Hello,
I have been unable to reach the list site to look for any archives
on this question, so I?ll through it out there. I?m trying to setup a IPSec
VPN tunnel from a Cisco Router (on which I have several hundred successful
site-to-site tunnels) running IOS 12.4(7) to a Symantec Raptor.
Unfortunately, I can?t really provide much detail about the Symantec because
it?s a customer/vendor?s device. At one point the tunnel did work, but
started failing, and now it fails when something behind the Symantec tries
to initiate a tunnel, but not when something behind the Router initiates the
tunnel.
To lay out some details (which have been obfuscated to protect
identity and security):
Cisco side:
Inside IP: 10.1.1.25 (local subnet has routing to encr dom)
Outside IP: 1.2.3.4
Preshared key
P1: 3DES MD5 DH2
P2: 3DES MD5 no-pfs
Local encryption domain: 7.8.9.0/24 (public space)
Sample ACL for crypto map:
permit ip 7.8.9.0 0.0.0.255 host 172.16.10.56
permit ip 7.8.9.0 0.0.0.255 host 172.16.10.113
permit ip 7.8.9.0 0.0.0.255 host 172.16.10.78
It use to work fine this way, with a single local group for the
hosts on the Raptor side, and a subnet on the Cisco side, and each host had
its own IPSec SA (tunnel) to the subnet on the Cisco side. Then the Raptor
changed behavior and started to try to use any existing SA for any 1 of the
3 hosts to encrypt traffic for the other 2 when a system behind the Raptor
was the initiator of traffic and negotiations. If the Cisco side initiates
to all 3 separately, creating the SAs itself, then the tunnel works
bi-directionally as it should, until the P2 SAs expire. At the moment,
there is no way to identify what firmware change, or config change on the
Raptor caused this, so rolling things back is not a practical option (unless
someone knows exactly what the issue is).
We tried disabling that group and tunnel (perhaps deleting it would
be more thorough and a better test ?) and creating 3 totally separate
tunnels on the Raptor, using the same key, etc as the 1 defined S-2-S tunnel
on the Cisco, but system behind the Raptor still can not initiate a tunnel.
As I said, perhaps deleting the old one (not just disabling it) is
necessary.
I ran into the same issue with another customer/vendor using a
Raptor, where they were using a group, and switching them to individual
tunnels resolved the bi-directional initiation issues (it introduced some
minor problems that I?m ignoring here).
Anyone have any experience with a Cisco to Raptor tunnel with a
subnet and hosts (or anything like this) that could shed some light on this?
Nate
--
No virus found in this outgoing message.
Checked by AVG Free Edition.
Version: 7.5.432 / Virus Database: 268.15.16/582 - Release Date: 12/11/2006
4:32 PM
I have been unable to reach the list site to look for any archives
on this question, so I?ll through it out there. I?m trying to setup a IPSec
VPN tunnel from a Cisco Router (on which I have several hundred successful
site-to-site tunnels) running IOS 12.4(7) to a Symantec Raptor.
Unfortunately, I can?t really provide much detail about the Symantec because
it?s a customer/vendor?s device. At one point the tunnel did work, but
started failing, and now it fails when something behind the Symantec tries
to initiate a tunnel, but not when something behind the Router initiates the
tunnel.
To lay out some details (which have been obfuscated to protect
identity and security):
Cisco side:
Inside IP: 10.1.1.25 (local subnet has routing to encr dom)
Outside IP: 1.2.3.4
Preshared key
P1: 3DES MD5 DH2
P2: 3DES MD5 no-pfs
Local encryption domain: 7.8.9.0/24 (public space)
Sample ACL for crypto map:
permit ip 7.8.9.0 0.0.0.255 host 172.16.10.56
permit ip 7.8.9.0 0.0.0.255 host 172.16.10.113
permit ip 7.8.9.0 0.0.0.255 host 172.16.10.78
Symantec Raptor side:
Inside IP: 172.16.10.254
Outside IP: 21.22.23.24
Preshared key
P1: 3DES MD5 DH2
P2: 3DES MD5 no-pfs
Local encryption domain: group containing 172.16.10.56, 172.16.10.113,
172.16.10.78
Remote encryption domain: 7.8.9.0 255.255.255.0
It use to work fine this way, with a single local group for the
hosts on the Raptor side, and a subnet on the Cisco side, and each host had
its own IPSec SA (tunnel) to the subnet on the Cisco side. Then the Raptor
changed behavior and started to try to use any existing SA for any 1 of the
3 hosts to encrypt traffic for the other 2 when a system behind the Raptor
was the initiator of traffic and negotiations. If the Cisco side initiates
to all 3 separately, creating the SAs itself, then the tunnel works
bi-directionally as it should, until the P2 SAs expire. At the moment,
there is no way to identify what firmware change, or config change on the
Raptor caused this, so rolling things back is not a practical option (unless
someone knows exactly what the issue is).
We tried disabling that group and tunnel (perhaps deleting it would
be more thorough and a better test ?) and creating 3 totally separate
tunnels on the Raptor, using the same key, etc as the 1 defined S-2-S tunnel
on the Cisco, but system behind the Raptor still can not initiate a tunnel.
As I said, perhaps deleting the old one (not just disabling it) is
necessary.
I ran into the same issue with another customer/vendor using a
Raptor, where they were using a group, and switching them to individual
tunnels resolved the bi-directional initiation issues (it introduced some
minor problems that I?m ignoring here).
Anyone have any experience with a Cisco to Raptor tunnel with a
subnet and hosts (or anything like this) that could shed some light on this?
Nate
--
No virus found in this outgoing message.
Checked by AVG Free Edition.
Version: 7.5.432 / Virus Database: 268.15.16/582 - Release Date: 12/11/2006
4:32 PM
x?>"9äè?IPM.Microsoft Mail.Note1 & p$Cisco Router IOS to Symantec RaptorqÇ @ödpõï?9F§®õ/·dyã
Á?h ÎÓ?æ°/Â? ÒÎ17LZFu+#*ß `ng102f5drcp
Ð2 `c
D41stsâhpbch5 Çfh°ÖbiC
¤3ò3æfeb÷¤cGÀ
ÀsetÑp(rq2*
¡no-
ðq6p05?04ñÐà4}mß?PÔÏÛb± ?? Ä ?36_/sBÀÐ! b3`}GiovpIPTCTT Ô8 N2?"Ò r m CE Ô?9"ÿ$/%5yr?æ4 l16'?úG Ñk(ô ),±*¿½?Tp(ô¡d ,Þ77-ÿ%4(Heòb pw)(ô'A0/13ÿ$ 2? °3u,Þ®8 15¯?B@t°¿(ô ?*`/ñ9?2ÃVètnae3u"á<÷
#ø%?4&?M'7@Åý(Õ5*h@Ä,Do÷-æ@Ä/f5/÷D}1w@Ľ3 53çJ>@L6û57ÑïD}8÷@Ä:?5
;AD~<vûKµ>51=@´??Uæ; o0X?e5ÿYÊZáZ?[©Y´[ÒZ?^?]Í]O[YÏ028c?ÿd±doeyY´e¢dgßg÷g eOi9 ldmÁeã§mÀ?Pylh àêtq PlÁ@áðdctl
±p7²pau: `s
°Gpð àqònumaÉq°to
QjuP|ghqà
p
i½ppApàÀ ±sQ1uà ð'@@
¶: rÿud Ã'@'èÐ À4 xnpxizsneúxWAN°Àsàu¡Ívd40:°ve@ ?mi|Ð ð Dq?4 P
Àa Àq`h îF!|`1P``Nw 0sÀ?sW4 t¼hBsÀ
°|Ðl
àû"àdrØ
F??GÊb?GrBcb
°*Pÿ?2 `??` ? ??do@?peAðellp¡÷?±?Ás} :?Áÿ30?`?& P?D±?Sq ù?Ddg?&? ?&up?Dþvoïpÿrs t/u? òÿw,?ñ
´x"vQyl?wÿ?õ{Cñ}Z{´<à o`ýnó1??¯¿?Ïÿ?Úu òvw?4A "wï÷xÿz{b?À ? 1??Co1 4 ??83½ ð} ?` X°~tp£u°;@?³f08ß?Ð
0x૱îy0 p-m°ªQ¬q¬w7mÀAxPt?R»ªQ?ñmÐЮ)y?Aÿ? /???Aª3?? ¦voÿwt2¢´ !£O¤_¥o¦}ß;@§¨??Bs|1?ß|Ç?Íw)°@Ðf ¦fc|?»?7378àLà þH?Q? ?,C|S"à¾?ÿ¿OÀTðÀÏÁØ0?à?Pÿ ?Âm°Ã¯ lw*DB¿?ð1Æy}h@Â?s w@@ m«±}1Á?EûÀSoBm°WÃà `Ïà0o4?ÐsdPpÞa®ÐSÒ¡Qk ?Ö0|#X°vâUÂà ~w¡ÔD»Ñ 3»ØÕÓ6_-Ð?Á¹ÖT2Áð9ÅLà5|#xml?ã Ù³1 ?Àtp:/Î/ðoÀs.}?U0o?.Ï1/Üf?°e/w°d/!¾3ÜóÙÀWÐ
¡Â?wðwµ@Þ3h¼ÞÁÀrÿ?°®!ß??pà*P3Ðß?ÚbáCg±°àr?ó ???R?P???nb~j` ð|Ð`ð oïàÐ ?¬0sPä¸é?Agd?a ¢p`ÿÔ Ò@!à?àæÁ{`ÙÀ½??h?P Q?Àèàlß{b@¹ °}qx ? ÷0Ò1a} ?èÙ±ÿ1èáÙ±` P ¶xÑѱÀyÎQ{`ppÿ °A?°á0û`?b í!°??À¶rÀaðQmp
a\èàtrzäsgß² ? hóð®#gvò?ñQ? ?ÿàó!ôáRòbèáåÁó1ýõãjíñp 0äq?B òvwk??÷Òðß@1ÞÑáÀ?²e
`ù5ÇäàÎqlytÕP ?ÿ}0ãÑúÇ?ÀÀ±°°í!ÿÙÐ?À±ñ 2² ?ÐP@ÿ ýÑ?d?ÐúÐøÁ?`?aúÁQ?À?QÙÐ30kÿðq}0 Q¯À0 A{@ÿ¯à±À¸¢ ??µ!È1Ü° ?Ð}ÑÒÀ?Я±ppuÿ@°b0G»Â `äàØ&ý{Pw 1»?°@p À?P±¢Ü°°` 0Âw}ç!f®Ü°: ì°`1ü3fÞÐРаøÀþÐýÙÐu??w!«"ââ¸ÑâÅÿ?A{`®@äAüÐì°}1âñÿ â¸
¢ 1 °
@ÏãÓÃÙàâðlv衱1ÿÛб`aüð?Àâ??Òþ7Ì¡±0 àµ`?P±0®¡üa.Ñtf÷°w!oÿ/ð
±0}ЫñO_'@±0?àÿ¯³)?¼a O?b("?ÿ o¢;@ Ï ß!ï1?ÿ#O$%*?# (ÿ)*?A ',ï-ÿ ²Þáÿ?ùà?ò1
??¿?Ï°?ÿ±¯?þ«!EØ ?ßµwoÿ·¯¸¿z??PÊ_ËoÌx?Pç?0ÁÊ?Ño,F±A/B?óCO×e
3?E?FOG_c×ùüðb IÚ°ëQ ïå }áð?ò 8¨ñópß¼ð4ðÒ0 Ø°àcN¢È0ok ðQ½nÎy½=}s @O1¹V qYÒÑ@,OÀýNÀIIoJK×úR0äáS T/U?ÁÉ?àO1Pu}8À Q 8O2c°.þ RÿXOY_V/W?]ß^ïåD mN ryæ?N¢Ï?M© p½MpPSâð øVPNN ð{P?ÀÀ?Ï@fCOÜP R\õ (Q±w} Oa/b?ÿcOÁÉM?i?jOk_ÁÉi/¿noÁºÏ??Á?±hð½½1dqorspªsÐ[?À½`f6OÃ-
8-sOÔfós)¨ðfñeRIOS Øà.4(7ç|N±f SyаêÑf?úR²r\¡ÕðQfáÑáïúÀR°M?øÀnv?wOx_ÿ` ?/??OÁÉ[ðNáÈ ýQpP÷Ð?0dðÐ[Àï?0üðÐнb\}¸å ÿøÀýqq_?o?Áº¡?ÿOÀ½?Ï?ßïp¯Ï?ß»?ïÂc8qÏ@ì°/ç?ÿ¦°I_?o??O?_???Oßt???÷Ð
zP\¡A[ñ§½?Ào9?Tfå dhÀõÝkR°b\!0³È`PïÐÁæ?R°÷ Õ1[Ò¤âÿQhÐNÎÀ?Qáeaå ÿ§!£ ?{8?QN±9ÉñÿÑáffä¤äѦ§?h%÷©F¨ñ¢ç.I?/???õMBTP1aQ\«B??ýQ(hÔM¨
àzø±¤¢ÿN±?Ñ~[ð?° Q?¥âáu8 Ñ):®T÷®TgµØ±e¸%®¿¯Ï°ßÿljº »/¼?liÙà?f@â:
|à0.1¡<À¾w¿ À/?ª(Ó¡u?z bÿû [ðM Q[ÒàedíÀÿÛÐ?Ï@3`Ã/Ä?ÅOlwï¹¿Ê Ë/ÅïOÍ?ίϿÏliüQÂÂà.3}ÑçÒ?Ó¯Ì? Pê@ðñvð keyÍ?×?ØOÔ_|P1Â`ÛÿÝÞ li3äDE|ÐMDÃá â/ñ??DH2Û?å/æ?çO?P2Â`ãö¥¡-pGÿèÿêë
Ì?î ï/ð?lx~Lò?óOô_liÇ#ÈÒyÿö/÷?øOli@Rú¯û¿ÿüÏ?ªÉ!þßÿïÿli4ïÿ lh:
/?ª7.8.9.0ö/< h?pÇ?4ðf?6áÿzPÉ_ ïÿñ/oñliSam3ðo?¯ñ??ACLP?úq~qdðÿ60¸%M2ßïÿýÚh`Úm[áifÕ Â#?Ó<Àí?hoO¡11  æ6 Â5653?4Xüfi1¢4ÿ67 8/9?ÿlY ¯ ¿ Ï!ß"ï#ÿ ?. //li1133?ÿ4¯5¿?7¿8Ï9ß0O1_?2o3<Ï=ßlK78BoÿCD:ß%¾' (/)?*O
ÿ+_,oFßGïHÿÚ'¸?}Íÿ¹TFoR¯S¿I?W?X¯Y¿ÿ½_\ ]/^?Á_¯`¿aÏÿ6Ê$?A0Öe/f?Z¯hßÿiïj
ÿÐÏm_nooÕpÿ·rs ^é2ÂÑ}2ÖPÿPuv?w¯Ù¿ÚÏlï{ÿ| ß??¯ãOä_??ÿ?¯ç/?¿?Ï
?ßìßíïÿ?}/????¯õ[úïþ?ÉÑÂ`gÈ!@0¹0ÿ¢ Ñ«¢?Ï?ß?ïg_$äÿ?O_?o}HªP ï¡ÿ£
ÿ?B/¥¯¦¿67?ª_«oÿ¤¯®¿¯Ï¨O±_²o³ÿE?¶ ·/¸??º/»?¼Oá_4RemoV??ÿ?ï@VA1A"
Ä30½¯¾¿¿Ïÿ¼¯Uy RÕÀ@O Õ° :w k ðPÊahiòsÊ ay±0L ËPÀçW!?° lú?4 ÿËPÕ°$2Ë??ÍÒVɱ0V`~ÐÌA Ë @ÎuC÷Ëp?ÏIe Ì $3Mà·~Ð?ðÎQw?ÕÐSV?DSAptunË l^)ÊrÍÒÐ Ñ%. TÿÍà?Å?ÆOÇ_^éΨÖïß×ÿÙ?:ÝV`g~ÁÛo§ÜÝ^ébeMàvþ ÿÛ_àßáï?+ä
?åOæ_*ÿÏÁ$P 0V?~ÐÔr PÊrçÊBV`íexËp°?WÓ± í¢1ùðfÍÃ3ÿÎ ÂUìáé@&°àÍ?÷Â
Íà 2Ê Ö¯èÿêûîW y$PÁðã¢Pì¡¿Î¸Ë ðÍá?á°aVòïïBðõÏ²Ë gÂùþ¡úsÖ`IïTÐøø¶~pÊr¿M°?àï°ÊPP²V?lËÁÿÂpÑðî#ÍÒÓ°Ë?ò¿óÏïôß^éÒÑÔ0f±0ÍÑÎ?ç
ÓôÊ£Ë?biÿ_ow=^-?O^édiÿ~`LPÂÁý!íøQ?ñ~?ù?Pld±0Ô°?àÍÒ¿`ÿ ¯
¿^?íàpÑ]ÖaAðÁÍáÂmÂPtÿ?~`@Ë??0Ë?ÊrWAý?fíò`ùÊñ?ÐË ÿ!ßT±0 ? &°? ßT¿ÎmÌðÊA÷rËp±0s ÿ?@ý0þ??ñÒÊàS»@Ì@pLÐ
Ìòo?Tö(ÔÌ sË?Ð? õu k?0wË?íà ñ
q?³ø? 0u2).ÄßïO_nÉÃWÊaOP~ÁýÀsÉà5Ñ?4ϲEö(?±MàpË?MÌ î#ÿ?ñÊ°1ã¡a!ËPù0ï?POpÏ¥ã°tV?ͱ~pý@?ÔPϲþGï°
Ôp?Àÿ
bý?2!_"o#bÚÔ0ïÎ]aÌbÔ?a~â±0Õ ùñødï MË~ÐSx-2-ÐEÕZ±0bÿN°ö¯ÎÈ¡?àÌðÓ0 rÿüVÌ1. //0?1OÒË?þI3ñÈp±0( ñ£) ¢þ(
rO%ù
ÐÔPRVû !Ly åÉÄð9áP¿Ôv4 TËô qòcO!ñr/vÂP?°ù@3dÿÌ@2æòa*Ê Hfÿ?3;?<O=_°?ìËñLà/þ?80òÏÀiãðduÿ
?ÑÓôË?~aGð÷t¾-Éø¶Â SË?(
ÑÿEQ?@PàCÀì!`Ã@ûù1 Ðo&@ÁðøbÑ_?ÇL?MO$zrquÂW/ÿX?YO?ù80?Uñ?û ÖÉAîð ¢ãÑí?@!ÿ%ÀÂ`FvÐåÔq9FÌwÔôϲÎ(î´?ÌÀiÿ~ðËCÔQÂ?)r~?UVoBà*Õ5Ëp
?`_ù@N¿ü¡[o\]$?ßQrÈ_j} ôdÉ l?án5z7nC lqjnl 8¦ m`Ë--såNàýãðrÊ@Í ðÒ±jï0¿7°úp?Cáß.sô.CÍà ~ÁbíAVØG F~`EÀ²}wUVò}@? ÃbÄ 4Ú3ò@/yÐu#DÐDÀ¥øPe?26à 1Ä ñ `/58ò@t`ÁàÌ G{Á{b{á12/0/Am@06 4:zÁP.Msô?É$}?Þ?â Y ? ÀF?? ÀF?
? ÀF?? ? ÀF?? ÀF?@? ÀF`?p?J2 ? ÀF? ? ÀF?J?7GVA2¡??è{O± AVG FLAGS (OUT)Ð?! øÁ?h ÎÓ?æ°/úÁ?h ÎÓ?æ°/þ
4ý?4ý?4NITAù¿¸ª7Ùn100000000C18C906820CED31189E6B02F9D00000
0443A6E00åátÓm eHELLO,IHAVEBEENUNABLETOREACHTHELISTSITETOLOOKFORANYARCHIVESON
THISQUESTION,SOI?LLTHROUGHITOUTTHEREI?MHè_______________________________
________________
VPN mailing list
VPN (at) lists.shmoo (dot) com [email concealed]
http://lists.shmoo.com/mailman/listinfo/vpn
[ reply ]