IPSecトンネルでOSPF

新しい会社に入社し、研修室で色々ネットワーク組んで遊んでるんだけど、YAMAHAルータはあまり触ったことがないからわからない。Ciscoルータでもまだまだなのに。
で、CIscoとYAMAHAでIPSec接続したあとにOSPFで経路情報をやりとりしようとするんだけども、上手くいかない。誰かわかる人いないかな。。。

■YAMAHA RouterとCisco4500でIPSec接続(Static Routing)

*************************************
* Router_A -- RTX1100
* Router_B -- Cisco4500
*************************************

Router_A# show config
# RTX1100 Rev.8.02.31 (Fri Jan 14 11:04:37 2005)
# MAC Address : 00:a0:de:30:30:75, 00:a0:de:30:30:76, 00:a0:de:30:30:77,
# Memory 32Mbytes, 3LAN, 1BRI
# main:  RTX1100 ver=c0 serial=N1A001616 MAC-Address=00:a0:de:30:30:75
MAC-Addr
ess=00:a0:de:30:30:76 MAC-Address=00:a0:de:30:30:77
security class 1 on on
console prompt Router_A
ip route 192.168.1.0/24 gateway tunnel 1
ip lan1 address 192.168.0.254/24
ip lan2 address 10.0.0.1/24
tunnel select 1
 ipsec tunnel 101
  ipsec sa policy 101 1 esp des-cbc sha-hmac
  ipsec ike group 1 modp1024
  ipsec ike hash 1 sha
  ipsec ike local address 1 10.0.0.1
  ipsec ike local id 1 192.168.0.0/24
  ipsec ike negotiate-strictly 1 on
  ipsec ike pre-shared-key 1 text himitsu
  ipsec ike remote address 1 10.0.0.2
  ipsec ike remote id 1 192.168.1.0/24
 tunnel enable 1
ipsec auto refresh on

Router_B#show run
Building configuration...

Current configuration : 1387 bytes
!
version 12.2
service timestamps debug datetime
service timestamps log datetime
no service password-encryption
!
hostname Router_B
!
enable secret 5 $1$uMK5$U4kEFQ8fmu8Wx0tGt4mHA0
!
ip subnet-zero
!
!
crypto isakmp policy 10
 authentication pre-share
 group 2
crypto isakmp key himitsu address 10.0.0.1
!
!
crypto ipsec transform-set ZZZ esp-des esp-sha-hmac
!
crypto map cisco 10 ipsec-isakmp
 set peer 10.0.0.1
 set security-association lifetime seconds 28800
 set transform-set ZZZ
 match address Cisco
!
!
!
!
interface Ethernet0
 ip address 10.0.0.2 255.255.255.0
 media-type 10BaseT
 crypto map cisco
!
interface Ethernet1
 ip address 192.168.1.254 255.255.255.0
 media-type 10BaseT
!
interface Serial0
 no ip address
 shutdown
 no fair-queue
!
interface Serial1
 no ip address
 shutdown
!
interface Serial2
 no ip address
 shutdown
!
interface Serial3
 no ip address
 shutdown
!
interface BRI0
 no ip address
 encapsulation hdlc
 shutdown
!
interface BRI1
 no ip address
 encapsulation hdlc
 shutdown
!
interface BRI2
 no ip address
 encapsulation hdlc
 shutdown
!
interface BRI3
 no ip address
 encapsulation hdlc
 shutdown
!
ip classless
ip route 192.168.0.0 255.255.255.0 10.0.0.1
no ip http server
!
!
ip access-list extended Cisco
 permit ip 192.168.1.0 0.0.0.255 192.168.0.0 0.0.0.255
!
line con 0
line aux 0
line vty 0 4
 exec-timeout 0 0
 password pass
 login
!
end

と、まぁこんな感じで接続させているんだけどCiscoルータでdebugしてると

*Dec  6 08:06:40: %CRYPTO-4-RECVD_PKT_INV_IDENTITY: identity doesn't match
negotiated identity
        (ip) dest_addr= 224.0.0.5, src_addr= 192.168.0.254, prot= 89
        (ident) local=10.0.0.2, remote=10.0.0.1
         local proxy=192.168.1.0/255.255.255.0/0/0,
         remote_proxy=192.168.0.0/255.255.255.0/0/0

という感じでね、OSPFのHelloパケットをポリシー違反として弾いてしまうのです。他にやり方があるのかな。
結局俺は分からずで、スタティックでルーティングさせて終わりました。

コメント