Hi,
I have a IPSec tunnel between a MT and a Pix, all is configured, Phase 1 & 2 is up, and my security keys are installed and active. My MT encrypts and transmit the data to the PIX, the PIX receives it and uncrypt it, my PIX encrypts and sends the responces back, the MT refuses to decrypt the encrypted data received back…
On the PIX:
access-list NONAT permit ip 172.21.44.0 255.255.254.0 172.19.44.0 255.255.252.0
access-list NONAT permit ip 172.21.44.0 255.255.254.0 172.20.44.0 255.255.252.0
access-list VPN permit ip 172.21.44.0 255.255.254.0 172.19.44.0 255.255.252.0
access-list VPN permit ip 172.21.44.0 255.255.254.0 172.20.44.0 255.255.252.0
crypto ipsec transform-set IPSEC-BLAH esp-3des esp-md5-hmac
crypto map OSFW 1 ipsec-isakmp
crypto map OSFW 1 match address VPN
crypto map OSFW 1 set peer a.b.240.11
crypto map OSFW 1 set transform-set IPSEC-BLAH
crypto map OSFW 1 set security-association lifetime seconds 86400 kilobytes 4608000
crypto map OSFW interface outside
isakmp enable outside
isakmp key ******** address a.b.240.11 netmask 255.255.255.255
isakmp identity address
isakmp policy 100 authentication pre-share
isakmp policy 100 encryption 3des
isakmp policy 100 hash md5
isakmp policy 100 group 2
isakmp policy 100 lifetime 86400
And, as mentioned, the tunnel is established and active:
interface: outside
Crypto map tag: OSFW, local addr. a.b.170.14
local ident (addr/mask/prot/port): (172.21.44.0/255.255.254.0/0/0)
remote ident (addr/mask/prot/port): (172.20.44.0/255.255.252.0/0/0)
current_peer: a.b.240.11:0
PERMIT, flags={origin_is_acl,}
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest 0
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0
local crypto endpt.: a.b.170.14, remote crypto endpt.: a.b.240.11
path mtu 1500, ipsec overhead 0, media mtu 1500
current outbound spi: 0
inbound esp sas:
inbound ah sas:
inbound pcp sas:
outbound esp sas:
outbound ah sas:
outbound pcp sas:
local ident (addr/mask/prot/port): (172.21.44.0/255.255.254.0/0/0)
remote ident (addr/mask/prot/port): (172.19.44.0/255.255.252.0/0/0)
current_peer: a.b.240.11:500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest 0
#pkts decaps: 611, #pkts decrypt: 652, #pkts verify 652
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 41
local crypto endpt.: a.b.170.14, remote crypto endpt.: a.b.240.11
path mtu 1500, ipsec overhead 56, media mtu 1500
current outbound spi: c959bac
inbound esp sas:
spi: 0x1caa6eaf(480931503)
transform: esp-3des esp-md5-hmac ,
in use settings ={Tunnel, }
slot: 0, conn id: 7, crypto map: OSFW
sa timing: remaining key lifetime (k/sec): (4607922/84969)
IV size: 8 bytes
replay detection support: Y
inbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0xc959bac(211131308)
transform: esp-3des esp-md5-hmac ,
in use settings ={Tunnel, }
slot: 0, conn id: 8, crypto map: OSFW
sa timing: remaining key lifetime (k/sec): (4608000/84972)
IV size: 8 bytes
replay detection support: Y
outbound ah sas:
outbound pcp sas:
On my MT:
/ip ipsec proposal
set default auth-algorithms=md5 disabled=no enc-algorithms=3des lifetime=1d name=default pfs-group=modp1024
/ip ipsec peer
add address=a.b.170.14/32:500 auth-method=pre-shared-key dh-group=modp1024 disabled=no dpd-interval=20s dpd-maximum-failures=1 enc-algorithm=3des \
exchange-mode=main generate-policy=no hash-algorithm=md5 lifebytes=0 lifetime=1d nat-traversal=no proposal-check=obey secret=secret \
send-initial-contact=yes
/ip ipsec policy
add action=encrypt disabled=no dst-address=172.21.44.0/23:any ipsec-protocols=esp level=require manual-sa=none priority=0 proposal=default protocol=\
all sa-dst-address=a.b.170.14 sa-src-address=a.b.240.11 src-address=172.19.44.0/22:any tunnel=yes
add action=encrypt disabled=no dst-address=172.21.44.0/23:any ipsec-protocols=esp level=require manual-sa=none priority=0 proposal=default protocol=\
all sa-dst-address=a.b.170.14 sa-src-address=a.b.240.11 src-address=172.20.44.0/22:any tunnel=yes
HOWEVER:
- Why is my second policy marked as INACTIVE in the Console, but INVALID in Winbox
Flags: X - disabled, D - dynamic, I - inactive
0 src-address=172.19.44.0/22:any dst-address=172.21.44.0/23:any protocol=all action=encrypt level=require ipsec-protocols=esp tunnel=yes
sa-src-address=a.b.240.11 sa-dst-address=a.b.170.14 proposal=default manual-sa=none priority=0
1 I src-address=172.20.44.0/22:any dst-address=172.21.44.0/23:any protocol=all action=encrypt level=require ipsec-protocols=esp tunnel=yes
sa-src-address=a.b.240.11 sa-dst-address=a.b.170.14 proposal=default manual-sa=none priority=0
- Looking at my installed-sa, encrypted packets received from the PIX to my MT, is never decrypted:
Flags: A - AH, E - ESP, P - pfs
0 E spi=0xC959BAC src-address=a.b.170.14 dst-address=a.b.240.11 auth-algorithm=md5 enc-algorithm=3des replay=4 state=mature
auth-key="84d4a2e8e5e3130b6c7c1a94b6543279" enc-key="612ef01732ff3cdd6d08ff03a71aebd34181cc157364a51f" add-lifetime=19h12m/1d
use-lifetime=0s/0s lifebytes=0/0
1 E spi=0x1CAA6EAF src-address=a.b.240.11 dst-address=a.b.170.14 auth-algorithm=md5 enc-algorithm=3des replay=4 state=mature
auth-key="32b8cfe52031b07b3c46b524b897b67e" enc-key="dafd8e21288eaa8040bf9b03e33a0fe4b0efa49beeafb8da" addtime=oct/16/2008 13:05:04
add-lifetime=19h12m/1d usetime=oct/16/2008 13:05:05 use-lifetime=0s/0s current-bytes=64588 lifebytes=0/0
Feedback and suggestions much appreciated!
