000154: Feb 26 23:42:09.078 PCTime: ISAKMP:(0): SA request profile is (NULL)
000155: Feb 26 23:42:09.078 PCTime: ISAKMP: Created a peer struct for 194.215.92.1, peer port 500
000156: Feb 26 23:42:09.078 PCTime: ISAKMP: New peer created peer = 0x82AF328C peer_handle = 0x80000003
000157: Feb 26 23:42:09.078 PCTime: ISAKMP: Locking peer struct 0x82AF328C, refcount 1 for isakmp_initiator
000158: Feb 26 23:42:09.078 PCTime: ISAKMP: local port 500, remote port 500
000159: Feb 26 23:42:09.078 PCTime: ISAKMP: set new node 0 to QM_IDLE
000160: Feb 26 23:42:09.078 PCTime: insert sa successfully sa = 822F7E78
000161: Feb 26 23:42:09.078 PCTime: ISAKMP:(0):Can not start Aggressive mode, trying Main mode.
000162: Feb 26 23:42:09.078 PCTime: ISAKMP:(0):found peer pre-shared key matching 194.215.92.1
000163: Feb 26 23:42:09.082 PCTime: ISAKMP:(0): constructed NAT-T vendor-07 ID
000164: Feb 26 23:42:09.082 PCTime: ISAKMP:(0): constructed NAT-T vendor-03 ID
000165: Feb 26 23:42:09.082 PCTime: ISAKMP:(0): constructed NAT-T vendor-02 ID
000166: Feb 26 23:42:09.082 PCTime: ISAKMP:(0):Input = IKE_MESG_FROM_IPSEC, IKE_SA_REQ_MM
000167: Feb 26 23:42:09.082 PCTime: ISAKMP:(0):Old State = IKE_READY New State = IKE_I_MM1
000168: Feb 26 23:42:09.082 PCTime: ISAKMP:(0): beginning Main Mode exchange
000169: Feb 26 23:42:09.082 PCTime: ISAKMP:(0): sending packet to 194.215.92.1 my_port 500 peer_port 500 (I) MM_NO_STATE
000170: Feb 26 23:42:09.130 PCTime: %SEC-6-IPACCESSLOGP: list hyyremote permitted udp 194.215.92.1(500) -> 87.108.10.17(500), 1 packet
000171: Feb 26 23:42:09.130 PCTime: ISAKMP (0:0): received packet from 194.215.92.1 dport 500 sport 500 Global (I) MM_NO_STATE
000172: Feb 26 23:42:09.130 PCTime: ISAKMP:(0):Notify has no hash. Rejected.
000173: Feb 26 23:42:09.134 PCTime: ISAKMP (0:0): Unknown Input IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY: state = IKE_I_MM1
000174: Feb 26 23:42:09.134 PCTime: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY
000175: Feb 26 23:42:09.134 PCTime: ISAKMP:(0):Old State = IKE_I_MM1 New State = IKE_I_MM1
000176: Feb 26 23:42:09.134 PCTime: %CRYPTO-6-IKMP_MODE_FAILURE: Processing of Informational mode failed with peer at 194.215.92.1
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
!
hostname adsl-unicafe-olivia
!
boot-start-marker
boot-end-marker
!
logging buffered 262144 debugging
logging rate-limit 10
logging console critical
enable secret 5 $1$Y.1x$KiQSASuYiJZBbHrQ1dpyB.
!
aaa new-model
!
!
aaa group server radius rad_eap
!
aaa group server radius rad_mac
!
aaa group server radius rad_acct
!
aaa group server radius rad_admin
!
aaa group server tacacs+ tac_admin
!
aaa group server radius rad_pmip
!
aaa group server radius dummy
!
aaa authentication login default group tacacs+ enable
aaa authentication login eap_methods group rad_eap
aaa authentication login mac_methods local
aaa authentication login console enable
aaa authentication enable default enable
aaa authorization exec default group tacacs+ if-authenticated
aaa accounting exec default start-stop group tacacs+
aaa accounting commands 15 default start-stop group tacacs+
aaa accounting network acct_methods start-stop group rad_acct
aaa accounting system default start-stop group tacacs+
!
aaa session-id common
!
resource policy
!
clock timezone PCTime 2
clock summer-time PCTime date Mar 30 2003 3:00 Oct 26 2003 4:00
ip subnet-zero
no ip source-route
ip cef
no ip dhcp use vrf connected
!
!
!
ip tcp synwait-time 10
no ip bootp server
no ip domain lookup
ip domain name customer.academica.fi
ip name-server 217.64.177.177
ip name-server 217.64.177.178
ip ssh time-out 60
ip ssh authentication-retries 2
!
!
crypto pki trustpoint TP-self-signed-2644435013
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-2644435013
revocation-check none
rsakeypair TP-self-signed-2644435013
!
!
!
!
crypto isakmp policy 10
encr 3des
hash md5
authentication pre-share
crypto isakmp key "salausavain" address 194.x.x.x
!
!
crypto map YYyyYY 10 ipsec-isakmp
set peer 194.x.x.x
set security-association lifetime seconds 86400
match address acl-vpn
!
bridge irb
!
!
interface ATM0
no ip address
no atm ilmi-keepalive
dsl operating-mode auto
!
interface ATM0.1 point-to-point
description ATM0.1 ptp
ip address 87.x.x.x 255.255.255.252
ip access-group xxxx in
atm route-bridged ip
pvc 0/100
encapsulation aal5snap
!
crypto map YYyyYY
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface Dot11Radio0
no ip address
shutdown
!
encryption mode ciphers tkip
!
!
speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0 54.0
channel 2412
station-role root
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 spanning-disabled
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
!
interface Vlan1
description vlan1
no ip address
ip tcp adjust-mss 1452
bridge-group 1
!
interface BVI1
description LAN
ip address 82.x.x.x 255.255.255.248
!
ip classless
ip route 0.0.0.0 0.0.0.0 87.x.x.x
!
no ip http server
ip http access-class 23
ip http authentication local
no ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
ip access-list extended acl-vpn
permit ip 82.x.x.x 0.0.0.7 194.x.x.x.0 0.0.0.63
ip access-list extended hyyremote
permit ip 194.215.92.0 0.0.0.63 any log
deny ip any any
!
logging trap debugging
snmp-server view pingmib ciscoPingEntry included
snmp-server community G00F00R1T view pingmib RW 2
snmp-server community G11F11r0T RO 2
snmp-server location snmp-server location
snmp-server contact
snmp-server enable traps tty
no cdp run
tacacs-server directed-request
tacacs-server key 7 08241A450B2E202F1F
radius-server attribute 32 include-in-access-req format %h
radius-server vsa send accounting
!
control-plane
!
bridge 1 protocol ieee
bridge 1 route ip
banner login ^CCCAuthorized access only!
Disconnect IMMEDIATELY if you are not an authorized user!^C
banner motd ^CCCC
$(hostname).$(domain)
Unauthorized access prohibited.
^C
!
line con 0
password 7 053B1059035A572A16
login authentication console
modem enable
transport preferred none
transport output none
stopbits 1
line aux 0
transport output all
line vty 0 4
access-class 1 in
exec-timeout 60 0
privilege level 15
transport input telnet ssh
transport output all
!
scheduler max-task-time 5000
scheduler allocate 4000 1000
scheduler interval 500
ntp clock-period 17175006
ntp server 217.64.177.129
end
Lokituksia:
000097: Feb 26 23:20:06.040 PCTime: No peer struct to get peer description
000098: Feb 26 23:20:06.396 PCTime: No peer struct to get peer description
000099: Feb 26 23:20:06.740 PCTime: No peer struct to get peer description
000100: Feb 26 23:20:07.092 PCTime: No peer struct to get peer description
000101: Feb 26 23:20:07.388 PCTime: No peer struct to get peer description
000102: Feb 26 23:20:07.732 PCTime: No peer struct to get peer description
000103: Feb 26 23:20:08.068 PCTime: No peer struct to get peer description
000104: Feb 26 23:20:08.404 PCTime: No peer struct to get peer description
000105: Feb 26 23:20:51.023 PCTime: IPSEC(crypto_map_check_encrypt_core): CRYPTO: Packet dropped because cryptomap is currently being created
000106: Feb 26 23:21:08.043 PCTime: %CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd packet not an IPSEC packet.
(ip) vrf/dest_addr= /82.133.128.225, src_addr= 194.215.92.1, prot= 17
000107: Feb 26 23:21:51.006 PCTime: %SEC-6-IPACCESSLOGP: list hyyremote permitted udp 194.215.92.1(500) -> 82.133.128.225(500), 21 packets
000108: Feb 26 23:22:07.626 PCTime: %SYS-5-CONFIG_I: Configured from console by aki on vty0 (82.133.252.1)
000109: Feb 26 23:22:09.573 PCTime: %CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd packet not an IPSEC packet.
(ip) vrf/dest_addr= /82.133.128.225, src_addr= 194.215.92.1, prot= 17
000110: Feb 26 23:23:39.548 PCTime: %CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd packet not an IPSEC packet.
(ip) vrf/dest_addr= /82.133.128.225, src_addr= 194.215.92.1, prot= 17
000111: Feb 26 23:24:41.542 PCTime: %CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd packet not an IPSEC packet.
(ip) vrf/dest_addr= /82.133.128.225, src_addr= 194.215.92.1, prot= 17
000112: Feb 26 23:25:23.758 PCTime: %SYS-5-CONFIG_I: Configured from console by aki on vty0 (82.133.252.1)
000113: Feb 26 23:25:41.541 PCTime: %CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd packet not an IPSEC packet.
(ip) vrf/dest_addr= /82.133.128.225, src_addr= 194.215.92.1, prot= 17
000114: Feb 26 23:26:41.544 PCTime: %CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd packet not an IPSEC packet.
(ip) vrf/dest_addr= /82.133.128.225, src_addr= 194.215.92.1, prot= 17
000115: Feb 26 23:26:50.922 PCTime: %SEC-6-IPACCESSLOGP: list hyyremote permitted udp 194.215.92.1(500) -> 82.133.128.225(500), 15 packets
000116: Feb 26 23:27:04.010 PCTime: %SYS-5-CONFIG_I: Configured from console by aki on vty0 (82.133.252.1)
000117: Feb 26 23:27:43.547 PCTime: %CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd packet not an IPSEC packet.
(ip) vrf/dest_addr= /82.133.128.225, src_addr= 194.215.92.1, prot= 17