IPSECVPN基础知识必备知识学习本课程要求在R&S方面具备CCNP基础，良好的TCP/IP协议基础课程内容1。加密的历史和技术2。IP安全综述3。IPSEC体系4。ESP协议5。AH协议6。IKE协议加密历史和技术一。加密历史：恺撒大帝密码风语者（原始的也许是最好的）解密：最好的方法从密钥管理和密钥分发中寻找机会点，而不是从算法本身寻找寻找脆弱点。因此，一个密码系统的成功与否的关键是密钥的生成，分发，管理。二。加密技术现代的基本加密技术要依赖于消息之目标接收者已知的一项秘密。通常，解密方法（亦即“算法”）是任何人都知道的—就象所有人都知道怎样打开门一样。然而，真正用来解开这一秘密的“密钥（Key）”却并非尽人皆知—就象钥匙一样，一扇门的钥匙并不是任何人都拿得到的。因此，关键的问题是如何保障密钥的安全。当然，还有某些加密系统建立在一种保密的算法基础上—通常把它叫作“隐匿保密”加密安全不存在“绝对安全”加密方法的“健壮度”是由其复杂程度来决定的。例如，假设某种特定的加密系统复杂程度是2的32次方，我们便认为为了破解它，需进行2的32次方次独立的运算。这个数量表面上似乎非常大，但对一部高速计算机来说，它每秒钟也许就能执行数百乃至上千次这样的解密运算。所以对这种加密系统来说，其能力尚不足以保证秘密的安全。正是考虑到这样的情况，所以我们用“计算安全”来量度一个现代加密系统的安全程度。加密基础公共密钥加密系统，建立在“单向函数和活门”的基础上。“单向函数”，是指一个函数很容易朝一个方向计算，但很难（甚至不可能）逆向回溯；“活门”，是指一种可供回溯的“小道”1。因式分解问题：z=x.y一个有限的范围内，很容易计算出数字的乘积，但却很难分解出生成那个乘积的各个乘数RSA2。离散对数问题：一个大质数p，以及一个底数g。已知一个特定的值y，求指数x，如下所示：gx＝ymodp其中，mod是“求余”的意思。模指数很容易便可计算出来，但假若想通过一次离散对数运算恢复原来的指数，却是异常艰难的。3。活门函数从树叶到树干很容易；从树干到树叶的活门：左－右－右－左－右4。单向散列函数定义：散列函数采用一条长度可变的消息作为自己的输入，对其进行压缩，再产生一个长度固定的摘要。一致的输入会产生一致的输出。特点：COLLISIONFREE,血崩效应作用：身份验证，完整性校验具体函数：MD5（MessageDigest5，消息摘要5），SHA－1（SecureHashAlgorithm，安全散列算法），RIPEMD。5。异或（XOR）”函数01010110----------0011对称加密算法对数据输入处理方式：“块”的方式“流”的方式无论块加密还是流加密，加密速度快，数据长度几乎不增加所以特别适用于批量加密，但是密钥分发和管理困难。工作模式：1。电子密码本（ElectronicCodeBook，ECB）2。加密块链接（CBC）cbc解密3。加密回馈模式（CipherFeedbackMode，CFB）4。输出回馈模式（OutputFeedbackMode，OFB)对称加密算法的特点在对称密码学中，同一个密钥既用于加密也用于解密。对称加密速度快。对称加密是安全的。对称加密得到的密文是紧凑的。因为接收者需要得到对称密钥，所以对称加密容易受到中途拦截窃听的攻击。对称密码系统当中密钥的个数大约是以参与者数目的平方的速度增长，因此很难将它的使用扩展到大范围的人群中。对称密码系统需要复杂的密钥管理。对称密码技术不适用于数字签名和不可否认性。不对称加密算法通俗的名称叫作“公共密钥算法”。其中要用到两个密钥，一个是公共的，一个是私人的。一个密钥负责加密（编码），另一个负责解密（译码），建立在单向函数基础上。1.RSA目前最流行的公共密钥算法就是RSA，名字来源于它的发明者：RonRivest，AdiShamir以及LeonardAdleman。RSA之所以能够保密，关键在于假如已知两个非常大的质数的乘积，那么很难解析出到底是哪两个质数相乘的结果（因数分解）。RSA的重要特点是其中一个密钥可用来加密数据，另一个密钥可用来解密。这意味着任何人都能用你的公共密钥对一条消息进行加密，而只有你才能对它进行解密。另外，你也可用自己的私人密钥对任何东西进行加密，而拿到你的公共密钥的任何人都能对其解密。缺点：是速度非常慢，而且能处理的数据最多只能有它的密钥的模数大小应用：是密钥交换和数字签名的事实标准2.El-Gamal一种公共密钥加密系统是El-Gamal，名字是从其发明者来的：TaherEl-Gamal。El-Gamal数学基础:建立在“离散对数问题”的基础上。El-Gamal的主要缺点就是密文长度达到了明文的两倍。不对称算法的特点使用非对称密码技术时，用一个密钥加密的东西只能用另一个密钥来解密。非对称加密是安全的。因为不必发送密钥给接受者，所以非对称加密不必担心密钥被中途截获的问题。需要分发的密钥数目和参与者的数目一样。非对称密码技术没有复杂的密钥分发问题。非对称密钥技术不需要事先在各参与者之间建立关系以交换密钥。非对称密码技术支持数字签名和不可否认性。非对称加密速度相对较慢。非对称加密会造成密文变长。身份验证和完整性为保守一个秘密，它的机密性是首先必须保证的。但假如不进行身份验证，也没有办法知道要同你分享秘密的人是不是他／她所声称的那个人！同时假如不能验证接收到的一条消息的完整性，也无法知道它是否确为实际发出的那条消息.对每个数据的身份验证和完整性保证1.密钥化的单向散列函数.2.数字签名(缺点是非常慢)对数据交换前的身份验证:数字证书+数字签名………数字签名特点1)难以伪造：只有私人密钥的持有人才能生成签名；2)无法抵赖：由于极难伪造，所以对于一份经过签名的文档来说，签署人很难抵赖这不是自己的“手迹”；3)不可更改：一经签名，文档便不能修改；4)不能转移：签名不能移走，并加入另一个不相干的文档。对数据流的密钥化散列对数据流的数字签名提前的身份验证:RSA签名单纯的数字签名不能完成身份验证,必须和数字证书相结合提前的身份验证:DSA签名DSA（数字签名算法）和RSA类似，既可用来加密，亦可用来签名。数学基础:建立在“离散对数问题”的基础上。DSA实际并不对生成的签名进行加密处理，也不对签名的验证进行解密处理（尽管它实际上有一个公共密钥和一个私人密钥）。相反，私人密钥用来生成两个160位的值，该值代表着签名，而签名的验证是一种数学上的求证（用公共密钥进行），证明那两个值只能由私人密钥生成。DSA将SHA作为一种散列函数应用于签名。密钥交换(1)对称加密算法和对称MAC都要求使用一个共享的密钥一.Diffie-Hellman密钥交换是第一种公共密钥加密系统。Diffie-Hellman密钥交换建立在“离散对数问题”的基础上Diffie-Hellman交换过程中涉及到的所有参与者首先都必须隶属于一个组。这个组定义了要使用哪个质数p，以及底数g。Diffie-Hellman密钥交换是一个两部分的过程。在每一端（Alice和Bob）的第一部分，需要选择一个随机的私人数字（由当事人的小写首字母表示），并在组内进行乘幂运算，产生一个公共值（当事人的大写首字母）：开始交换自己的公共密钥，Alice将A给Bob，而Bob将B给Alice，他们再次执行乘幂运算，使用当事人的公共值作为底数，以生成共享的一个“秘密”密钥交换(2)Diffie-Hellman密钥交换的一个缺点是易受“中间人”的攻击。解决方法:“中间人”攻击并不足以证明Diffie-Hellman的脆弱，只要Alice和Bob为自己的公共值加上了数字签名，便能有效地防范此类攻击密钥交换(3)RSA密钥交换TOM拥有:TOMPRIVATEKEYJERRYPUBLICKEYJERRY拥有:JERRYPRIVATEKEYTOMPUBLICKEY产生一个随机数为共享密钥,用JERRYPUBLICKEY加密传送给JERRY完美向前保密短暂的一次性密钥的系统称为“完美向前保密”（PerfectForwardSecrecy，PFS）如果加密系统中有一个秘密是所有对称密钥的衍生者（始祖），便不能认为那是一个“完美向前保密”的系统。在这种情况下，一旦破解了根密钥，便能拿到自它衍生的所有密钥，受那些密钥保护的全部数据都会曝光。在ISAKMP阶段的DH会产生三个密钥，一个用于加密，一个用于HMAC，一个用于衍生IPSEC阶段的密钥。PFS的作用就是通过在IPSECSA协商阶段从新进行一次D-H交换来实现的.INTERNET面临的威胁每种通信方法的安全取决于建立通信的那种媒体（或媒介）。媒体越开放，消息落入外人之手就越有可能。INTERNET是一个吵闹的大房间，大量的敏感信息不可靠传输。tomjerry对接受者jerry来说，收到从TOM过来的信息，她怀疑：1。这个邀请是从TOM发过来的吗？2。这个邀请在传送过程有没有被别人偷看到呢？3。这个邀请里的时间对吗，地点对吗？TOM向JERRY发出约会邀请IPSEC基本概念 IPSecisadefinedencryptionstandardthatencryptstheupperlayersoftheOSImodelbyaddinganewpredefinedsetofheaders.AnumberofRFCsdefinedIPSec.IPSecisamandatoryrequirementforIPversion6.(IPV6isnotcoveredintheexamination.)IPSecensuresthatthenetworklayeroftheOSImodelissecured.InTCP/IP’scase,thiswouldbetheIPnetworklayer.IPSEC的两种保护模式 Transportmode—ProtectspayloadoftheoriginalIPdatagram;typicallyusedforend-to-endsessions Tunnelmode—ProtectstheentireIPdatagrambyencapsulatingtheentireIPdatagraminanewIPdatagram两个概念(1)通信点:实际通信的设备加密点:完成加密的设备通信点TOM通信点JERRY加密点A加密点B*加密点A=通信点TOM?加密点B通信点JERRY两个概念(2)*两个概念(3)加密点A=通信点TOM加密点B=通信点JERRY*怎么选取IPSEC保护模式?TUNNELMODE:产生新的可路由IP头,可解决不同私有网络之间跨越INTERNET数据包的加密传送TRANSPORTMODE:不产生新的IP头部,要求原IP包可在INTERNET路由,要求通信点和加密点为同一IP*两种保护模式的包结构SA-安全联盟“安全联盟”（IPSec术语，常常简称为SA）是构成IPSec的基础。SA是两个通信实体经协商建立起来的一种协定。它们决定了用来保护数据包安全的IPSec协议、转码方式、密钥以及密钥的有效存在时间等等。任何IPSec实施
方案
气瓶 现场处置方案 .pdf气瓶 现场处置方案 .doc见习基地管理方案.doc关于群访事件的化解方案建筑工地扬尘治理专项方案下载
始终会构建一个SA数据库（SADB），由它来维护IPSec协议用来保障数据包安全的SA
记录
混凝土 养护记录下载土方回填监理旁站记录免费下载集备记录下载集备记录下载集备记录下载
。SA是单向的。如果两个主机（比如A和B）正在通过ESP进行安全通信，那么主机A就需要有一个SA，即SA(out)，用来处理外发的数据包；另外还需要有一个不同的SA，即SA(in)，用来处理进入的数据包。主机A的SA(out)和主机B的SA(in)将共享相同的加密参数（比如密钥）SA还是“与协议相关”的。每种协议都有一个SA。如果主机A和B同时通过AH和ESP进行安全通信，那么每个主机都会针对每一种协议来构建一个独立的SA。至于SPD检索的输出，则可能有下面这几种情况：■丢弃这个包。此时包不会得以处理，只是简单地丢掉。(pc上能够采用)■绕过安全服务。在这种情况下，IP层会在载荷内增添IP头，然后分发IP包。■应用安全服务。在这种情况下，假如已建立了一个SA，就会返回指向这个SA的指针；假如尚未建立SA，就会调用IKE，将这个SA建立起来。如果SA已经建立，SPD内便会包含指向SA或SA集束的一个指针（具体由策略决定）。如果策略的输出规定强行将IPSec应用于数据包，那么在SA正式建立起来之前，包是不会传送出去的。SPD-安全策略数据库*选择符－应用SPD的依据应用SPD的依据，主机和ROUTER处理的方式不同选择符利用ACL来定义，包括：源地址目的地址协议上层端口名字IPSEC的组成部分 ESP（负载安全封装）协议 认证头（AH）协议 Internet密钥交换（IKE）协议*IKE：提供协商安全参数和创建认证密钥的框架。ESP：提供加密，认证和保护数据的框架。AH：提供认证和保护数据的框架。EncapsulationSecurityPayload(ESP) TheESPsecurityserviceisdefinedinRFC2406.ESPprovidesaservicetotheIPdata(payload),includingupper-layerprotocolssuchasTCP.ThedestinationIPportnumberis50.TheESPheaderislocatedbetweentheuserdataandoriginalIPheader。ESPdoesnotencrypttheoriginalIPheader,andencryptsonlytheIPdatabyplacingaheaderinbetweentheoriginalIPheaderanddata.ESPprovidesdataconfidentiality,dataintegrity,anddataoriginauthentication.ESPalsopreventsreplayattacks.ESP包结构(1)*具体长度介绍参考vpn
设计
领导形象设计圆作业设计ao工艺污水处理厂设计附属工程施工组织设计清扫机器人结构设计
P4121TheSecurityParametersIndex(SPI)isanarbitrary32-bitvaluethat,incombinationwiththedestinationIPaddressandsecurityprotocol(ESP),uniquelyidentifiestheSecurityAssociationforthisdatagram.2Thesequencenumber,anunsigned32-bitfield,containsamonotonicallyincreasingcountervalue.Itismandatoryandisalwayspresent,evenifthereceiverdoesnotelecttoenabletheantireplayserviceforaspecificSA.3TheNextHeaderisan8-bitfieldthatidentifiesthetypeofdatacontainedinthePayloadDatafield.TheIPdatafieldcontainsthedatatobesent.4TheAuthenticationDatafieldisavariablelengthfieldcontaininganIntegrityCheckValue(ICV)computedovertheESPpacketminustheAuthenticationData.ESP包结构(2)*1TheSecurityParametersIndex(SPI)isanarbitrary32-bitvaluethat,incombinationwiththedestinationIPaddressandsecurityprotocol(ESP),uniquelyidentifiestheSecurityAssociationforthisdatagram.2Thesequencenumber,anunsigned32-bitfield,containsamonotonicallyincreasingcountervalue.Itismandatoryandisalwayspresent,evenifthereceiverdoesnotelecttoenabletheantireplayserviceforaspecificSA.3TheNextHeaderisan8-bitfieldthatidentifiesthetypeofdatacontainedinthePayloadDatafield.TheIPdatafieldcontainsthedatatobesent.4TheAuthenticationDatafieldisavariablelengthfieldcontaininganIntegrityCheckValue(ICV)computedovertheESPpacketminustheAuthenticationData.ESP包字段解释SPI字段，和IP头之前的目标地址以及协议结合在一起，用来标识用于处理数据包的特定的那个安全联盟。序列号，使ESP具有了抵抗重播攻击的能力初始化向量（IV）:作为CBC加密的种子填充项（填充数据）用于在ESP中保证边界的正确和扰乱原始数据实际长度下一个头的字段表明数据类型，这一数据包含在载荷数据字段内。如果在通道模式下使用ESP，这个值就会是4，表示IP-in-IP。如果在传送模式下使用ESP，这个值表示的就是它背后的上一级协议的类型，比如TCP对应的就是6。身份验证数据字段用于容纳数据完整性的检验结果*1TheSecurityParametersIndex(SPI)isanarbitrary32-bitvaluethat,incombinationwiththedestinationIPaddressandsecurityprotocol(ESP),uniquelyidentifiestheSecurityAssociationforthisdatagram.2Thesequencenumber,anunsigned32-bitfield,containsamonotonicallyincreasingcountervalue.Itismandatoryandisalwayspresent,evenifthereceiverdoesnotelecttoenabletheantireplayserviceforaspecificSA.3TheNextHeaderisan8-bitfieldthatidentifiesthetypeofdatacontainedinthePayloadDatafield.TheIPdatafieldcontainsthedatatobesent.4TheAuthenticationDatafieldisavariablelengthfieldcontaininganIntegrityCheckValue(ICV)computedovertheESPpacketminustheAuthenticationData.防重放攻击的实现对每个接收到的数据包检查:1.接收的需要是否在滑动窗口以内2.与原来收到的数据包序号是否相同*ESP数据包的外出处理1。传送模式：ESP头紧跟在IP头（包括IP头可能有的任何选项）之后，插入一个外出的IP包中。IP头的协议字段被复制到ESP头的“下一个头”字段中，ESP头的其余字段则被填满—SPI字段分配到的是来自SADB的、用来对这个包进行处理的特定SA的SPI；填充序列号字段的是序列中的下一个值；填充数据会被插入，其值被分配；同时分配的还有填充长度值。随后，IP头的协议字段得到的是ESP的值，或者50。通道模式：ESP头是加在IP包前面的。一个IPv4包，那么ESP头的“下一个头”字段分配到值4；其他字段的填充方式和在传送模式中一样。随后，在ESP头的前面新增了一个IP头，并对相应的字段进行填充（赋值）—源地址对应于应用ESP的那个设备本身；目标地址取自于用来应用ESP的SA；协议设为50；其他字段的值则参照本地的IP处理加以填充2。从恰当的SA中选择加密器（加密算法），对包进行加密（从载荷数据的开头，一直到“下一个头”字段）。3。使用恰当的SA中的验证器，对包进行验证（自ESP头开始，中间经过加密的密文，一直到ESP尾）。随后，将验证器的结果插入ESP尾的“验证数据”字段中。4。重新计算位于ESP前面的IP头的校验和。*ESP数据包的进入处理1。检查处理这个包的SA是否存在；2。检查序列号是否有效3。对数据包进行完整性和来源进行验证4。对数据包解密5。对数据包进行初步的有效性检验验证模式是否匹配传送模式：上层协议头与IP头是同步的，ESP头的下一个头字段被复制到IP头的协议字段中，并计算出一个新的IP校验和；通道模式：就抛开外部IP头和ESP头—我们需要的是这个解开封装的包。这时，必须进行另一个有效性检验。如果这个包和所要求的地址和／或端口、和／或协议（SA表明的）不相符，必须将它丢弃。6。传送模式：就会转送到一个高一级的协议层—比如TCP或UDP—由它们对这个包进行处理；通道模式包：就会重新插入到IP处理流中，继续转发到它的最终目的地（也许在同一个主机上）*ESP对分片包的处理先分段，后加密传输模式：验证，解密，收集分片包，送给上层协议通道模式：验证，解密，路由先加密，后分段收集完分片包后，才能验证，解密*AuthenticationHeader(AH) AHisdescribedinRFC2402.TheIPprotocoldestinationportis51. ThefieldsintheIPdatagramthatareencryptedandauthenticated. AHprovidesdataoriginauthenticationandoptionalreplay-detectionservices. AHdoesn’tprovidedataconfidentiality(orencryption).AH包结构(1)-传输模式序列号下一个头Ip头保留SPI数据UDP/TCP数据头验证数据载荷长度验证*•NextHeader,an8-bitfield,identifiesthetypeofthenextpayloadaftertheAuthenticationHeader.•ThePayloadLengthfieldisan8-bitfieldspecifyingAH’slengthin32-bitwords(4-byteunits),minus2.•TheReservedfieldisa16-bitfieldreservedforfutureuse.ItMUSTbesetto0.•TheSPIisanarbitrary32-bitvaluethat,incombinationwiththedestinationIPaddressandsecurityprotocol(AH),uniquelyidentifiestheSecurityAssociationforthisdatagram.AH包结构(2)－隧道模式序列号下一个头保留SPI数据新的Ip头UDP/TCP数据头验证数据载荷长度验证原始IP头*•NextHeader,an8-bitfield,identifiesthetypeofthenextpayloadaftertheAuthenticationHeader.•ThePayloadLengthfieldisan8-bitfieldspecifyingAH’slengthin32-bitwords(4-byteunits),minus2.•TheReservedfieldisa16-bitfieldreservedforfutureuse.ItMUSTbesetto0.•TheSPIisanarbitrary32-bitvaluethat,incombinationwiththedestinationIPaddressandsecurityprotocol(AH),uniquelyidentifiestheSecurityAssociationforthisdatagram.AH的处理－输出处理1。检查外出数据包，是否与一个SPD条目匹配时，然后SADB查看是否存在一个合适的SA。如果没有，可用IKE动态地建立一个。如果有，就将AH应用到这个与之相符的数据包，该数据包在SPD条目指定的那个模式中。2。SPI字段分配的值是取自SA的SPI；下一个头字段分配的是跟在AH头之后的数据类型值；“身份验证数据”字段设成0。3。AH将安全保护扩展到外部IP头的原有的或预计有的字段。因此，将“完整性检查值（ICV）”之前的不定字段调成零是必要的AH的处理－输出处理4。根据身份验证器的要求，或出于排列方面的原因，可能需要进行适当的填充；5。利用密钥对整个IP包进行ICV进行计算。由于不定字段已设成零，它们就不会包括在ICV计算中。接下来，ICV值被复制到AH的“身份验证数据”字段中，IP头中的不定字段就可根据IP处理的不同得以填充。6。输出数据包AH的处理－输入处理1。找出用来保护这个包的SA。然后用IP头的目的地址、特定协议（这里是51）和取自AH头的SPI这三者再对SA进行识别。如果没有找到合适的SA，这个包就会被丢弃。2。找到SA之后，进行序列号检查。如果检查失败，这个包就会被丢弃。3。检查ICV。首先将AH头的“验证数据”字段中的ICV值保存下来，然后将那个字段清零。IP中的所有不定字段也被清零（。取决于身份验证器算法以及载荷长度，可能还要进行隐式填充，使验证数据的长度符合算法的要求。隐式填充包含的值必须全为零。随后，对整个数据包应用“身份验证器”算法，并将获得的摘要同保存下来的ICV值进行比较。如相符，IP包就通过了身份验证；如不符，便丢弃该包。4。ICV一经验证，滑动接收窗口的序列号就可能递增。5。传输模式：把数据包交给上层协议隧道模式：路由数据包AH和ESP共同作用（1）嵌套通道，是指我们对一个已经通道化的数据包再进行一次通道化处理通道1。hostA—RB通道2。routerA--routerBAH和ESP共同作用（2）对同一数据同时进行AH和ESP处理由于数据的完整性应以尽可能多的数据为基础计算出来。如果先用ESP保护以后，再用AH重新保护一遍数据包，那么数据的完整性就能同时应用于ESP载荷，其中包含了传送载荷。IKE介绍 IKE负责在两个IPSEC对等体间协商一条IPSEC隧道的协议。 协商协议参数 交换公共密钥 对双方进行认证 在交换后对密钥进行管理IKE的三个组成部分 SKEME：提供为认证目的使用公开密钥加密的机制。（定义一种密钥交换方式） Oakley：提供在两个IPSEC对等体间达成相同加密密钥的基本模式的机制。（对多模式的支持，例如对新的加密技术。并没有具体的定义交换什么样的信息） ISAKMP：定义了消息交换的体系结构，包括两个IPSEC对等体间分组形式和状态转变（定义封装格式和协商包交换的方式）*IKE,describedinRFC2409,isahybridprotocol.ItisbasedonaframeworkdefinedbytheInternetSecurityAssociationandKeyManagementProtocol(ISAKMP),definedinRFC2408,andimplementspartsoftwokeymanagementprotocols桹akleyandSKEME.InadditionIKEdefinestwoexchangesofitsown.OakleyisaprotocoldevelopedbyHilarieOrman,acryptographerfromtheUniversityofArizona.Itisafree-formprotocolthatallowseachpartytoadvancethestateoftheprotocolatitsownspeed.FromOakley,IKEborrowedtheideaofdifferentmodes,eachproducingasimilarresult梐nauthenticatedkeyexchange?throughtheexchangeofinformation.InOakley,therewasnodefinitionofwhatinformationtoexchangewitheachmessage.ThemodeswereexamplesofhowOakleycouldbeutilizedtoachieveasecurekeyexchange.IKEcodifiedthemodesintoexchanges.BynarrowingtheflexibilityoftheOakleymodel,IKElimitsthewiderangeofpossibilitiesthatOakleyallowsyetstillprovidesmultiplemodes,albeitinawell-definedmanner.SKEMEisanotherkeyexchangeprotocol,designedbycryptographerHugoKrawczyk.SKEMEdefinesatypeofauthenticatedkeyexchangeinwhichthepartiesusepublickeyencryptiontoauthenticateeachotherand"share"componentsoftheexchange.Eachsideencryptsarandomnumberinthepublickeyofthepeerandbothrandomnumbers(afterdecryption)contributetotheultimatekey.OnecanoptionallydoaDiffie-HellmanexchangealongwiththeSKEMEsharetechniqueforPerfectForwardSecrecy(PFS),ormerelyuseanotherrapidexchange,whichdoesnotrequirepublickeyoperations,torefreshanexistingkey.IKEborrowsthistechniquedirectlyfromSKEMEforoneofitsauthenticationmethods(authenticationwithpublickeyencryption)andalsoborrowsthenotionofrapidkeyrefreshmentwithoutPFS.ISAKMPwasdevelopedbyresearchersattheNationalSecurityAgency(NSA).TheNSAusedtobeasuper-secretorganizationwhoseexistencewasevendeniedbytheUnitedStatesgovernment.Recently,theNSAhascomeoutoftheshadowsanditsconsiderableexpertiseincryptographyandsecurityhasbeenputtovisibleuse.ISAKMPisonesuchoutput.Itisuponthesethreeprotocols桰SAKMP,Oakley,andSKEME梩hatIKEisbased.Itisahybridprotocol;itusesthefoundationofISAKMP,themodesofOakley,andtheshareandrekeyingtechniquesofSKEMEtodefineitsownuniquewayofderivingauthenticatedkeyingmaterialandnegotiatingsharedpolicy.ThecontributionsofOakleyandSKEMEcanbeseeninthediscussionofIKEitself,butthecontributionsofISAKMPareconsiderableenoughtowarrantaseparatediscussion.IKE是一个混合协议IKE的三个模式*AggressivemodeeliminatesseveralstepsduringIKEauthenticationnegotiationphaseIbetweentwoormoreIPSecpeers.Aggressivemodeisfasterthanmainmodebutnotassecure.Aggressivemodeisathree-waypacketexchange,whilemainmodeisasix-waypacketexchange.IKEcanbeconfiguredinaggressivemodeormainmode(notboth).Aggressivemodeisalessintensiveprocessthatrequiresonlythreemessagestoestablishatunnelratherthansixinmainmode.Aggressivemodeistypicallyusedindialupenvironments.IKEPhaseIMessagesTypes1-6（1，2） NegotiatesIKEpolicy(messagetypes1and2).InformationexchangesinthesemessagetypesincludeIPaddresses.Proposals,suchasDiffie-Hellmangroupnumberandencryptionalgorithm,arealsoexchangedhere.AllmessagesarecarriedinUDPpacketswithadestinationUDPportnumberof500.TheUDPpayloadcomprisesaheader,anSApayload,andoneormoreproposals.Messagetype1offersmanyproposals,andmessagetype2containsasingleproposal.*CookiesThefirststepofanyexchangeisanexchangeofcookies.Theseare8bytepseudo-randomnumbersgeneratedbyeachISAKMPentityandassignedtoeachremotepeer.Eachcookieisuniquetotheremotepeerandalsototheparticularexchangeinwhichitisdefined.ThepurposeofthecookiesistoidentifytheISAKMPSAandalsotoprovidesomeanticloggingprotectionagainstcertaindenialofserviceattacks.WhilenomethodofcookiegenerationisproscribedinISAKMP,thetechniqueproposedbyKarnandSimpson(inthePhoturiskeyexchange)isthepreferredmethod:Thecookieistheresultofhashingauniqueidentifierofthepeer(e.g.,hisIPaddressandaportandprotocol),asecretknownonlytothegenerator,andsometimestamp.Inthismanner,eachcookieisboundtotheremotepeeranditistrivialtocheckthatthecookiepresentedbyapeeristheonegiventohim.ThecookiesresideintheISAKMPheader.Toachievethemostanticloggingprotectionoutofthecookies,anexchangewillgenerallydelayexpensiveandintensiveoperations梥uchasexponentiationforaDiffie-Hellmanexchange梪ntilcookieshavebeenexchanged.Inthisway,someprotectionagainstrudimentarydenial-of-serviceattacksispossible.Forinstance,anattackerwhogeneratesthousandsofbogusISAKMPmessageswithfalsereturnaddresseswouldnotcausehistargettodoanysignificantworkbecausethesecondmessagethatcontainsthecookieuniquetothe(bogus)addresswouldnotbereceived.Thecookieexchangetakesplaceinthefirsttwomessagesexchanged.Thefirstmessageisfromtheinitiatoroftheprotocoltotheresponder.TheinitiatorcreatesacookieuniquetotheresponderandtheexchangehewishestobeginandinsertsitintotheinitiatorcookieportionoftheISAKMPheader.Sincethisisthefirstmessagethereisnorespondercookieandthatfieldiszero.Afterthemessagehasbeenreceivedandprocessedtherespondergeneratesacookieforthisexchange.Toformulateareplyhecopiesthistotherespondercookieportionoftheheaderofhisreplyandcopiesthecookieprovidedbytheinitiatorintotheinitiatorcookiefieldoftheheaderofhisreply.TheresponderisabletocreatealarvalISAKMPsecurityassociationidentifiedbythecookiesandsendthemessagebacktotheinitiator.UponreceiptofthisresponsetheinitiatorisabletoupdateherlarvalSAwiththeresponder'scookieandtheexchangecontinues.Obviouslytheinitiatormustcreatesomestatepriortosendingoutthefirstmessage.Ataminimum,thisstatemustcontainthepeertowhichthemessagewassentandthecookiecreatedforhim.Sincehesentoutthemessagebeforeheknewtheresponder'scookie,hemustbepreparedtoidentifythisstatebasedsolelyonhisowncookie.Afterreceivingtheresponder'sfirstmessage,though,he'sabletoupdatethatstatetoincludetheresponder'scookie.TheresponderalsocreatessomestateintheformofthelarvalISAKMPSA.Itdoesnotdoanysignificantworkuntilithasreceivedit'scookiebackfromtheinitiatorandverifiedthatthatcookieiscorrectbasedonthepeer'sIPaddress.AfterthecookieexchangetheconcatenationofthetwocookiesidentifiestheSAinthesamemannerinwhichanSPIidentifiesanIPSecSA.SincethecookiesarepassedaspartoftheISAKMPheaderitisstraightforwardforanentitytolookupthestateassociatedwiththemessage梩heISAKMPSA梪ponreceiptofthemessage.Afteramessageisprocessed,thestateoftheISAKMPSAisupdatedandaresponse,ifrequired,issent.Inthismanner,theexchangeproceedsuntiltheISAKMPSAhasbeencompleted.IKEPhaseIMessagesTypes1-6（3，4） PerformsauthenticatedDiffie-Hellmanexchange(messagetypes3and4).Messagestype3and4carryouttheDiffie-Hellman(DH)exchange.Messagestype3and4containthekeyexchangepayload,whichistheDHpublicvalueandarandomnumber.Messagestype3and4alsocontaintheremotepeer’spublickeyhashandthehashingalgorithm.Acommonsessionkeycreatedonbothends,andtheremainingIKEmessagesexchangedfromhereareencrypted.Ifperfectforwardsecrecy(PFS)isenabled,anotherDHexchangewillbecompleted.DH算法 数学难题 Z=X*Y(RSA) Xa=gamodp(DH)发起方：接受方：Xi=gimodpXr=grmodp共享秘密（Xi=gimodp）r=（Xr=grmodp）i=gri3个密钥IKEPhaseIMessagesTypes1-6（5，6） ProtectsIKEpeers’identities—identitiesareencrypted.Messagetypes5and6arethelaststagebeforetrafficissentovertheIPSectunnel.Messagetype5allowstherespondertoauthenticatetheinitiatingdevice.Messagetype6allowstheinitiatortoauthenticatetheresponder.Thesemessagetypesarenotsentascleartext.Messagestype5and6willnowbeencryptedusingtheagreeduponencryptionmethodsestablishedinmessagetypes1and2. Hash_I=PRF(SKEYID,CKY-I,CKY-R,Pre-sharedKey(PK-I),SAPayload,Proposals+Transforms,ID_I)*ThefirstmessageexchangedofferstheremoterouterachoiceofIPSecparameters,suchasencryptionalgorithm,3DES,MD5,andDHgroupnumber,forexample.Thefirstmessage’saimistonegotiateallSApoliciesandgeneratethesharedsecret.Inthesecondmessage(type2),therespondingdeviceindicateswhichoftheIPSecparametersitwantstouseinthetunnelbetweenthetwodevices,includingtheinformationrequiredtogeneratethesharedsecretandprovideauthenticationdetails.Thefinalmessage(type3;untilnownoencryptionisenabled),whichmightormightnotbeencrypted,authenticatestheinitiator.IKEPhaseISummaryIKEPhaseIIMessageTypes1-3 IKEphaseIInegotiatestheSAandthekeysthatwillbeusedtoprotecttheuserdata.IKEphaseIImessagesoccurmorefrequentlyandtypicallyeveryfewminutes,whereIKEphaseImessagesmightoccuronceaday. MessagetypeIallowstheinitiatortoauthenticateitselfandselectsarandom(nonce)numberandproposesasecurityassociationtotheremotepeer.Additionally,apublickeyisprovided(canbedifferentthanakeyexchangedinIKEphaseI). IKEphaseIImessagetypeIIallowstherespondingpeertogeneratethehash.Messagetype2allowstherespondertoauthenticateitself,andselectsarandomnumberandacceptstheSAofferedbytheinitiatingIPSecpeer. IKEMessagetypeIIIacknowledgesinformationsentfromquickmodemessage2sothatthephaseIItunnelcanbeestablished.*PhaseIInegotiationsoccurinamodecalledOakleyquickmodeandhavethreedifferentmessageexchanges.Quickmodecanbethefollowing:•Withoutkeyexchange—NoPFSenabled.•WithKeyexchange—WhenPFSisenabled,theDHalgorithmisrunoncemoretogeneratethesharedsecret.IKEPhaseIISummaryIKEPhaseI/IISummary IKEphaseI：AuthenticatesIPSecpeers,negotiatesmatchingpolicytoprotectIKEexchange,exchangeskeysviaDiffie-Hellman,andestablishestheIKESA. IKEphaseII：NegotiatesIPSecSAparametersbyusinganexistingIKESA.EstablishesIPSecsecurityparameters.PeriodicallyrenegotiatesIPSecSAstoensuresecurityandthatnointrudershavediscoveredsensitivedata.CanalsoperformoptionaladditionalDiffie-Hellmanexchange.IKEPhaseI/II图IKEpreventattacks: •DenialofService—Whenmessagesareconstructedwithuniquecookiesthatcanbeusedtoidentifyandrejectinvalidmessages. •Maninthemiddle—Preventstheintruderfrommodifyingmessagesandreflectingthembacktothesourceorreplayingoldmessages.IKEANDIPSecCHARTCiscoIOSIPSecConfiguration（Step1） Step1EnableISAKMPwiththeIOScommandcryptoisakmpenable.ThisstepgloballyenablesordisablesISAKMPatyourpeerrouter.ISAKMPisenabledbydefault(optionally,definewhatinterestingtrafficwillbeencryptedusingdefinedaccesslists).CiscoIOSIPSecConfiguration（Step2） Step2DefineanISAKMPpolicy,asetofparametersusedduringISAKMPnegotiation:cryptoisakmppolicypriorityYouwillenterconfig-isakmpcommandmode.Optionsavailableincludethefollowing:Router(config-isakmp)#?authentication{rsa-sig|rsa-encr|pre-share}defaultencryption{des}exitgrouphash{md5|sha}lifetimesecondsCiscoIOSIPSecConfiguration（Step3） Step3SettheISAKMPidentity(canbeIPaddressorhostnamebased).cryptoisakmpidentity{address|hostname}CiscoIOSIPSecConfiguration（Step4） Step4Definetransformsets. Atransformsetrepresentsacombinationofsecurityprotocolsandalgorithms.DuringtheIPSecsecurityassociationnegotiation,thepeersagreetouseaparticulartransformsetforprotectingaparticulardataflow. Todefineatransformset,usethefollowingcommandsstartinginglobalconfigurationmode:cryptoipsectransform-settransform-set-nametransform1[transform2[transform3]] Thiscommandputsyouintothecryptotransformconfigurationmode.Thendefinethemodeassociatedwiththetransformset.Router(cfg-crypto-tran)#mode[tunnel|transport]CiscoIOSIPSecConfiguration（Step5） Step5Definecryptomaps.CryptomapstietheIPSecpoliciesandSAstogether.cryptomapnameseqmethod[dynamicdynamic-map-name]Cryptomapconfiguration CryptomapentriescreatedforIPSecpulltogetherthevariouspartsusedtosetupIPSecSAs,includingthefollowing: WhichtrafficshouldbeprotectedbyIPSec(peracryptoaccesslist) ThegranularityoftheflowtobeprotectedbyasetofSAs WhereIPSec-protectedtrafficshouldbesent(whotheremoteIPSecpeeris) ThelocaladdresstobeusedfortheIPSectraffic WhatIPSecsecurityshouldbeappliedtothistraffic WhetherSAsaremanuallyestablishedorareestablishedthroughIKE OtherparametersthatmightbenecessarytodefineanIPSecSATypicalIPSecTopologyBetweenTwoRemoteRoutersVPN成功DEBUG分析*05:25:42:IPSEC(sa_request):,*****************************************************************************(数据触发sa)(keyeng.msg.)OUTBOUNDlocal=2.2.2.2,remote=4.4.4.4,local_proxy=2.2.2.2/255.255.255.255/0/0(type=1),remote_proxy=4.4.4.4/255.255.255.255/0/0(type=1),protocol=ESP,transform=esp-desesp-sha-hmac,******************************************************(触发的crytomap的细节)lifedur=3600sand4608000kb,spi=0x370E3818(923678744),conn_id=0,keysize=0,flags=0x400D05:25:42:ISAKMP:receivedkemessage(1/1)****************************************************************(P&G用于计算DH公共值)05:25:42:ISAKMP:localport500,remoteport500**********************************************************(本地和远端的接口)05:25:42:ISAKMP(0:2):beginningMainModeexchange05:25:42:ISAKMP(0:2):sendingpacketto4.4.4.4(I)MM_NO_STATE******************************************(发出第一个包)05:25:42:ISAKMP(0:1):purgingnode-277032244.***********************************************************(清扫节点)05:25:44:ISAKMP(0:2):receivedpacketfrom4.4.4.4(I)MM_NO_STATE***************************************(收到第二个包)05:25:44:ISAKMP(0:2):processingSApayload.messageID=0**********************************************(处理SA负载)05:25:44:ISAKMP(0:2):foundpeerpre-sharedkeymatching4.4.4.4*****************************************(只是在匹配地址)05:25:44:ISAKMP(0:2):CheckingISAKMPtransform1againstpriority10policy*****************************(转换负载)05:25:44:ISAKMP:encryptionDES-CBC05:25:44:ISAKMP:hashSHA05:25:44:ISAKMP:defaultgroup105:25:44:ISAKMP:authpre-share05:25:44:ISAKMP:lifetypeinseconds05:25:44:ISAKMP:lifeduration(VPI)of0x00x10x510x80*******************************************(????????)05:25:44:ISAKMP(0:2):attsareacceptable.Nextpayloadis0*********************************************(转换负载可以接受)05:25:45:ISAKMP(0:2):SAisdoingpre-sharedkeyauthenticationusingidtypeID_IPV4_ADDR***************(准备基于ip地址进行认证)05:25:45:ISAKMP(0:2):sendingpacketto4.4.4.4(I)MM_SA_SETUP******************************************(发出第三个包)05:25:48:ISAKMP(0:2):receivedpacketfrom4.4.4.4(I)MM_SA_SETUP***************************************(接受第四个包)05:25:48:ISAKMP(0:2):processingKEpayload.messageID=0**********************************************(处理第四个包里边的DH公共值)05:25:50:ISAKMP(0:2):processingNONCEpayload.messageID=0*******************************************(处理第四个包里边的随机数)05:25:50:ISAKMP(0:2):foundpeerpre-sharedkeymatching4.4.4.4*****************************************(只是在匹配地址)05:25:50:ISAKMP(0:2):SKEYIDstategenerated*************************************************************(产生SKEYID)05:25:50:ISAKMP(0:2):processingvendoridpayload*******************************************************(处理厂商ID)05:25:50:ISAKMP(0:2):speakingtoanotherIOSbox********************************************************(发现是和另一个IOS进行通信)05:25:50:ISAKMP(2):IDpayload next-payload:8 type:1 protocol:17 port:500 length:805:25:50:ISAKMP(2):Totalpayloadlength:1205:25:50:ISAKMP(0:2):sendingpacketto4.4.4.4(I)MM_KEY_EXCH******************************************(发送第五个包)05:25:50:ISAKMP(0:2):receivedpacketfrom4.4.4.4(I)MM_KEY_EXCH***************************************(接受第六个包)05:25:50:ISAKMP(0:2):processingIDpayload.messageID=0**********************************************(处理发送者ip或主机名)05:25:50:ISAKMP(0:2):processingHASHpayload.messageID=0********************************************(处理散列认证负载)05:25:50:ISAKMP(0:2):SAhasbeenauthenticatedwith4.4.4.4*********************************************(认证完成)05:25:50:ISAKMP(0:2):beginningQuickModeexchange,M-IDof643516822***********************************(开始快速模式)05:25:51:ISAKMP(0:2):sendingpacketto4.4.4.4(I)QM_IDLE**********************************************(发送快速模式第一个包)05:25:55:ISAKMP(0:2):receivedpacketfrom4.4.4.4(I)QM_IDLE*******************************************(发送快速模式第二个包)05:25:55:ISAKMP(0:2):processingHASHpayload.messageID=643516822************************************(处理认证数据)05:25:55:ISAKMP(0:2):processingSApayload.messageID=643516822**************************************(处理SA负载)05:25:55:ISAKMP(0:2):CheckingIPSecproposal1**********************************************************(检察第一个提议)05:25:55:ISAKMP:transform1,ESP_DES05:25:55:ISAKMP:attributesintransform:05:25:55:ISAKMP:encapsis105:25:55:ISAKMP:SAlifetypeinseconds05:25:55:ISAKMP:SAlifeduration(basic)of360005:25:55:ISAKMP:SAlifetypeinkilobytes05:25:55:ISAKMP:SAlifeduration(VPI)of0x00x460x500x005:25:55:ISAKMP:authenticatorisHMAC-SHA05:25:55:ISAKMP:groupis105:25:55:ISAKMP(0:2):attsareacceptable.***************************************************************(提议是可以接受的)05:25:55:IPSEC(validate_proposal_request):proposalpart#1,**********************************************(合法的提议负载)(keyeng.msg.)INBOUNDlocal=2.2.2.2,remote=4.4.4.4,local_proxy=2.2.2.2/255.255.255.255/0/0(type=1),remote_proxy=4.4.4.4/255.255.255.255/0/0(type=1),protocol=ES.P,transform=esp-desesp-sha-hmac,lifedur=0sand0kb,spi=0x0(0),conn_id=0,keysize=0,flags=0x1405:25:55:ISAKMP(0:2):processingNONCEpayload.messageID=643516822***********************************(处理随机数负载)05:25:55:ISAKMP(0:2):processingKEpayload.messageID=643516822**************************************(处理新的DH公共值)05:25:57:ISAKMP(0:2):processingIDpayload.messageID=643516822**************************************(处理ID[sourceproxy&destinationproxy])05:25:57:ISAKMP(0:2):processingIDpayload.messageID=64351682205:25:57:ISAKMP(0:2):CreatingIPSecSAs*****************************************************************(创建安全联盟)05:25:57:inboundSAfrom4.4.4.4to2.2.2.2(proxy4.4.4.4to2.2.2.2)************************************(创建进入方向的SPI)05:25:57:hasspi0x370E3818andconn_id2000andflags1505:25:57:lifetimeof3600seconds05:25:57:lifetimeof4608000kilobytes05:25:57:outboundSAfrom2.2.2.2to4.4.4.4(proxy2.2.2.2to4.4.4.4)***********(创建出方向的SPI)05:25:57:hasspi2099365266andconn_id2001andflags1D05:25:57:lifetimeof3600seconds05:25:57:lifetimeof4608000kilobytes05:25:57:ISAKMP(0:2):sendingpacketto4.4.4.4(I)QM_IDLE**********************************************(发送快速模式的最后一个包)05:25:57:ISAKMP(0:2):deletingnode643516822errorFALSEreason""05:25:57:IPSEC(key_engine):gotaqueueevent...05:25:57:IPSEC(initialize_sas):,*************************************************************************(初始化进入安全联盟)(keyeng.msg.)INBOUNDlocal=2.2.2.2,remote=4.4.4.4,local_proxy=2.2.2.2/0.0.0.0/0/0(type=1),remote_proxy=4.4.4.4/0.0.0.0/0/0(type=1),protocol=ESP,transform=esp-desesp-sha-hmac,lifedur=3600sand4608000kb,spi=0x370E3818(923678744),conn_id=2000,keysize=0,flags=0x1505:25:57:IPSEC(initialize_sas):,*************************************************************************(初始化出安全联盟)(keyeng.msg.)OUTBOUNDlocal=2.2.2.2,remote=4.4.4.4,local_proxy=2.2.2.2/0.0.0.0/0/0(type=1),remote_proxy=4.4.4.4/0.0.0.0/0/0(type=1),protocol=ESP,transform=esp-desesp-sha-hmac,lifedur=3600sand4608000kb,spi=0x7D21C592(2099365266),conn_id=2001,keysize=0,flags=0x1D05:25:57:IPSEC(create_sa):sacreated,********************************************************************(安全联盟已建立)(sa)sa_dest=2.2.2.2,sa_prot=50,sa_spi=0x370E3818(923678744),sa_trans=esp-desesp-sha-hmac,sa_conn_id=200005:25:57:IPSEC(create_sa):sacreated,********************************************************************(安全联盟已建立)(sa)sa_dest=4.4.4.4,sa_prot=50,sa_spi=0x7D21C592(2099365266),sa_trans=esp-desesp-sha-hmac,sa_conn_id=2001VPNallerrordebug*cryptoisakmppolicy10hashmd5authenticationpre-sharecryptoisakmpkeyciscoaddress22.22.22.22!!cryptoipsectransform-setciscoesp-desesp-sha-hmac!cryptomapciscolocal-addressLoopback1cryptomapcisco10ipsec-isakmpsetpeer22.22.22.22settransform-setciscomatchaddress101intere0crymapciscoiproute0.0.0.00.0.0.010.1.1.2access-list101permitiphost1.1.1.1host2.2.2.2!****************************************cryptoisakmppolicy10nohashmd5----------------------------------------10:41:57:IPSEC(sa_request):,(keyeng.msg.)src=11.11.11.11,dest=22.22.22.22,src_proxy=1.1.1.1/255.255.255.255/0/0(type=1),dest_proxy=2.2.2.2/255.255.255.255/0/0(type=1),protocol=ESP,transform=esp-desesp-sha-hmac,lifedur=3600sand4608000kb,spi=0x741BA3B8(1947968440),conn_id=0,keysize=0,flags=0x400410:41:57:ISAKMP:receivedkemessage(1/1)10:41:57:ISAKMP:localport500,remoteport50010:41:57:ISAKMP(0:2):beginningMainModeexchange10:41:57:ISAKMP(0:2):sendingpacketto22.22.22.22(I)MM_NO_STATE10:41:57:ISAKMP(0:2):receivedpacketfrom22.22.22.22(I)MM_NO_STATE10:41:57:ISAKMP(0:2):Notifyhasnohash.Rejected.10:41:57:%CRYPTO-6-IKMP_MODE_FAILURE:ProcessingofInformationalmodefailedwithpeerat22.22.22.22initial#shcryisasadstsrcstateconn-idslot22.22.22.2211.11.11.11MM_NO_STATE20*****************************************cryptoisakmpkeycisco1address22.22.22.22-----------------------------------------10:45:35:IPSEC(sa_request):,(keyeng.msg.)src=11.11.11.11,dest=22.22.22.22,src_proxy=1.1.1.1/255.255.255.255/0/0(type=1),dest_proxy=2.2.2.2/255.255.255.255/0/0(type=1),protocol=ESP,transform=esp-desesp-sha-hmac,lifedur=3600sand4608000kb,spi=0xC4A6A9D0(3299256784),conn_id=0,keysize=0,flags=0x400410:45:35:ISAKMP:receivedkemessage(1/1)10:45:35:ISAKMP:localport500,remoteport50010:45:35:ISAKMP(0:1):beginningMainModeexchange10:45:35:ISAKMP(0:1):sendingpacketto22.22.22.22(I)MM_NO_STATE.10:45:37:ISAKMP(0:1):receivedpacketfrom22.22.22.22(I)MM_NO_STATE10:45:37:ISAKMP(0:1):processingSApayload.messageID=010:45:37:ISAKMP(0:1):foundpeerpre-sharedkeymatching22.22.22.2210:45:37:ISAKMP(0:1):CheckingISAKMPtransform1againstpriority10policy10:45:37:ISAKMP:encryptionDES-CBC10:45:37:ISAKMP:hashMD510:45:37:ISAKMP:defaultgroup110:45:37:ISAKMP:authpre-share10:45:37:ISAKMP:lifetypeinseconds10:45:37:ISAKMP:lifeduration(VPI)of0x00x10x510x8010:45:37:ISAKMP(0:1):attsareacceptable.Nextpayloadis010:45:38:ISAKMP(0:1):SAisdoingpre-sharedkeyauthenticationusingidtypeID_IPV4_ADDR10:45:38:ISAKMP(0:1):sendingpacketto22.22.22.22(I)MM_SA_SETUP..10:45:40:ISAKMP(0:1):receivedpacketfrom22.22.22.22(I)MM_SA_SETUP10:45:40:ISAKMP(0:1):processingKEpayload.messageID=010:45:42:ISAKMP(0:1):processingNONCEpayload.messageID=010:45:42:ISAKMP(0:1):foundpeerpre-sharedkeymatching22.22.22.2210:45:42:ISAKMP(0:1):SKEYIDstategenerated10:45:42:ISAKMP(0:1):processingvendoridpayload10:45:42:ISAKMP(0:1):speakingtoanotherIOSbox!10:45:42:ISAKMP(1):IDpayloadnext-payload:8type:1protocol:17port:500length:810:45:42:ISAKMP(1):Totalpayloadlength:1210:45:42:ISAKMP(0:1):sendingpacketto22.22.22.22(I)MM_KEY_EXCH10:45:42:ISAKMP(0:1):receivedpacketfrom22.22.22.22(I)MM_KEY_EXCH10:45:42:ISAKMP:reservednotzeroonNOTIFYpayload!10:45:42:%CRYPTO-4-IKMP_BAD_MESSAGE:IKEmessagefrom22.22.22.22faileditssanitycheckorismalformed.10:45:42:ISAKMP(0:1):incrementingerrorcounteronsa:reset_retransmission10:45:43:ISAKMP(0:1):retransmittingphase1MM_KEY_EXCH...10:45:43:ISAKMP(0:1):incrementingerrorcounteronsa:retransmitphase110:45:43:ISAKMP(0:1):retransmittingphase1MM_KEY_EXCH10:45:43:ISAKMP(0:1):sendingpacketto22.22.22.22(I)MM_KEY_EXCH10:45:43:ISAKMP(0:1):receivedpacketfrom22.22.22.22(I)MM_KEY_EXCH10:45:43:ISAKMP:reservednotzeroonNOTIFYpayload!10:45:43:ISAKMP(0:1):incrementingerrorcounteronsa:reset_retransmission.10:45:44:ISAKMP(0:1):retransmittingphase1MM_KEY_EXCH...10:45:44:ISAKMP(0:1):incrementingerrorcounteronsa:retransmitphase110:45:44:ISAKMP(0:1):retransmittingphase1MM_KEY_EXCH10:45:44:ISAKMP(0:1):sendingpacketto22.22.22.22(I)MM_KEY_EXCH.initial#shcryisasadstsrcstateconn-idslot22.22.22.2211.11.11.11MM_KEY_EXCH10****************************************************cryptoisakmpkeyciscoaddress22.22.22.21----------------------------------------------------10:49:08:IPSEC(sa_request):,(keyeng.msg.)src=11.11.11.11,dest=22.22.22.22,src_proxy=1.1.1.1/255.255.255.255/0/0(type=1),dest_proxy=2.2.2.2/255.255.255.255/0/0(type=1),protocol=ESP,transform=esp-desesp-sha-hmac,lifedur=3600sand4608000kb,spi=0xB977049F(3111584927),conn_id=0,keysize=0,flags=0x400410:49:08:ISAKMP:receivedkemessage(1/1)10:49:08:ISAKMP:localport500,remoteport50010:49:08:ISAKMP(0:1):NoCertorpre-sharedaddresskey.10:49:08:ISAKMP(0:1):CannotstartMainmode10:49:08:ISAKMP(0:1):Cannotstartaggressivemode.10:49:08:ISAKMP(0:1):purgingSA.10:49:08:ISAKMP(0:1):purgingnode-1300701206......initial#shcryisasadstsrcstateconn-idslot******************************************************cryptoipsectransform-setciscoesp-desesp-md5-hmac------------------------------------------------------10:53:24:IPSEC(sa_request):,(keyeng.msg.)src=11.11.11.11,dest=22.22.22.22,src_proxy=1.1.1.1/255.255.255.255/0/0(type=1),dest_proxy=2.2.2.2/255.255.255.255/0/0(type=1),protocol=ESP,transform=esp-desesp-md5-hmac,lifedur=3600sand4608000kb,spi=0x6F87605E(1871143006),conn_id=0,keysize=0,flags=0x400410:53:24:ISAKMP:receivedkemessage(1/1)10:53:24:ISAKMP:localport500,remoteport50010:53:24:ISAKMP(0:1):beginningMainModeexchange10:53:24:ISAKMP(0:1):sendingpacketto22.22.22.22(I)MM_NO_STATE.10:53:26:ISAKMP(0:1):receivedpacketfrom22.22.22.22(I)MM_NO_STATE10:53:26:ISAKMP(0:1):processingSApayload.messageID=010:53:26:ISAKMP(0:1):foundpeerpre-sharedkeymatching22.22.22.2210:53:26:ISAKMP(0:1):CheckingISAKMPtransform1againstpriority10policy10:53:26:ISAKMP:encryptionDES-CBC10:53:26:ISAKMP:hashMD510:53:26:ISAKMP:defaultgroup110:53:26:ISAKMP:authpre-share10:53:26:ISAKMP:lifetypeinseconds10:53:26:ISAKMP:lifeduration(VPI)of0x00x10x510x8010:53:26:ISAKMP(0:1):attsareacceptable.Nextpayloadis010:53:27:ISAKMP(0:1):SAisdoingpre-sharedkeyauthenticationusingidtypeID_IPV4_ADDR10:53:27:ISAKMP(0:1):sendingpacketto22.22.22.22(I)MM_SA_SETUP..10:53:29:ISAKMP(0:1):receivedpacketfrom22.22.22.22(I)MM_SA_SETUP10:53:29:ISAKMP(0:1):processingKEpayload.messageID=010:53:31:ISAKMP(0:1):processingNONCEpayload.messageID=010:53:31:ISAKMP(0:1):foundpeerpre-sharedkeymatching22.22.22.2210:53:31:ISAKMP(0:1):SKEYIDstategenerated10:53:31:ISAKMP(0:1):processingvendoridpayload10:53:31:ISAKMP(0:1):speakingtoanotherIOSbox!10:53:31:ISAKMP(1):IDpayloadnext-payload:8type:1protocol:17port:500length:810:53:31:ISAKMP(1):Totalpayloadlength:1210:53:31:ISAKMP(0:1):sendingpacketto22.22.22.22(I)MM_KEY_EXCH10:53:31:ISAKMP(0:1):receivedpacketfrom22.22.22.22(I)MM_KEY_EXCH10:53:31:ISAKMP(0:1):processingIDpayload.messageID=010:53:31:ISAKMP(0:1):processingHASHpayload.messageID=010:53:31:ISAKMP(0:1):SAhasbeenauthenticatedwith22.22.22.2210:53:31:ISAKMP(0:1):beginningQuickModeex.change,M-IDof-212677278010:53:31:ISAKMP(0:1):sendingpacketto22.22.22.22(I)QM_IDLE10:53:31:ISAKMP(0:1):receivedpacketfrom22.22.22.22(I)QM_IDLE10:53:31:ISAKMP(0:1):processingHASHpayload.messageID=-3767604810:53:31:ISAKMP(0:1):processingNOTIFYPROPOSAL_NOT_CHOSENprotocol0spi0,messageID=-3767604810:53:32:ISAKMP(0:1):deletingnode-37676048errorFALSEreason"informational(in)state1"10:53:32:IPSEC(key_engine):gotaqueueevent...10:53:32:IPSEC(key_engine_delete_sas):rec'ddeletenotifyfromISAKMP10:53:32:IPSEC(key_engine_delete_sas):deleteallSAssharedwith22.22.22.22.....10:53:41:ISAKMP(0:1):retransmittingphase2QM_IDLE-2126772780...10:53:41:ISAKMP(0:1):incrementingerrorcounteronsa:retransmitphase210:53:41:ISAKMP(0:1):incrementingerrorcounteronsa:retransmitphase210:53:41:ISAKMP(0:1):retransmittingphase2-2126772780QM_IDLE10:53:41:ISAKMP(0:1):sendingpacketto22.22.22.22(I)QM_IDLEinitial#shcryisasadstsrcstateconn-idslot22.22.22.2211.11.11.11QM_IDLE10*****************************************************cryptomapciscolocal-addressLoopback0-----------------------------------------------------11:00:06:%CRYPTO-6-IKMP_MODE_FAILURE:ProcessingofInformationalmodefailedwithpeerat22.22.22.22...initial#shcryisasadstsrcstateconn-idslot22.22.22.221.1.1.1MM_NO_STATE10*****************************************************cryptomapcisco10ipsec-isakmpsetpeer22.22.22.21-----------------------------------------------------12:03:52:IPSEC(sa_request):,(keyeng.msg.)src=11.11.11.11,dest=22.22.22.21,src_proxy=1.1.1.1/255.255.255.255/0/0(type=1),dest_proxy=2.2.2.2/255.255.255.255/0/0(type=1),protocol=ESP,transform=esp-desesp-sha-hmac,lifedur=3600sand4608000kb,spi=0x483194BE(1211208894),conn_id=0,keysize=0,flags=0x400412:03:52:ISAKMP:receivedkemessage(1/1)12:03:52:ISAKMP:localport500,remoteport50012:03:52:ISAKMP(0:1):NoCertorpre-sharedaddresskey.12:03:52:ISAKMP(0:1):CannotstartMainmode12:03:52:ISAKMP(0:1):Cannotstartaggressivemode.12:03:52:ISAKMP(0:1):purgingSA.12:03:52:ISAKMP(0:1):purgingnode-355279463..initial#shcryisasadstsrcstateconn-idslot*******************************************************access-list101periphost1.1.1.1any-------------------------------------------------------12:07:22:IPSEC(sa_request):,(keyeng.msg.)src=11.11.11.11,dest=22.22.22.22,src_proxy=1.1.1.1/255.255.255.255/0/0(type=1),dest_proxy=0.0.0.0/0.0.0.0/0/0(type=4),protocol=ESP,transform=esp-desesp-sha-hmac,lifedur=3600sand4608000kb,spi=0x53E1EAB3(1407314611),conn_id=0,keysize=0,flags=0x400412:07:22:ISAKMP:receivedkemessage(1/1)12:07:22:ISAKMP:localport500,remoteport50012:07:22:ISAKMP(0:1):beginningMainModeexchange12:07:22:ISAKMP(0:1):sendingpacketto22.22.22.22(I)MM_NO_STATE..12:07:23:ISAKMP(0:1):receivedpacketfrom22.22.22.22(I)MM_NO_STATE12:07:23:ISAKMP(0:1):processingSApayload.messageID=012:07:23:ISAKMP(0:1):foundpeerpre-sharedkeymatching22.22.22.2212:07:23:ISAKMP(0:1):CheckingISAKMPtransform1againstpriority10policy12:07:23:ISAKMP:encryptionDES-CBC12:07:23:ISAKMP:hashMD512:07:23:ISAKMP:defaultgroup112:07:23:ISAKMP:authpre-share12:07:23:ISAKMP:lifetypeinseconds12:07:23:ISAKMP:lifeduration(VPI)of0x00x10x510x8012:07:23:ISAKMP(0:1):attsareacceptable.Nextpayloadis012:07:25:ISAKMP(0:1):SAisdoingpre-sharedkeyauthenticationusingidtypeID_IPV4_ADDR12:07:25:ISAKMP(0:1):sendingpacketto22.22.22.22(I)MM_SA_SETUP.12:07:27:ISAKMP(0:1):receivedpacketfrom22.22.22.22(I)MM_SA_SETUP12:07:27:ISAKMP(0:1):processingKEpayload.messageID=012:07:29:ISAKMP(0:1):processingNONCEpayload.messageID=012:07:29:ISAKMP(0:1):foundpeerpre-sharedkeymatching22.22.22.2212:07:29:ISAKMP(0:1):SKEYIDstategenerated12:07:29:ISAKMP(0:1):processingvendoridpayload12:07:29:ISAKMP(0:1):speakingtoanotherIOSbox!12:07:29:ISAKMP(1):IDpayloadnext-payload:8type:1protocol:17port:500length:812:07:29:ISAKMP(1):Totalpayloadlength:1212:07:29:ISAKMP(0:1):sendingpacketto22.22.22.22(I)MM_KEY_EXCH12:07:29:ISAKMP(0:1):receivedpacketfrom22.22.22.22(I)MM_KEY_EXCH12:07:29:ISAKMP(0:1):processingIDpayload.messageID=012:07:29:ISAKMP(0:1):processingHASHpayload.messageID=012:07:29:ISAKMP(0:1):SAhasbeenauthenticatedwith22.22.22.2212:07:29:ISAKMP(0:1):beginningQuickModeex.change,M-IDof-65044566512:07:29:ISAKMP(0:1):sendingpacketto22.22.22.22(I)QM_IDLE12:07:29:ISAKMP(0:1):receivedpacketfrom22.22.22.22(I)QM_IDLE12:07:29:ISAKMP(0:1):processingHASHpayload.messageID=150314482812:07:29:ISAKMP(0:1):processingNOTIFYPROPOSAL_NOT_CHOSENprotocol3spi1407314611,messageID=150314482812:07:29:ISAKMP(0:1):deletingspi1407314611messageID=-65044566512:07:29:ISAKMP(0:1):deletingnode-650445665errorTRUEreason"delete_larval"12:07:29:ISAKMP(0:1):deletingnode1503144828errorFALSEreason"informational(in)state1"initial#shcryisasadstsrcstateconn-idslot22.22.22.2211.11.11.11QM_IDLE10*********************************************************initial没有使用cryptomap---------------------------------------------------------initial#pingProtocol[ip]:TargetIPaddress:2.2.2.2Repeatcount[5]:50Datagramsize[100]:Timeoutinseconds[2]:Extendedcommands[n]:ySourceaddressorinterface:1.1.1.1Typeofservice[0]:SetDFbitinIPheader?[no]:Validatereplydata?[no]:Datapattern[0xABCD]:Loose,Strict,Record,Timestamp,Verbose[none]:Sweeprangeofsizes[n]:Typeescapesequencetoabort.Sending50,100-byteICMPEchosto2.2.2.2,timeoutis2seconds:................................************************************************************response没有使用cryptomap------------------------------------------------------------12:15:15:IPSEC(sa_request):,(keyeng.msg.)src=11.11.11.11,dest=22.22.22.22,src_proxy=1.1.1.1/255.255.255.255/0/0(type=1),dest_proxy=0.0.0.0/0.0.0.0/0/0(type=4),protocol=ESP,transform=esp-desesp-sha-hmac,lifedur=3600sand4608000kb,spi=0xE84FF6C5(3897554629),conn_id=0,keysize=0,flags=0x400412:15:15:ISAKMP:receivedkemessage(1/1)12:15:15:ISAKMP:localport500,remoteport50012:15:15:ISAKMP(0:1):beginningMainModeexchange12:15:15:ISAKMP(0:1):sendingpacketto22.22.22.22(I)MM_NO_STATE.12:15:16:ISAKMP(0:1):receivedpacketfrom22.22.22.22(I)MM_NO_STATE12:15:16:ISAKMP(0:1):processingSApayload.messageID=012:15:16:ISAKMP(0:1):foundpeerpre-sharedkeymatching22.22.22.2212:15:16:ISAKMP(0:1):CheckingISAKMPtransform1againstpriority10policy12:15:16:ISAKMP:encryptionDES-CBC12:15:16:ISAKMP:hashMD512:15:16:ISAKMP:defaultgroup112:15:16:ISAKMP:authpre-share12:15:16:ISAKMP:lifetypeinseconds12:15:16:ISAKMP:lifeduration(VPI)of0x00x10x510x8012:15:16:ISAKMP(0:1):attsareacceptable.Nextpayloadis012:15:18:ISAKMP(0:1):SAisdoingpre-sharedkeyauthenticationusingidtypeID_IPV4_ADDR12:15:18:ISAKMP(0:1):sendingpacketto22.22.22.22(I)MM_SA_SETUP..12:15:20:ISAKMP(0:1):receivedpacketfrom22.22.22.22(I)MM_SA_SETUP12:15:20:ISAKMP(0:1):processingKEpayload.messageID=012:15:22:ISAKMP(0:1):processingNONCEpayload.messageID=012:15:22:ISAKMP(0:1):foundpeerpre-sharedkeymatching22.22.22.2212:15:22:ISAKMP(0:1):SKEYIDstategenerated12:15:22:ISAKMP(0:1):processingvendoridpayload12:15:22:ISAKMP(0:1):speakingtoanotherIOSbox!12:15:22:ISAKMP(1):IDpayloadnext-payload:8type:1protocol:17port:500length:812:15:22:ISAKMP(1):Totalpayloadlength:1212:15:22:ISAKMP(0:1):sendingpacketto22.22.22.22(I)MM_KEY_EXCH12:15:22:ISAKMP(0:1):receivedpacketfrom22.22.22.22(I)MM_KEY_EXCH12:15:22:ISAKMP(0:1):processingIDpayload.messageID=012:15:22:ISAKMP(0:1):processingHASHpayload.messageID=012:15:22:ISAKMP(0:1):SAhasbeenauthenticatedwith22.22.22.2212:15:22:ISAKMP(0:1):beginningQuickModee.xchange,M-IDof-4959559612:15:22:ISAKMP(0:1):sendingpacketto22.22.22.22(I)QM_IDLE12:15:22:ISAKMP(0:1):receivedpacketfrom22.22.22.22(I)QM_IDLE12:15:22:ISAKMP(0:1):processingHASHpayload.messageID=-165304404412:15:22:ISAKMP(0:1):processingNOTIFYPROPOSAL_NOT_CHOSENprotocol0spi0,messageID=-165304404412:15:22:ISAKMP(0:1):deletingnode-1653044044errorFALSEreason"informational(in)state1"12:15:22:IPSEC(key_engine):gotaqueueevent...12:15:22:IPSEC(key_engine_delete_sas):rec'ddeletenotifyfromISAKMP12:15:22:IPSEC(key_engine_delete_sas):deleteallSAssharedwith22.22.22.22....initial#shcryisasadstsrcstateconn-idslot22.22.22.2211.11.11.11QM_IDLE10此
课件
超市陈列培训课件免费下载搭石ppt课件免费下载公安保密教育课件下载病媒生物防治课件 可下载高中数学必修四课件打包下载
下载可自行编辑修改，供参考！感谢您的支持，我们努力做得更好！******IKE：提供协商安全参数和创建认证密钥的框架。ESP：提供加密，认证和保护数据的框架。AH：提供认证和保护数据的框架。*具体长度介绍参考vpn设计P4121TheSecurityParametersIndex(SPI)isanarbitrary32-bitvaluethat,incombinationwiththedestinationIPaddressandsecurityprotocol(ESP),uniquelyidentifiestheSecurityAssociationforthisdatagram.2Thesequencenumber,anunsigned32-bitfield,containsamonotonicallyincreasingcountervalue.Itismandatoryandisalwayspresent,evenifthereceiverdoesnotelecttoenabletheantireplayserviceforaspecificSA.3TheNextHeaderisan8-bitfieldthatidentifiesthetypeofdatacontainedinthePayloadDatafield.TheIPdatafieldcontainsthedatatobesent.4TheAuthenticationDatafieldisavariablelengthfieldcontaininganIntegrityCheckValue(ICV)computedovertheESPpacketminustheAuthenticationData.*1TheSecurityParametersIndex(SPI)isanarbitrary32-bitvaluethat,incombinationwiththedestinationIPaddressandsecurityprotocol(ESP),uniquelyidentifiestheSecurityAssociationforthisdatagram.2Thesequencenumber,anunsigned32-bitfield,containsamonotonicallyincreasingcountervalue.Itismandatoryandisalwayspresent,evenifthereceiverdoesnotelecttoenabletheantireplayserviceforaspecificSA.3TheNextHeaderisan8-bitfieldthatidentifiesthetypeofdatacontainedinthePayloadDatafield.TheIPdatafieldcontainsthedatatobesent.4TheAuthenticationDatafieldisavariablelengthfieldcontaininganIntegrityCheckValue(ICV)computedovertheESPpacketminustheAuthenticationData.*1TheSecurityParametersIndex(SPI)isanarbitrary32-bitvaluethat,incombinationwiththedestinationIPaddressandsecurityprotocol(ESP),uniquelyidentifiestheSecurityAssociationforthisdatagram.2Thesequencenumber,anunsigned32-bitfield,containsamonotonicallyincreasingcountervalue.Itismandatoryandisalwayspresent,evenifthereceiverdoesnotelecttoenabletheantireplayserviceforaspecificSA.3TheNextHeaderisan8-bitfieldthatidentifiesthetypeofdatacontainedinthePayloadDatafield.TheIPdatafieldcontainsthedatatobesent.4TheAuthenticationDatafieldisavariablelengthfieldcontaininganIntegrityCheckValue(ICV)computedovertheESPpacketminustheAuthenticationData.*****•NextHeader,an8-bitfield,identifiesthetypeofthenextpayloadaftertheAuthenticationHeader.•ThePayloadLengthfieldisan8-bitfieldspecifyingAH’slengthin32-bitwords(4-byteunits),minus2.•TheReservedfieldisa16-bitfieldreservedforfutureuse.ItMUSTbesetto0.•TheSPIisanarbitrary32-bitvaluethat,incombinationwiththedestinationIPaddressandsecurityprotocol(AH),uniquelyidentifiestheSecurityAssociationforthisdatagram.*•NextHeader,an8-bitfield,identifiesthetypeofthenextpayloadaftertheAuthenticationHeader.•ThePayloadLengthfieldisan8-bitfieldspecifyingAH’slengthin32-bitwords(4-byteunits),minus2.•TheReservedfieldisa16-bitfieldreservedforfutureuse.ItMUSTbesetto0.•TheSPIisanarbitrary32-bitvaluethat,incombinationwiththedestinationIPaddressandsecurityprotocol(AH),uniquelyidentifiestheSecurityAssociationforthisdatagram.*IKE,describedinRFC2409,isahybridprotocol.ItisbasedonaframeworkdefinedbytheInternetSecurityAssociationandKeyManagementProtocol(ISAKMP),definedinRFC2408,andimplementspartsoftwokeymanagementprotocols桹akleyandSKEME.InadditionIKEdefinestwoexchangesofitsown.OakleyisaprotocoldevelopedbyHilarieOrman,acryptographerfromtheUniversityofArizona.Itisafree-formprotocolthatallowseachpartytoadvancethestateoftheprotocolatitsownspeed.FromOakley,IKEborrowedtheideaofdifferentmodes,eachproducingasimilarresult梐nauthenticatedkeyexchange?throughtheexchangeofinformation.InOakley,therewasnodefinitionofwhatinformationtoexchangewitheachmessage.ThemodeswereexamplesofhowOakleycouldbeutilizedtoachieveasecurekeyexchange.IKEcodifiedthemodesintoexchanges.BynarrowingtheflexibilityoftheOakleymodel,IKElimitsthewiderangeofpossibilitiesthatOakleyallowsyetstillprovidesmultiplemodes,albeitinawell-definedmanner.SKEMEisanotherkeyexchangeprotocol,designedbycryptographerHugoKrawczyk.SKEMEdefinesatypeofauthenticatedkeyexchangeinwhichthepartiesusepublickeyencryptiontoauthenticateeachotherand"share"componentsoftheexchange.Eachsideencryptsarandomnumberinthepublickeyofthepeerandbothrandomnumbers(afterdecryption)contributetotheultimatekey.OnecanoptionallydoaDiffie-HellmanexchangealongwiththeSKEMEsharetechniqueforPerfectForwardSecrecy(PFS),ormerelyuseanotherrapidexchange,whichdoesnotrequirepublickeyoperations,torefreshanexistingkey.IKEborrowsthistechniquedirectlyfromSKEMEforoneofitsauthenticationmethods(authenticationwithpublickeyencryption)andalsoborrowsthenotionofrapidkeyrefreshmentwithoutPFS.ISAKMPwasdevelopedbyresearchersattheNationalSecurityAgency(NSA).TheNSAusedtobeasuper-secretorganizationwhoseexistencewasevendeniedbytheUnitedStatesgovernment.Recently,theNSAhascomeoutoftheshadowsanditsconsiderableexpertiseincryptographyandsecurityhasbeenputtovisibleuse.ISAKMPisonesuchoutput.Itisuponthesethreeprotocols桰SAKMP,Oakley,andSKEME梩hatIKEisbased.Itisahybridprotocol;itusesthefoundationofISAKMP,themodesofOakley,andtheshareandrekeyingtechniquesofSKEMEtodefineitsownuniquewayofderivingauthenticatedkeyingmaterialandnegotiatingsharedpolicy.ThecontributionsofOakleyandSKEMEcanbeseeninthediscussionofIKEitself,butthecontributionsofISAKMPareconsiderableenoughtowarrantaseparatediscussion.*AggressivemodeeliminatesseveralstepsduringIKEauthenticationnegotiationphaseIbetweentwoormoreIPSecpeers.Aggressivemodeisfasterthanmainmodebutnotassecure.Aggressivemodeisathree-waypacketexchange,whilemainmodeisasix-waypacketexchange.IKEcanbeconfiguredinaggressivemodeormainmode(notboth).Aggressivemodeisalessintensiveprocessthatrequiresonlythreemessagestoestablishatunnelratherthansixinmainmode.Aggressivemodeistypicallyusedindialupenvironments.*CookiesThefirststepofanyexchangeisanexchangeofcookies.Theseare8bytepseudo-randomnumbersgeneratedbyeachISAKMPentityandassignedtoeachremotepeer.Eachcookieisuniquetotheremotepeerandalsototheparticularexchangeinwhichitisdefined.ThepurposeofthecookiesistoidentifytheISAKMPSAandalsotoprovidesomeanticloggingprotectionagainstcertaindenialofserviceattacks.WhilenomethodofcookiegenerationisproscribedinISAKMP,thetechniqueproposedbyKarnandSimpson(inthePhoturiskeyexchange)isthepreferredmethod:Thecookieistheresultofhashingauniqueidentifierofthepeer(e.g.,hisIPaddressandaportandprotocol),asecretknownonlytothegenerator,andsometimestamp.Inthismanner,eachcookieisboundtotheremotepeeranditistrivialtocheckthatthecookiepresentedbyapeeristheonegiventohim.ThecookiesresideintheISAKMPheader.Toachievethemostanticloggingprotectionoutofthecookies,anexchangewillgenerallydelayexpensiveandintensiveoperations梥uchasexponentiationforaDiffie-Hellmanexchange梪ntilcookieshavebeenexchanged.Inthisway,someprotectionagainstrudimentarydenial-of-serviceattacksispossible.Forinstance,anattackerwhogeneratesthousandsofbogusISAKMPmessageswithfalsereturnaddresseswouldnotcausehistargettodoanysignificantworkbecausethesecondmessagethatcontainsthecookieuniquetothe(bogus)addresswouldnotbereceived.Thecookieexchangetakesplaceinthefirsttwomessagesexchanged.Thefirstmessageisfromtheinitiatoroftheprotocoltotheresponder.TheinitiatorcreatesacookieuniquetotheresponderandtheexchangehewishestobeginandinsertsitintotheinitiatorcookieportionoftheISAKMPheader.Sincethisisthefirstmessagethereisnorespondercookieandthatfieldiszero.Afterthemessagehasbeenreceivedandprocessedtherespondergeneratesacookieforthisexchange.Toformulateareplyhecopiesthistotherespondercookieportionoftheheaderofhisreplyandcopiesthecookieprovidedbytheinitiatorintotheinitiatorcookiefieldoftheheaderofhisreply.TheresponderisabletocreatealarvalISAKMPsecurityassociationidentifiedbythecookiesandsendthemessagebacktotheinitiator.UponreceiptofthisresponsetheinitiatorisabletoupdateherlarvalSAwiththeresponder'scookieandtheexchangecontinues.Obviouslytheinitiatormustcreatesomestatepriortosendingoutthefirstmessage.Ataminimum,thisstatemustcontainthepeertowhichthemessagewassentandthecookiecreatedforhim.Sincehesentoutthemessagebeforeheknewtheresponder'scookie,hemustbepreparedtoidentifythisstatebasedsolelyonhisowncookie.Afterreceivingtheresponder'sfirstmessage,though,he'sabletoupdatethatstatetoincludetheresponder'scookie.TheresponderalsocreatessomestateintheformofthelarvalISAKMPSA.Itdoesnotdoanysignificantworkuntilithasreceivedit'scookiebackfromtheinitiatorandverifiedthatthatcookieiscorrectbasedonthepeer'sIPaddress.AfterthecookieexchangetheconcatenationofthetwocookiesidentifiestheSAinthesamemannerinwhichanSPIidentifiesanIPSecSA.SincethecookiesarepassedaspartoftheISAKMPheaderitisstraightforwardforanentitytolookupthestateassociatedwiththemessage梩heISAKMPSA梪ponreceiptofthemessage.Afteramessageisprocessed,thestateoftheISAKMPSAisupdatedandaresponse,ifrequired,issent.Inthismanner,theexchangeproceedsuntiltheISAKMPSAhasbeencompleted.*ThefirstmessageexchangedofferstheremoterouterachoiceofIPSecparameters,suchasencryptionalgorithm,3DES,MD5,andDHgroupnumber,forexample.Thefirstmessage’saimistonegotiateallSApoliciesandgeneratethesharedsecret.Inthesecondmessage(type2),therespondingdeviceindicateswhichoftheIPSecparametersitwantstouseinthetunnelbetweenthetwodevices,includingtheinformationrequiredtogeneratethesharedsecretandprovideauthenticationdetails.Thefinalmessage(type3;untilnownoencryptionisenabled),whichmightormightnotbeencrypted,authenticatestheinitiator.*PhaseIInegotiationsoccurinamodecalledOakleyquickmodeandhavethreedifferentmessageexchanges.Quickmodecanbethefollowing:•Withoutkeyexchange—NoPFSenabled.•WithKeyexchange—WhenPFSisenabled,theDHalgorithmisrunoncemoretogeneratethesharedsecret.*05:25:42:IPSEC(sa_request):,*****************************************************************************(数据触发sa)(keyeng.msg.)OUTBOUNDlocal=2.2.2.2,remote=4.4.4.4,local_proxy=2.2.2.2/255.255.255.255/0/0(type=1),remote_proxy=4.4.4.4/255.255.255.255/0/0(type=1),protocol=ESP,transform=esp-desesp-sha-hmac,******************************************************(触发的crytomap的细节)lifedur=3600sand4608000kb,spi=0x370E3818(923678744),conn_id=0,keysize=0,flags=0x400D05:25:42:ISAKMP:receivedkemessage(1/1)****************************************************************(P&G用于计算DH公共值)05:25:42:ISAKMP:localport500,remoteport500**********************************************************(本地和远端的接口)05:25:42:ISAKMP(0:2):beginningMainModeexchange05:25:42:ISAKMP(0:2):sendingpacketto4.4.4.4(I)MM_NO_STATE******************************************(发出第一个包)05:25:42:ISAKMP(0:1):purgingnode-277032244.***********************************************************(清扫节点)05:25:44:ISAKMP(0:2):receivedpacketfrom4.4.4.4(I)MM_NO_STATE***************************************(收到第二个包)05:25:44:ISAKMP(0:2):processingSApayload.messageID=0**********************************************(处理SA负载)05:25:44:ISAKMP(0:2):foundpeerpre-sharedkeymatching4.4.4.4*****************************************(只是在匹配地址)05:25:44:ISAKMP(0:2):CheckingISAKMPtransform1againstpriority10policy*****************************(转换负载)05:25:44:ISAKMP:encryptionDES-CBC05:25:44:ISAKMP:hashSHA05:25:44:ISAKMP:defaultgroup105:25:44:ISAKMP:authpre-share05:25:44:ISAKMP:lifetypeinseconds05:25:44:ISAKMP:lifeduration(VPI)of0x00x10x510x80*******************************************(????????)05:25:44:ISAKMP(0:2):attsareacceptable.Nextpayloadis0*********************************************(转换负载可以接受)05:25:45:ISAKMP(0:2):SAisdoingpre-sharedkeyauthenticationusingidtypeID_IPV4_ADDR***************(准备基于ip地址进行认证)05:25:45:ISAKMP(0:2):sendingpacketto4.4.4.4(I)MM_SA_SETUP******************************************(发出第三个包)05:25:48:ISAKMP(0:2):receivedpacketfrom4.4.4.4(I)MM_SA_SETUP***************************************(接受第四个包)05:25:48:ISAKMP(0:2):processingKEpayload.messageID=0**********************************************(处理第四个包里边的DH公共值)05:25:50:ISAKMP(0:2):processingNONCEpayload.messageID=0*******************************************(处理第四个包里边的随机数)05:25:50:ISAKMP(0:2):foundpeerpre-sharedkeymatching4.4.4.4*****************************************(只是在匹配地址)05:25:50:ISAKMP(0:2):SKEYIDstategenerated*************************************************************(产生SKEYID)05:25:50:ISAKMP(0:2):processingvendoridpayload*******************************************************(处理厂商ID)05:25:50:ISAKMP(0:2):speakingtoanotherIOSbox********************************************************(发现是和另一个IOS进行通信)05:25:50:ISAKMP(2):IDpayload next-payload:8 type:1 protocol:17 port:500 length:805:25:50:ISAKMP(2):Totalpayloadlength:1205:25:50:ISAKMP(0:2):sendingpacketto4.4.4.4(I)MM_KEY_EXCH******************************************(发送第五个包)05:25:50:ISAKMP(0:2):receivedpacketfrom4.4.4.4(I)MM_KEY_EXCH***************************************(接受第六个包)05:25:50:ISAKMP(0:2):processingIDpayload.messageID=0**********************************************(处理发送者ip或主机名)05:25:50:ISAKMP(0:2):processingHASHpayload.messageID=0********************************************(处理散列认证负载)05:25:50:ISAKMP(0:2):SAhasbeenauthenticatedwith4.4.4.4*********************************************(认证完成)05:25:50:ISAKMP(0:2):beginningQuickModeexchange,M-IDof643516822***********************************(开始快速模式)05:25:51:ISAKMP(0:2):sendingpacketto4.4.4.4(I)QM_IDLE**********************************************(发送快速模式第一个包)05:25:55:ISAKMP(0:2):receivedpacketfrom4.4.4.4(I)QM_IDLE*******************************************(发送快速模式第二个包)05:25:55:ISAKMP(0:2):processingHASHpayload.messageID=643516822************************************(处理认证数据)05:25:55:ISAKMP(0:2):processingSApayload.messageID=643516822**************************************(处理SA负载)05:25:55:ISAKMP(0:2):CheckingIPSecproposal1**********************************************************(检察第一个提议)05:25:55:ISAKMP:transform1,ESP_DES05:25:55:ISAKMP:attributesintransform:05:25:55:ISAKMP:encapsis105:25:55:ISAKMP:SAlifetypeinseconds05:25:55:ISAKMP:SAlifeduration(basic)of360005:25:55:ISAKMP:SAlifetypeinkilobytes05:25:55:ISAKMP:SAlifeduration(VPI)of0x00x460x500x005:25:55:ISAKMP:authenticatorisHMAC-SHA05:25:55:ISAKMP:groupis105:25:55:ISAKMP(0:2):attsareacceptable.***************************************************************(提议是可以接受的)05:25:55:IPSEC(validate_proposal_request):proposalpart#1,**********************************************(合法的提议负载)(keyeng.msg.)INBOUNDlocal=2.2.2.2,remote=4.4.4.4,local_proxy=2.2.2.2/255.255.255.255/0/0(type=1),remote_proxy=4.4.4.4/255.255.255.255/0/0(type=1),protocol=ES.P,transform=esp-desesp-sha-hmac,lifedur=0sand0kb,spi=0x0(0),conn_id=0,keysize=0,flags=0x1405:25:55:ISAKMP(0:2):processingNONCEpayload.messageID=643516822***********************************(处理随机数负载)05:25:55:ISAKMP(0:2):processingKEpayload.messageID=643516822**************************************(处理新的DH公共值)05:25:57:ISAKMP(0:2):processingIDpayload.messageID=643516822**************************************(处理ID[sourceproxy&destinationproxy])05:25:57:ISAKMP(0:2):processingIDpayload.messageID=64351682205:25:57:ISAKMP(0:2):CreatingIPSecSAs*****************************************************************(创建安全联盟)05:25:57:inboundSAfrom4.4.4.4to2.2.2.2(proxy4.4.4.4to2.2.2.2)************************************(创建进入方向的SPI)05:25:57:hasspi0x370E3818andconn_id2000andflags1505:25:57:lifetimeof3600seconds05:25:57:lifetimeof4608000kilobytes05:25:57:outboundSAfrom2.2.2.2to4.4.4.4(proxy2.2.2.2to4.4.4.4)***********(创建出方向的SPI)05:25:57:hasspi2099365266andconn_id2001andflags1D05:25:57:lifetimeof3600seconds05:25:57:lifetimeof4608000kilobytes05:25:57:ISAKMP(0:2):sendingpacketto4.4.4.4(I)QM_IDLE**********************************************(发送快速模式的最后一个包)05:25:57:ISAKMP(0:2):deletingnode643516822errorFALSEreason""05:25:57:IPSEC(key_engine):gotaqueueevent...05:25:57:IPSEC(initialize_sas):,*************************************************************************(初始化进入安全联盟)(keyeng.msg.)INBOUNDlocal=2.2.2.2,remote=4.4.4.4,local_proxy=2.2.2.2/0.0.0.0/0/0(type=1),remote_proxy=4.4.4.4/0.0.0.0/0/0(type=1),protocol=ESP,transform=esp-desesp-sha-hmac,lifedur=3600sand4608000kb,spi=0x370E3818(923678744),conn_id=2000,keysize=0,flags=0x1505:25:57:IPSEC(initialize_sas):,*************************************************************************(初始化出安全联盟)(keyeng.msg.)OUTBOUNDlocal=2.2.2.2,remote=4.4.4.4,local_proxy=2.2.2.2/0.0.0.0/0/0(type=1),remote_proxy=4.4.4.4/0.0.0.0/0/0(type=1),protocol=ESP,transform=esp-desesp-sha-hmac,lifedur=3600sand4608000kb,spi=0x7D21C592(2099365266),conn_id=2001,keysize=0,flags=0x1D05:25:57:IPSEC(create_sa):sacreated,********************************************************************(安全联盟已建立)(sa)sa_dest=2.2.2.2,sa_prot=50,sa_spi=0x370E3818(923678744),sa_trans=esp-desesp-sha-hmac,sa_conn_id=200005:25:57:IPSEC(create_sa):sacreated,********************************************************************(安全联盟已建立)(sa)sa_dest=4.4.4.4,sa_prot=50,sa_spi=0x7D21C592(2099365266),sa_trans=esp-desesp-sha-hmac,sa_conn_id=2001*cryptoisakmppolicy10hashmd5authenticationpre-sharecryptoisakmpkeyciscoaddress22.22.22.22!!cryptoipsectransform-setciscoesp-desesp-sha-hmac!cryptomapciscolocal-addressLoopback1cryptomapcisco10ipsec-isakmpsetpeer22.22.22.22settransform-setciscomatchaddress101intere0crymapciscoiproute0.0.0.00.0.0.010.1.1.2access-list101permitiphost1.1.1.1host2.2.2.2!****************************************cryptoisakmppolicy10nohashmd5----------------------------------------10:41:57:IPSEC(sa_request):,(keyeng.msg.)src=11.11.11.11,dest=22.22.22.22,src_proxy=1.1.1.1/255.255.255.255/0/0(type=1),dest_proxy=2.2.2.2/255.255.255.255/0/0(type=1),protocol=ESP,transform=esp-desesp-sha-hmac,lifedur=3600sand4608000kb,spi=0x741BA3B8(1947968440),conn_id=0,keysize=0,flags=0x400410:41:57:ISAKMP:receivedkemessage(1/1)10:41:57:ISAKMP:localport500,remoteport50010:41:57:ISAKMP(0:2):beginningMainModeexchange10:41:57:ISAKMP(0:2):sendingpacketto22.22.22.22(I)MM_NO_STATE10:41:57:ISAKMP(0:2):receivedpacketfrom22.22.22.22(I)MM_NO_STATE10:41:57:ISAKMP(0:2):Notifyhasnohash.Rejected.10:41:57:%CRYPTO-6-IKMP_MODE_FAILURE:ProcessingofInformationalmodefailedwithpeerat22.22.22.22initial#shcryisasadstsrcstateconn-idslot22.22.22.2211.11.11.11MM_NO_STATE20*****************************************cryptoisakmpkeycisco1address22.22.22.22-----------------------------------------10:45:35:IPSEC(sa_request):,(keyeng.msg.)src=11.11.11.11,dest=22.22.22.22,src_proxy=1.1.1.1/255.255.255.255/0/0(type=1),dest_proxy=2.2.2.2/255.255.255.255/0/0(type=1),protocol=ESP,transform=esp-desesp-sha-hmac,lifedur=3600sand4608000kb,spi=0xC4A6A9D0(3299256784),conn_id=0,keysize=0,flags=0x400410:45:35:ISAKMP:receivedkemessage(1/1)10:45:35:ISAKMP:localport500,remoteport50010:45:35:ISAKMP(0:1):beginningMainModeexchange10:45:35:ISAKMP(0:1):sendingpacketto22.22.22.22(I)MM_NO_STATE.10:45:37:ISAKMP(0:1):receivedpacketfrom22.22.22.22(I)MM_NO_STATE10:45:37:ISAKMP(0:1):processingSApayload.messageID=010:45:37:ISAKMP(0:1):foundpeerpre-sharedkeymatching22.22.22.2210:45:37:ISAKMP(0:1):CheckingISAKMPtransform1againstpriority10policy10:45:37:ISAKMP:encryptionDES-CBC10:45:37:ISAKMP:hashMD510:45:37:ISAKMP:defaultgroup110:45:37:ISAKMP:authpre-share10:45:37:ISAKMP:lifetypeinseconds10:45:37:ISAKMP:lifeduration(VPI)of0x00x10x510x8010:45:37:ISAKMP(0:1):attsareacceptable.Nextpayloadis010:45:38:ISAKMP(0:1):SAisdoingpre-sharedkeyauthenticationusingidtypeID_IPV4_ADDR10:45:38:ISAKMP(0:1):sendingpacketto22.22.22.22(I)MM_SA_SETUP..10:45:40:ISAKMP(0:1):receivedpacketfrom22.22.22.22(I)MM_SA_SETUP10:45:40:ISAKMP(0:1):processingKEpayload.messageID=010:45:42:ISAKMP(0:1):processingNONCEpayload.messageID=010:45:42:ISAKMP(0:1):foundpeerpre-sharedkeymatching22.22.22.2210:45:42:ISAKMP(0:1):SKEYIDstategenerated10:45:42:ISAKMP(0:1):processingvendoridpayload10:45:42:ISAKMP(0:1):speakingtoanotherIOSbox!10:45:42:ISAKMP(1):IDpayloadnext-payload:8type:1protocol:17port:500length:810:45:42:ISAKMP(1):Totalpayloadlength:1210:45:42:ISAKMP(0:1):sendingpacketto22.22.22.22(I)MM_KEY_EXCH10:45:42:ISAKMP(0:1):receivedpacketfrom22.22.22.22(I)MM_KEY_EXCH10:45:42:ISAKMP:reservednotzeroonNOTIFYpayload!10:45:42:%CRYPTO-4-IKMP_BAD_MESSAGE:IKEmessagefrom22.22.22.22faileditssanitycheckorismalformed.10:45:42:ISAKMP(0:1):incrementingerrorcounteronsa:reset_retransmission10:45:43:ISAKMP(0:1):retransmittingphase1MM_KEY_EXCH...10:45:43:ISAKMP(0:1):incrementingerrorcounteronsa:retransmitphase110:45:43:ISAKMP(0:1):retransmittingphase1MM_KEY_EXCH10:45:43:ISAKMP(0:1):sendingpacketto22.22.22.22(I)MM_KEY_EXCH10:45:43:ISAKMP(0:1):receivedpacketfrom22.22.22.22(I)MM_KEY_EXCH10:45:43:ISAKMP:reservednotzeroonNOTIFYpayload!10:45:43:ISAKMP(0:1):incrementingerrorcounteronsa:reset_retransmission.10:45:44:ISAKMP(0:1):retransmittingphase1MM_KEY_EXCH...10:45:44:ISAKMP(0:1):incrementingerrorcounteronsa:retransmitphase110:45:44:ISAKMP(0:1):retransmittingphase1MM_KEY_EXCH10:45:44:ISAKMP(0:1):sendingpacketto22.22.22.22(I)MM_KEY_EXCH.initial#shcryisasadstsrcstateconn-idslot22.22.22.2211.11.11.11MM_KEY_EXCH10****************************************************cryptoisakmpkeyciscoaddress22.22.22.21----------------------------------------------------10:49:08:IPSEC(sa_request):,(keyeng.msg.)src=11.11.11.11,dest=22.22.22.22,src_proxy=1.1.1.1/255.255.255.255/0/0(type=1),dest_proxy=2.2.2.2/255.255.255.255/0/0(type=1),protocol=ESP,transform=esp-desesp-sha-hmac,lifedur=3600sand4608000kb,spi=0xB977049F(3111584927),conn_id=0,keysize=0,flags=0x400410:49:08:ISAKMP:receivedkemessage(1/1)10:49:08:ISAKMP:localport500,remoteport50010:49:08:ISAKMP(0:1):NoCertorpre-sharedaddresskey.10:49:08:ISAKMP(0:1):CannotstartMainmode10:49:08:ISAKMP(0:1):Cannotstartaggressivemode.10:49:08:ISAKMP(0:1):purgingSA.10:49:08:ISAKMP(0:1):purgingnode-1300701206......initial#shcryisasadstsrcstateconn-idslot******************************************************cryptoipsectransform-setciscoesp-desesp-md5-hmac------------------------------------------------------10:53:24:IPSEC(sa_request):,(keyeng.msg.)src=11.11.11.11,dest=22.22.22.22,src_proxy=1.1.1.1/255.255.255.255/0/0(type=1),dest_proxy=2.2.2.2/255.255.255.255/0/0(type=1),protocol=ESP,transform=esp-desesp-md5-hmac,lifedur=3600sand4608000kb,spi=0x6F87605E(1871143006),conn_id=0,keysize=0,flags=0x400410:53:24:ISAKMP:receivedkemessage(1/1)10:53:24:ISAKMP:localport500,remoteport50010:53:24:ISAKMP(0:1):beginningMainModeexchange10:53:24:ISAKMP(0:1):sendingpacketto22.22.22.22(I)MM_NO_STATE.10:53:26:ISAKMP(0:1):receivedpacketfrom22.22.22.22(I)MM_NO_STATE10:53:26:ISAKMP(0:1):processingSApayload.messageID=010:53:26:ISAKMP(0:1):foundpeerpre-sharedkeymatching22.22.22.2210:53:26:ISAKMP(0:1):CheckingISAKMPtransform1againstpriority10policy10:53:26:ISAKMP:encryptionDES-CBC10:53:26:ISAKMP:hashMD510:53:26:ISAKMP:defaultgroup110:53:26:ISAKMP:authpre-share10:53:26:ISAKMP:lifetypeinseconds10:53:26:ISAKMP:lifeduration(VPI)of0x00x10x510x8010:53:26:ISAKMP(0:1):attsareacceptable.Nextpayloadis010:53:27:ISAKMP(0:1):SAisdoingpre-sharedkeyauthenticationusingidtypeID_IPV4_ADDR10:53:27:ISAKMP(0:1):sendingpacketto22.22.22.22(I)MM_SA_SETUP..10:53:29:ISAKMP(0:1):receivedpacketfrom22.22.22.22(I)MM_SA_SETUP10:53:29:ISAKMP(0:1):processingKEpayload.messageID=010:53:31:ISAKMP(0:1):processingNONCEpayload.messageID=010:53:31:ISAKMP(0:1):foundpeerpre-sharedkeymatching22.22.22.2210:53:31:ISAKMP(0:1):SKEYIDstategenerated10:53:31:ISAKMP(0:1):processingvendoridpayload10:53:31:ISAKMP(0:1):speakingtoanotherIOSbox!10:53:31:ISAKMP(1):IDpayloadnext-payload:8type:1protocol:17port:500length:810:53:31:ISAKMP(1):Totalpayloadlength:1210:53:31:ISAKMP(0:1):sendingpacketto22.22.22.22(I)MM_KEY_EXCH10:53:31:ISAKMP(0:1):receivedpacketfrom22.22.22.22(I)MM_KEY_EXCH10:53:31:ISAKMP(0:1):processingIDpayload.messageID=010:53:31:ISAKMP(0:1):processingHASHpayload.messageID=010:53:31:ISAKMP(0:1):SAhasbeenauthenticatedwith22.22.22.2210:53:31:ISAKMP(0:1):beginningQuickModeex.change,M-IDof-212677278010:53:31:ISAKMP(0:1):sendingpacketto22.22.22.22(I)QM_IDLE10:53:31:ISAKMP(0:1):receivedpacketfrom22.22.22.22(I)QM_IDLE10:53:31:ISAKMP(0:1):processingHASHpayload.messageID=-3767604810:53:31:ISAKMP(0:1):processingNOTIFYPROPOSAL_NOT_CHOSENprotocol0spi0,messageID=-3767604810:53:32:ISAKMP(0:1):deletingnode-37676048errorFALSEreason"informational(in)state1"10:53:32:IPSEC(key_engine):gotaqueueevent...10:53:32:IPSEC(key_engine_delete_sas):rec'ddeletenotifyfromISAKMP10:53:32:IPSEC(key_engine_delete_sas):deleteallSAssharedwith22.22.22.22.....10:53:41:ISAKMP(0:1):retransmittingphase2QM_IDLE-2126772780...10:53:41:ISAKMP(0:1):incrementingerrorcounteronsa:retransmitphase210:53:41:ISAKMP(0:1):incrementingerrorcounteronsa:retransmitphase210:53:41:ISAKMP(0:1):retransmittingphase2-2126772780QM_IDLE10:53:41:ISAKMP(0:1):sendingpacketto22.22.22.22(I)QM_IDLEinitial#shcryisasadstsrcstateconn-idslot22.22.22.2211.11.11.11QM_IDLE10*****************************************************cryptomapciscolocal-addressLoopback0-----------------------------------------------------11:00:06:%CRYPTO-6-IKMP_MODE_FAILURE:ProcessingofInformationalmodefailedwithpeerat22.22.22.22...initial#shcryisasadstsrcstateconn-idslot22.22.22.221.1.1.1MM_NO_STATE10*****************************************************cryptomapcisco10ipsec-isakmpsetpeer22.22.22.21-----------------------------------------------------12:03:52:IPSEC(sa_request):,(keyeng.msg.)src=11.11.11.11,dest=22.22.22.21,src_proxy=1.1.1.1/255.255.255.255/0/0(type=1),dest_proxy=2.2.2.2/255.255.255.255/0/0(type=1),protocol=ESP,transform=esp-desesp-sha-hmac,lifedur=3600sand4608000kb,spi=0x483194BE(1211208894),conn_id=0,keysize=0,flags=0x400412:03:52:ISAKMP:receivedkemessage(1/1)12:03:52:ISAKMP:localport500,remoteport50012:03:52:ISAKMP(0:1):NoCertorpre-sharedaddresskey.12:03:52:ISAKMP(0:1):CannotstartMainmode12:03:52:ISAKMP(0:1):Cannotstartaggressivemode.12:03:52:ISAKMP(0:1):purgingSA.12:03:52:ISAKMP(0:1):purgingnode-355279463..initial#shcryisasadstsrcstateconn-idslot*******************************************************access-list101periphost1.1.1.1any-------------------------------------------------------12:07:22:IPSEC(sa_request):,(keyeng.msg.)src=11.11.11.11,dest=22.22.22.22,src_proxy=1.1.1.1/255.255.255.255/0/0(type=1),dest_proxy=0.0.0.0/0.0.0.0/0/0(type=4),protocol=ESP,transform=esp-desesp-sha-hmac,lifedur=3600sand4608000kb,spi=0x53E1EAB3(1407314611),conn_id=0,keysize=0,flags=0x400412:07:22:ISAKMP:receivedkemessage(1/1)12:07:22:ISAKMP:localport500,remoteport50012:07:22:ISAKMP(0:1):beginningMainModeexchange12:07:22:ISAKMP(0:1):sendingpacketto22.22.22.22(I)MM_NO_STATE..12:07:23:ISAKMP(0:1):receivedpacketfrom22.22.22.22(I)MM_NO_STATE12:07:23:ISAKMP(0:1):processingSApayload.messageID=012:07:23:ISAKMP(0:1):foundpeerpre-sharedkeymatching22.22.22.2212:07:23:ISAKMP(0:1):CheckingISAKMPtransform1againstpriority10policy12:07:23:ISAKMP:encryptionDES-CBC12:07:23:ISAKMP:hashMD512:07:23:ISAKMP:defaultgroup112:07:23:ISAKMP:authpre-share12:07:23:ISAKMP:lifetypeinseconds12:07:23:ISAKMP:lifeduration(VPI)of0x00x10x510x8012:07:23:ISAKMP(0:1):attsareacceptable.Nextpayloadis012:07:25:ISAKMP(0:1):SAisdoingpre-sharedkeyauthenticationusingidtypeID_IPV4_ADDR12:07:25:ISAKMP(0:1):sendingpacketto22.22.22.22(I)MM_SA_SETUP.12:07:27:ISAKMP(0:1):receivedpacketfrom22.22.22.22(I)MM_SA_SETUP12:07:27:ISAKMP(0:1):processingKEpayload.messageID=012:07:29:ISAKMP(0:1):processingNONCEpayload.messageID=012:07:29:ISAKMP(0:1):foundpeerpre-sharedkeymatching22.22.22.2212:07:29:ISAKMP(0:1):SKEYIDstategenerated12:07:29:ISAKMP(0:1):processingvendoridpayload12:07:29:ISAKMP(0:1):speakingtoanotherIOSbox!12:07:29:ISAKMP(1):IDpayloadnext-payload:8type:1protocol:17port:500length:812:07:29:ISAKMP(1):Totalpayloadlength:1212:07:29:ISAKMP(0:1):sendingpacketto22.22.22.22(I)MM_KEY_EXCH12:07:29:ISAKMP(0:1):receivedpacketfrom22.22.22.22(I)MM_KEY_EXCH12:07:29:ISAKMP(0:1):processingIDpayload.messageID=012:07:29:ISAKMP(0:1):processingHASHpayload.messageID=012:07:29:ISAKMP(0:1):SAhasbeenauthenticatedwith22.22.22.2212:07:29:ISAKMP(0:1):beginningQuickModeex.change,M-IDof-65044566512:07:29:ISAKMP(0:1):sendingpacketto22.22.22.22(I)QM_IDLE12:07:29:ISAKMP(0:1):receivedpacketfrom22.22.22.22(I)QM_IDLE12:07:29:ISAKMP(0:1):processingHASHpayload.messageID=150314482812:07:29:ISAKMP(0:1):processingNOTIFYPROPOSAL_NOT_CHOSENprotocol3spi1407314611,messageID=150314482812:07:29:ISAKMP(0:1):deletingspi1407314611messageID=-65044566512:07:29:ISAKMP(0:1):deletingnode-650445665errorTRUEreason"delete_larval"12:07:29:ISAKMP(0:1):deletingnode1503144828errorFALSEreason"informational(in)state1"initial#shcryisasadstsrcstateconn-idslot22.22.22.2211.11.11.11QM_IDLE10*********************************************************initial没有使用cryptomap---------------------------------------------------------initial#pingProtocol[ip]:TargetIPaddress:2.2.2.2Repeatcount[5]:50Datagramsize[100]:Timeoutinseconds[2]:Extendedcommands[n]:ySourceaddressorinterface:1.1.1.1Typeofservice[0]:SetDFbitinIPheader?[no]:Validatereplydata?[no]:Datapattern[0xABCD]:Loose,Strict,Record,Timestamp,Verbose[none]:Sweeprangeofsizes[n]:Typeescapesequencetoabort.Sending50,100-byteICMPEchosto2.2.2.2,timeoutis2seconds:................................************************************************************response没有使用cryptomap------------------------------------------------------------12:15:15:IPSEC(sa_request):,(keyeng.msg.)src=11.11.11.11,dest=22.22.22.22,src_proxy=1.1.1.1/255.255.255.255/0/0(type=1),dest_proxy=0.0.0.0/0.0.0.0/0/0(type=4),protocol=ESP,transform=esp-desesp-sha-hmac,lifedur=3600sand4608000kb,spi=0xE84FF6C5(3897554629),conn_id=0,keysize=0,flags=0x400412:15:15:ISAKMP:receivedkemessage(1/1)12:15:15:ISAKMP:localport500,remoteport50012:15:15:ISAKMP(0:1):beginningMainModeexchange12:15:15:ISAKMP(0:1):sendingpacketto22.22.22.22(I)MM_NO_STATE.12:15:16:ISAKMP(0:1):receivedpacketfrom22.22.22.22(I)MM_NO_STATE12:15:16:ISAKMP(0:1):processingSApayload.messageID=012:15:16:ISAKMP(0:1):foundpeerpre-sharedkeymatching22.22.22.2212:15:16:ISAKMP(0:1):CheckingISAKMPtransform1againstpriority10policy12:15:16:ISAKMP:encryptionDES-CBC12:15:16:ISAKMP:hashMD512:15:16:ISAKMP:defaultgroup112:15:16:ISAKMP:authpre-share12:15:16:ISAKMP:lifetypeinseconds12:15:16:ISAKMP:lifeduration(VPI)of0x00x10x510x8012:15:16:ISAKMP(0:1):attsareacceptable.Nextpayloadis012:15:18:ISAKMP(0:1):SAisdoingpre-sharedkeyauthenticationusingidtypeID_IPV4_ADDR12:15:18:ISAKMP(0:1):sendingpacketto22.22.22.22(I)MM_SA_SETUP..12:15:20:ISAKMP(0:1):receivedpacketfrom22.22.22.22(I)MM_SA_SETUP12:15:20:ISAKMP(0:1):processingKEpayload.messageID=012:15:22:ISAKMP(0:1):processingNONCEpayload.messageID=012:15:22:ISAKMP(0:1):foundpeerpre-sharedkeymatching22.22.22.2212:15:22:ISAKMP(0:1):SKEYIDstategenerated12:15:22:ISAKMP(0:1):processingvendoridpayload12:15:22:ISAKMP(0:1):speakingtoanotherIOSbox!12:15:22:ISAKMP(1):IDpayloadnext-payload:8type:1protocol:17port:500length:812:15:22:ISAKMP(1):Totalpayloadlength:1212:15:22:ISAKMP(0:1):sendingpacketto22.22.22.22(I)MM_KEY_EXCH12:15:22:ISAKMP(0:1):receivedpacketfrom22.22.22.22(I)MM_KEY_EXCH12:15:22:ISAKMP(0:1):processingIDpayload.messageID=012:15:22:ISAKMP(0:1):processingHASHpayload.messageID=012:15:22:ISAKMP(0:1):SAhasbeenauthenticatedwith22.22.22.2212:15:22:ISAKMP(0:1):beginningQuickModee.xchange,M-IDof-4959559612:15:22:ISAKMP(0:1):sendingpacketto22.22.22.22(I)QM_IDLE12:15:22:ISAKMP(0:1):receivedpacketfrom22.22.22.22(I)QM_IDLE12:15:22:ISAKMP(0:1):processingHASHpayload.messageID=-165304404412:15:22:ISAKMP(0:1):processingNOTIFYPROPOSAL_NOT_CHOSENprotocol0spi0,messageID=-165304404412:15:22:ISAKMP(0:1):deletingnode-1653044044errorFALSEreason"informational(in)state1"12:15:22:IPSEC(key_engine):gotaqueueevent...12:15:22:IPSEC(key_engine_delete_sas):rec'ddeletenotifyfromISAKMP12:15:22:IPSEC(key_engine_delete_sas):deleteallSAssharedwith22.22.22.22....initial#shcryisasadstsrcstateconn-idslot22.22.22.2211.11.11.11QM_IDLE10
浙公网安备 33021202002483