Lỗi VPN Site-To-Site

[speedforder219]

Hiện tại em gặp cái lỗi này không biết tại sao nữa.
*Aug 27 09:53:30.075: %CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd packet not an IPSEC packet. (ip) vrf/dest_addr= /192.168.1.255, src_addr= 192.168.1.22, prot= 17
*Aug 27 09:54:30.895: %CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd packet not an IPSEC packet. (ip) vrf/dest_addr= /192.168.1.255, src_addr= 192.168.1.58, prot= 17
*Aug 27 09:55:43.819: %CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd packet not an IPSEC packet. (ip) vrf/dest_addr= /192.168.1.255, src_addr= 192.168.1.41, prot= 17
*Aug 27 09:57:06.907: %CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd packet not an IPSEC packet. (ip) vrf/dest_addr= /192.168.1.255, src_addr= 192.168.1.22, prot= 17


Cấu hình;

R-2901:
Building configuration...

Current configuration : 2789 bytes
!
! Last configuration change at 08:31:59 UTC Wed Aug 26 2015
!
version 15.4
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname TrungTam
!
boot-start-marker
boot-end-marker
!
!
enable secret 5 $1$lrsk$MucpwJgQHm0xX1jdFORKK.
!
no aaa new-model
!
!
!
!
!
!
!
ip cef
no ipv6 cef
!
multilink bundle-name authenticated
!
!
!
!
!
!
username KCN password 7 05202521011D1C5A59
!
redundancy
!
!
!
!
!
!
!
crypto isakmp policy 10
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key KCN address 0.0.0.0
!
!
crypto ipsec transform-set MYSET esp-3des esp-md5-hmac
mode tunnel
!
!
!
crypto dynamic-map TT-VPN 10
set security-association lifetime seconds 86400
set transform-set MYSET
match address VPN-CongNgheCao
crypto dynamic-map TT-VPN 11
set security-association lifetime seconds 86400
set transform-set MYSET
match address VPN-LinhTrung1
!
!
crypto map VPN 1 ipsec-isakmp dynamic TT-VPN
!
!
!
!
!
interface Embedded-Service-Engine0/0
no ip address
shutdown
!
interface GigabitEthernet0/0
description "Connect ISP"
ip address dhcp
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
pppoe enable group global
pppoe-client dial-pool-number 1
crypto map VPN
!
interface GigabitEthernet0/1
description "Connec LAN"
ip address 192.168.21.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
duplex auto
speed auto
!
interface Dialer1
mtu 1492
ip address xxxxxxxxxx
ip nat outside
ip virtual-reassembly in
encapsulation ppp
dialer pool 1
dialer-group 1
ppp authentication pap chap callin
ppp chap hostname xxxxx
ppp chap password 7 010102145C06111B3654
ppp pap sent-username xxxx password 7 06140B314B431E0D120F
crypto map VPN
!
ip forward-protocol nd
!
no ip http server
no ip http secure-server
!
ip nat inside source list 99 interface Dialer1 overload
ip route 0.0.0.0 0.0.0.0 Dialer1
ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0
!
ip access-list extended VPN-CongNgheCao
permit ip 192.168.21.0 0.0.0.255 192.168.1.0 0.0.0.255
permit ip any any
ip access-list extended VPN-LinhTrung1
permit ip 192.168.21.0 0.0.0.255 192.168.2.0 0.0.0.255
ip access-list extended VPN1
!
!
!
access-list 99 permit 192.168.21.0 0.0.0.255 log
access-list 99 permit any
!
control-plane
!
!
!
line con 0
line aux 0
line 2
no activation-character
no exec
transport preferred none
transport output pad telnet rlogin lapb-ta mop udptn v120 ssh
stopbits 1
line vty 0 4
access-class 99 in
password 7 062D2C0F6C1F5B4A
login
transport input telnet ssh
!
scheduler allocate 20000 1000
!
!
pnp profile pnp_profile
transport http host pnpserver.Home port 80 source GigabitEthernet0/0
end



R-867

Building configuration...

Current configuration : 1557 bytes
!
! Last configuration change at 02:42:29 UTC Wed Aug 26 2015
version 15.2
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname KhuCongNgheCao
!
boot-start-marker
boot-end-marker
!
!
enable password KCN@123
!
no aaa new-model
wan mode dsl
!
!
!
!
!
!
ip cef
no ipv6 cef
!
!
!
!
!
!
!
!
!
controller VDSL 0
!
!
!
!
!
!
crypto isakmp policy 10
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key KCN address 113.161.38.137
!
!
crypto ipsec transform-set MYSET esp-3des esp-md5-hmac
mode tunnel
!
!
!
crypto map VPN-TO-TT 10 ipsec-isakmp
set peer 113.161.38.137
set transform-set MYSET
match address VPN
!
!
!
!
!
interface ATM0
no ip address
shutdown
no atm ilmi-keepalive
!
interface Ethernet0
no ip address
shutdown
!
interface FastEthernet0
no ip address
!
interface FastEthernet1
no ip address
!
interface FastEthernet2
no ip address
!
interface FastEthernet3
no ip address
!
interface GigabitEthernet0
no ip address
!
interface GigabitEthernet1
no ip address
shutdown
duplex auto
speed auto
!
interface Vlan1
ip address 192.168.1.10 255.255.255.0
crypto map VPN-TO-TT
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!
!
ip route 0.0.0.0 0.0.0.0 192.168.1.1
!
ip access-list extended VPN
permit ip any 192.168.21.0 0.0.0.255
!
mac-address-table aging-time 15
!
!
line con 0
no modem enable
line aux 0
line vty 0 4
password KCN@123
login
transport input telnet ssh
!
scheduler allocate 60000 1000
!
end

[speedforder219]

Log đổ về


Tram1#ping 192.168.21.1 source 192.168.1.51
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.21.1, timeout is 2 seconds:
Packet sent with a source address of 192.168.1.51

*Aug 27 10:33:02.147: ISAKMP:(0): SA request profile is (NULL)
*Aug 27 10:33:02.147: ISAKMP: Created a peer struct for 113.161.38.137, peer port 500
*Aug 27 10:33:02.147: ISAKMP: New peer created peer = 0x84E13250 peer_handle = 0x80000005
*Aug 27 10:33:02.147: ISAKMP: Locking peer struct 0x84E13250, refcount 1 for isakmp_initiator
*Aug 27 10:33:02.147: ISAKMP: local port 500, remote port 500
*Aug 27 10:33:02.147: ISAKMP: set new node 0 to QM_IDLE
*Aug 27 10:33:02.147: ISAKMP:(0):insert sa successfully sa = 874CE540
*Aug 27 10:33:02.147: ISAKMP:(0):Can not start Aggressive mode, trying Main mode.
*Aug 27 10:33:02.147: ISAKMP:(0):found peer pre-shared key matching 113.161.38.137
*Aug 27 10:33:02.147: ISAKMP:(0): constructed NAT-T vendor-rfc3947 ID
*Aug 27 10:33:02.147: ISAKMP:(0): constructed NAT-T vendor-07 ID
*Aug 27 10:33:02.147: ISAKMP:(0): constructed NAT-T vendor-03 ID
*Aug 27 10:33:02.147: ISAKMP:(0): constructed NAT-T vendor-02 ID
*Aug 27 10:33:02.147: ISAKMP:(0):Input = IKE_MESG_FROM_IPSEC, IKE_SA_REQ_MM
*Aug 27 10:33:02.147: ISAKMP:(0):Old State = IKE_READY New State = IKE_I_MM1

*Aug 27 10:33:02.147: ISAKMP:(0): beginning Main Mode exchange
*Aug 27 10:33:02.147: ISAKMP:(0): sending packet to 113.161.38.137 my_port 500 peer_port 500 (I) MM_NO_STATE
*Aug 27 10:33:02.147: ISAKMP:(0):Sending an IKE IPv4 Packet......
Success rate is 0 percent (0/5)
Tram1#
*Aug 27 10:33:12.147: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE...
*Aug 27 10:33:12.147: ISAKMP (0): incrementing error counter on sa, attempt 1 of 5: retransmit phase 1
*Aug 27 10:33:12.147: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE
*Aug 27 10:33:12.147: ISAKMP:(0): sending packet to 113.161.38.137 my_port 500 peer_port 500 (I) MM_NO_STATE
*Aug 27 10:33:12.147: ISAKMP:(0):Sending an IKE IPv4 Packet.
*Aug 27 10:33:12.547: %CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd packet not an IPSEC packet. (ip) vrf/dest_addr= /224.0.0.252, src_addr= 192.168.1.38, prot= 17
*Aug 27 10:33:22.147: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE...
*Aug 27 10:33:22.147: ISAKMP (0): incrementing error counter on sa, attempt 2 of 5: retransmit phase 1
*Aug 27 10:33:22.147: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE
*Aug 27 10:33:22.147: ISAKMP:(0): sending packet to 113.161.38.137 my_port 500 peer_port 500 (I) MM_NO_STATE
*Aug 27 10:33:22.147: ISAKMP:(0):Sending an IKE IPv4 Packet.
*Aug 27 10:33:32.147: ISAKMP: set new node 0 to QM_IDLE
*Aug 27 10:33:32.147: ISAKMP:(0):SA is still budding. Attached new ipsec request to it. (local 192.168.1.51, remote 113.161.38.137)
*Aug 27 10:33:32.147: ISAKMP: Error while processing SA request: Failed to initialize SA
*Aug 27 10:33:32.147: ISAKMP: Error while processing KMI message 0, error 2.
*Aug 27 10:33:32.147: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE...
*Aug 27 10:33:32.147: ISAKMP (0): incrementing error counter on sa, attempt 3 of 5: retransmit phase 1
*Aug 27 10:33:32.147: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE
*Aug 27 10:33:32.147: ISAKMP:(0): sending packet to 113.161.38.137 my_port 500 peer_port 500 (I) MM_NO_STATE
*Aug 27 10:33:32.147: ISAKMP:(0):Sending an IKE IPv4 Packet.
*Aug 27 10:33:42.147: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE...
*Aug 27 10:33:42.147: ISAKMP (0): incrementing error counter on sa, attempt 4 of 5: retransmit phase 1
*Aug 27 10:33:42.147: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE
*Aug 27 10:33:42.147: ISAKMP:(0): sending packet to 113.161.38.137 my_port 500 peer_port 500 (I) MM_NO_STATE
*Aug 27 10:33:42.147: ISAKMP:(0):Sending an IKE IPv4 Packet.
*Aug 27 10:33:52.147: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE...
*Aug 27 10:33:52.147: ISAKMP (0): incrementing error counter on sa, attempt 5 of 5: retransmit phase 1
*Aug 27 10:33:52.147: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE
*Aug 27 10:33:52.147: ISAKMP:(0): sending packet to 113.161.38.137 my_port 500 peer_port 500 (I) MM_NO_STATE
*Aug 27 10:33:52.147: ISAKMP:(0):Sending an IKE IPv4 Packet.
*Aug 27 10:34:02.147: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE...
*Aug 27 10:34:02.147: ISAKMP:(0):peer does not do paranoid keepalives.

*Aug 27 10:34:02.147: ISAKMP:(0):deleting SA reason "Death by retransmission P1" state (I) MM_NO_STATE (peer 113.161.38.137)
*Aug 27 10:34:02.147: ISAKMP:(0):deleting SA reason "Death by retransmission P1" state (I) MM_NO_STATE (peer 113.161.38.137)
*Aug 27 10:34:02.147: ISAKMP: Unlocking peer struct 0x84E13250 for isadb_mark_sa_deleted(), count 0
*Aug 27 10:34:02.147: ISAKMP: Deleting peer node by peer_reap for 113.161.38.137: 84E13250
*Aug 27 10:34:02.147: ISAKMP:(0):deleting node 1797047820 error FALSE reason "IKE deleted"
*Aug 27 10:34:02.147: ISAKMP:(0):deleting node 1219673663 error FALSE reason "IKE deleted"
*Aug 27 10:34:02.147: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PHASE1_DEL
*Aug 27 10:34:02.147: ISAKMP:(0):Old State = IKE_I_MM1 New State = IKE_DEST_SA

*Aug 27 10:34:27.095: %CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd packet not an IPSEC packet. (ip) vrf/dest_addr= /224.0.0.252, src_addr= 192.168.1.38, prot= 17
*Aug 27 10:34:52.147: ISAKMP:(0):purging node 1797047820
*Aug 27 10:34:52.147: ISAKMP:(0):purging node 1219673663

[dangquangminh]

lỗi này là do crypto access list ở hai đầu chưa "match" hoặc là cấu hình routing chưa chính xác.

https://supportforums.cisco.com/document/15966/user-receives-error-message-crypto-4-recvdpktnotipsec-recd-packet-not-ipsec-packetip

[speedforder219]

theo như cấu hình của em ở trên thì em thấy đúng mà ta.
lúc ping tới thì nó báo phase không thiết lập đc bị lỗi =.=