share
crypto isakmp client configuration address-pool local ourpool
!
crypto isakmp client configuration group cisco
key cisco123
pool ourpool
!
!
crypto ipsec transform-set trans1 esp-des esp-sha-hmac
!
crypto dynamic-map dynmap 10
set transform-set trans1
!
!
crypto map intmap client configuration address initiate
crypto map intmap client configuration address respond
crypto map intmap 10 ipsec-isakmp dynamic dynmap
!
!
!
!
interface Loopback0
ip address 10.100.100.1 255.255.255.0
!
interface FastEthernet0/0
ip address 210.82.28.29 255.255.255.252
ip access-group deny-virus in
speed 10
full-duplex
!
interface FastEthernet0/1
ip address 10.1.14.100 255.255.255.0
speed auto
full-duplex
mls rp vlan-id 2
crypto map intmap
!
interface Virtual-Template1
ip unnumbered FastEthernet0/1
peer default ip address pool test
no keepalive
ppp encrypt mppe auto required
ppp authentication ms-chap
!
ip local pool test 192.168.1.1 192.168.1.250
ip local pool ourpool 10.2.1.1 10.2.1.254
ip http server
no ip http secure-server
!
ip classless
ip route 0.0.0.0 0.0.0.0 210.82.28.30
ip route 10.1.1.0 255.255.255.0 210.82.32.141
!
!
!
ip access-list extended deny-virus
deny tcp any any eq 135
deny tcp any any eq 139
deny tcp any any eq 445
deny udp any any eq 1434
permit ip any any
deny tcp any any eq 1720
snmp-server community public RO
!
!
!
control-plane
!
!
!
!
!
!
!
!
!
line con 0
password 7 070C285F4D06
line aux 0
line vty 0 4
password 7 070C294540081506184259
!
!
end
顶 DEBUG完了以后 总是提示 HASH算法与策略不匹配!!
encryption DES-CBC
hash MD5
default group 2
auth pre-share
life type in seconds
life duration (VPI) of 0x0 0x20 0xC4 0x9B 0:0:N/A:0):Hash algorithm offered does not match policy!
atts are not acceptable. Next payload is 0
no offers accepted!
phase 1 SA policy not acceptable! (local 192.168.1
.1 remote 192.168.1.2)
incrementing error counter on sa: construct_fail_ag
_init
sending packet to 192.168.1.2 my_port 500 peer_por
t 500 (R) AG_NO_STATE
peer does not do paranoid keepalives.
04:23:36: ISAKMP0:0:N/A:0):deleting SA reason "Phase1 SA policy proposal not a
ccepted" state (R) AG_NO_STATE (peer 192.168.1.2)
04:23:36: ISAKMP0:0:N/A:0): processing KE payload. message ID = 0
请问有谁知道原因??
多谢
加密方式
再发个配置你自己参照着修改吧
Router#sh run
Building configuration...
Current configuration : 1412 bytes
!
version 12.2
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router
!
aaa new-model
!
!
aaa authentication login userauthen local
aaa authorization network groupauthor local
aaa session-id common
!
username cisco password 0 cisco
memory-size iomem 15
ip subnet-zero
!
!
!
--More-- !
crypto isakmp policy 3
hash md5
authentication pre-share
group 2
!
crypto isakmp client configuration group test
key test
pool testpool
acl 101
!
!
crypto ipsec transform-set myset esp-des esp-md5-hmac
!
crypto dynamic-map dynmap 10
set transform-set myset
!
!
crypto map clientmap client authentication list userauthen
crypto map clientmap isakmp authorization list groupauthor
crypto map clientmap client configuration address respond
crypto map clientmap 10 ipsec-isakmp dynamic dynmap
!
--More-- !
!
voice call carrier capacity active
!
!
!
!
!
!
!
!
!
mta receive maximum-recipients 0
!
!
!
!
interface FastEthernet0/0
description connect to vpn client
ip address 192.168.0.2 255.255.255.0
duplex auto
speed auto
crypto map clientmap
--More-- !
interface FastEthernet0/1
no ip address
shutdown
duplex auto
speed auto
!
ip local pool testpool 192.168.0.20 192.168.0.30
ip classless
ip http server
!
!
access-list 101 permit ip any any
!
call rsvp-sync
!
!
mgcp profile default
!
dial-peer cor custom
!
!
!
--More-- !
!
line con 0
line aux 0
line vty 0 4
!
!
end
Router#
按照上面的文档改了一下配置,
User Access Verification
welcome to you !!please input your uasernam:
welcome to you !!please input your uasernam:chalco
welcome to you !!please input your password:
cisco3662-1>en
welcome to you !!please input your password:
cisco3662-1#show runn
Building configuration...
Current configuration : 2468 bytes
!
version 12.4
service timestamps debug uptime
service timestamps log uptime
service password-encryption
!
hostname cisco3662-1
!
boot-start-marker
boot system tftp c3660-ik9s-mz.124-1a.bin 10.1.14.200
boot-end-marker
!
enable secret 5 $1$gqa0$FpG7mXkuYK3/DZfHRrqyP/
enable password 7 070C294540081506184259
!
aaa new-model
!
!
aaa authentication password-prompt "welcome to you !!please input your password:"
aaa authentication username-prompt "welcome to you !!please input your uasernam:"
aaa authentication login default local enable
!
aaa session-id common
!
resource policy
!
ip subnet-zero
!
!
ip cef
no ip domain lookup
no ip dhcp use vrf connected
!
!
vpdn enable
vpdn ip udp ignore checksum
!
vpdn-group 1
! Default PPTP VPDN group
accept-dialin
protocol pptp
virtual-template 1
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
username chalco password 7 02050C5A0705007115
!
!
!
crypto isakmp policy 3
hash md5
authentication pre-share
group 2
crypto isakmp client configuration address-pool local ourpool
!
crypto isakmp client configuration group cisco3000
key cisco123
pool ourpool
acl 101
!
!
crypto ipsec transform-set trans1 esp-des esp-md5-hmac
!
crypto dynamic-map dynmap 10
set transform-set trans1
!
!
crypto map intmap client authentication list default
crypto map intmap client configuration address respond
crypto map intmap 10 ipsec-isakmp dynamic dynmap
!
!
!
!
interface Loopback0
ip address 10.100.100.1 255.255.255.0
!
interface FastEthernet0/0
ip address 192.168.1.1 255.255.255.0
speed auto
full-duplex
!
interface FastEthernet0/1
ip address 10.1.14.100 255.255.255.0
speed auto
full-duplex
mls rp vlan-id 2
crypto map intmap
!
interface Virtual-Template1
ip unnumbered FastEthernet0/1
peer default ip address pool test
no keepalive
ppp encrypt mppe auto required
ppp authentication ms-chap
!
ip local pool ourpool 10.2.1.1 10.2.1.254
ip local pool test 192.168.1.10 192.168.1.250
ip http server
no ip http secure-server
!
ip classless
ip route 0.0.0.0 0.0.0.0 210.82.28.30
ip route 10.1.1.0 255.255.255.0 210.82.32.141
!
!
!
ip access-list extended deny-virus
deny tcp any any eq 135
deny tcp any any eq 139
deny tcp any any eq 445
deny udp any any eq 1434
permit ip any any
deny tcp any any eq 1720
access-list 101 permit ip any any
snmp-server community public RO
!
!
!
control-plane
!
!
!
!
!
!
!
!
!
line con 0
password 7 070C285F4D06
line aux 0
line vty 0 4
password 7 070C294540081506184259
!
!
end
还是不行!!
这回提示 变成了 Preshared authentication offered but does not match
policy!
06:39:16: ISAKMP: encryption DES-CBC
06:39:16: ISAKMP: hash MD5
06:39:16: ISAKMP: default group 2
06:39:16: ISAKMP: auth pre-share
06:39:16: ISAKMP: life type in seconds
06:39:16: ISAKMP: life duration (VPI) of 0x0 0x20 0xC4 0x9B
06:39:16: ISAKMP0:0:N/A:0):Preshared authentication offered but does not match
policy!
06:39:16: ISAKMP0:0:N/A:0):atts are not acceptable. Next payload is 0
06:39:16: ISAKMP:(0:0:N/A:0):Checking ISAKMP transform 1 against priority 65535
policy
AAA 认证不知道 哪里有问题 ??
用户名密码 在VPN CLIENT GROUP AUTHENTICATION 中 name cisco3000 password:cisco123.
但是 总是提示:
Preshared authentication offered but does not match
policy!
不知道 是在那里有问题??
此外 现在我的F0/0口不知道 为什么不能够TELNET 只有F0/1口可以TELNET ????
发表于 2007-8-23 22:59
| 
0:0:N/A:0):Hash algorithm offered does not match policy!
