[Problem] VPN zwischen Frit!Box 6490 Cable und Cisco ASA 5510

Steinche · 22 Feb 2017

Hallo liebe Foren-Gemeinde,

bevor mich die Sache in den Wahnsinn treibt, brauche ich doch Eure Hilfe.
Eigentlich haben das schon viele gemacht und ich habe auch schon zahllose Beiträge gelesen und zahlreiche Konfigurationsmöglichkeiten getestet, aber keine führte bisher zum Erfolg

Folgende Ausgangslage. In der Firma haben wir eine Cisco ASA 5510, mittels VPN Client (Cisco oder auch Shrew Soft) kann ich mich mit meinem Benutzernamen und Passwort ins Netzwerk einwählen. Aus der .pcf Datei habe ich versucht alle Infos raus zu holen, aber ich bekomme keine passende .cfg für die Fritz!Box hin. Mit VPNs in der Fritz!Box oder auch OpenVPN habe ich schon Erfahrungen gesammelt. Bei meiner 6490 laufen einige VPNs zu anderen Fritz!Boxen, die teilweise eine angepasste Konfig bzgl. des Zugriffs in meinem lokalen Netz haben.

Aus der .pcf Datei habe ich den Pre-Shared Key und Ausgangslage war folgende Konfig für die Fritz!Box:

Code:

vpncfg {        connections {
                enabled = yes;
                conn_type = conntype_lan;
                name = "Firma-Sued";
                always_renew = yes;
                reject_not_encrypted = no;
                dont_filter_netbios = yes;
                localip = 0.0.0.0;
                local_virtualip = 0.0.0.0;
                remoteip = 12.34.56.78;
                remote_virtualip = 0.0.0.0;
                localid {
                        fqdn = "meindyname.no-ip.biz";
                }
                remoteid {
                        ipaddr = "12.34.56.78";
                }
                mode = phase1_mode_idp;
                phase1ss = "alt/aes/sha";
                keytype = connkeytype_pre_shared;
                key = "ABCFg5gdhBd2812GX";
                cert_do_server_auth = no;
                use_nat_t = yes;
                use_xauth = yes;
                xauth {
                    valid = yes;
                    username = "Steinche";
                    passwd = "passwort";
                    }
                use_cfgmode = no;
                phase2localid {
                        ipnet {
                                ipaddr = 192.168.96.0;
                                mask = 255.255.255.0;
                        }
                }
                phase2remoteid {
                        ipnet {
                                ipaddr = 10.192.84.0;
                                mask = 255.255.225.0;
                        }
                }
                phase2ss = "esp-all-all/ah-all/comp-all/no-pfs";
                accesslist = "permit ip any 10.192.84.0 255.255.225.0";
        }
        ike_forward_rules = "udp 0.0.0.0:500 0.0.0.0:500",
                            "udp 0.0.0.0:4500 0.0.0.0:4500";
                                
}
// EOF

Die feste externe IP der ASA habe ich als 12.34.56.78 eingetragen. Wenn ich mich per Software einwähle bekomme ich eine Adresse aus dem Bereich 10.10.10.0/24 zugewiesen, keine Ahnung ob das relevant ist. Weiterhin gibt es in der Firma neben dem Bereich 10.192.84.0/24 noch ein Routing in den Adressbereich 10.192.52.0/24.

Das Logfile des Cisco VPN Clients sieht beim Einwählen so aus:

Code:

36     23:30:55.890  02/21/17  Sev=Info/4    CM/0x63100002
Begin connection process


37     23:30:55.900  02/21/17  Sev=Info/4    CM/0x63100004
Establish secure connection


38     23:30:55.900  02/21/17  Sev=Info/4    CM/0x63100024
Attempt connection with server "12.34.56.78"


39     23:30:55.903  02/21/17  Sev=Info/6    IKE/0x6300003B
Attempting to establish a connection with 12.34.56.78.


40     23:30:55.908  02/21/17  Sev=Info/4    IKE/0x63000001
Starting IKE Phase 1 Negotiation


41     23:30:55.914  02/21/17  Sev=Info/4    IKE/0x63000013
SENDING >>> ISAKMP OAK AG (SA, KE, NON, ID, VID(Xauth), VID(dpd), VID(Frag), VID(Nat-T), VID(Unity)) to 12.34.56.78


42     23:30:55.943  02/21/17  Sev=Info/5    IKE/0x6300002F
Received ISAKMP packet: peer = 12.34.56.78


43     23:30:55.943  02/21/17  Sev=Info/4    IKE/0x63000014
RECEIVING <<< ISAKMP OAK AG (SA, KE, NON, ID, HASH, VID(Unity), VID(Xauth), VID(dpd), VID(Nat-T), NAT-D, NAT-D, VID(Frag), VID(?)) from 12.34.56.78


44     23:30:55.943  02/21/17  Sev=Info/5    IKE/0x63000001
Peer is a Cisco-Unity compliant peer


45     23:30:55.943  02/21/17  Sev=Info/5    IKE/0x63000001
Peer supports XAUTH


46     23:30:55.943  02/21/17  Sev=Info/5    IKE/0x63000001
Peer supports DPD


47     23:30:55.943  02/21/17  Sev=Info/5    IKE/0x63000001
Peer supports NAT-T


48     23:30:55.943  02/21/17  Sev=Info/5    IKE/0x63000001
Peer supports IKE fragmentation payloads


49     23:30:55.949  02/21/17  Sev=Info/6    IKE/0x63000001
IOS Vendor ID Contruction successful


50     23:30:55.949  02/21/17  Sev=Info/4    IKE/0x63000013
SENDING >>> ISAKMP OAK AG *(HASH, NOTIFY:STATUS_INITIAL_CONTACT, NAT-D, NAT-D, VID(?), VID(Unity)) to 12.34.56.78


51     23:30:55.949  02/21/17  Sev=Info/6    IKE/0x63000055
Sent a keepalive on the IPSec SA


52     23:30:55.949  02/21/17  Sev=Info/4    IKE/0x63000083
IKE Port in use - Local Port =  0xDA19, Remote Port = 0x1194


53     23:30:55.949  02/21/17  Sev=Info/5    IKE/0x63000072
Automatic NAT Detection Status:
   Remote end is NOT behind a NAT device
   This   end IS behind a NAT device


54     23:30:55.949  02/21/17  Sev=Info/4    CM/0x6310000E
Established Phase 1 SA.  1 Crypto Active IKE SA, 0 User Authenticated IKE SA in the system


55     23:30:55.975  02/21/17  Sev=Info/5    IKE/0x6300002F
Received ISAKMP packet: peer = 12.34.56.78


56     23:30:55.975  02/21/17  Sev=Info/4    IKE/0x63000014
RECEIVING <<< ISAKMP OAK TRANS *(HASH, ATTR) from 12.34.56.78


57     23:30:55.975  02/21/17  Sev=Info/4    CM/0x63100015
Launch xAuth application


58     23:30:55.978  02/21/17  Sev=Info/6    GUI/0x63B00012
Authentication request attributes is 6h.


59     23:30:56.101  02/21/17  Sev=Info/4    IPSEC/0x63700008
IPSec driver successfully started


60     23:30:56.101  02/21/17  Sev=Info/4    IPSEC/0x63700014
Deleted all keys


61     23:30:56.101  02/21/17  Sev=Info/6    IPSEC/0x6370002C
Sent 254 packets, 0 were fragmented.


62     23:30:58.946  02/21/17  Sev=Info/4    CM/0x63100017
xAuth application returned


63     23:30:58.946  02/21/17  Sev=Info/4    IKE/0x63000013
SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to 12.34.56.78


64     23:30:58.977  02/21/17  Sev=Info/5    IKE/0x6300002F
Received ISAKMP packet: peer = 12.34.56.78


65     23:30:58.977  02/21/17  Sev=Info/4    IKE/0x63000014
RECEIVING <<< ISAKMP OAK TRANS *(HASH, ATTR) from 12.34.56.78


66     23:30:58.977  02/21/17  Sev=Info/4    IKE/0x63000013
SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to 12.34.56.78


67     23:30:58.977  02/21/17  Sev=Info/4    CM/0x6310000E
Established Phase 1 SA.  1 Crypto Active IKE SA, 1 User Authenticated IKE SA in the system


68     23:30:58.981  02/21/17  Sev=Info/5    IKE/0x6300005E
Client sending a firewall request to concentrator


69     23:30:58.982  02/21/17  Sev=Info/4    IKE/0x63000013
SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to 12.34.56.78


70     23:30:59.056  02/21/17  Sev=Info/5    IKE/0x6300002F
Received ISAKMP packet: peer = 12.34.56.78


71     23:30:59.056  02/21/17  Sev=Info/4    IKE/0x63000014
RECEIVING <<< ISAKMP OAK TRANS *(HASH, ATTR) from 12.34.56.78


72     23:30:59.056  02/21/17  Sev=Info/5    IKE/0x63000010
MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_ADDRESS: , value = 10.10.10.4


73     23:30:59.056  02/21/17  Sev=Info/5    IKE/0x63000010
MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_NETMASK: , value = 255.255.255.0


74     23:30:59.056  02/21/17  Sev=Info/5    IKE/0x63000010
MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_DNS(1): , value = 10.192.84.10


75     23:30:59.056  02/21/17  Sev=Info/5    IKE/0x6300000D
MODE_CFG_REPLY: Attribute = MODECFG_UNITY_SAVEPWD: , value = 0x00000000


76     23:30:59.056  02/21/17  Sev=Info/5    IKE/0x6300000D
MODE_CFG_REPLY: Attribute = MODECFG_UNITY_SPLIT_INCLUDE (# of split_nets), value = 0x00000002


77     23:30:59.056  02/21/17  Sev=Info/5    IKE/0x6300000F
SPLIT_NET #1
    subnet = 10.192.84.0 
    mask = 255.255.255.0
    protocol = 0
    src port = 0
    dest port=0


78     23:30:59.056  02/21/17  Sev=Info/5    IKE/0x6300000F
SPLIT_NET #2
    subnet = 10.192.52.0 
    mask = 255.255.255.0
    protocol = 0
    src port = 0
    dest port=0


79     23:30:59.056  02/21/17  Sev=Info/5    IKE/0x6300000E
MODE_CFG_REPLY: Attribute = MODECFG_UNITY_DEFDOMAIN: , value = interne.firmendomain.com


80     23:30:59.056  02/21/17  Sev=Info/5    IKE/0x6300000D
MODE_CFG_REPLY: Attribute = MODECFG_UNITY_PFS: , value = 0x00000000


81     23:30:59.056  02/21/17  Sev=Info/5    IKE/0x6300000E
MODE_CFG_REPLY: Attribute = APPLICATION_VERSION, value = Cisco Systems, Inc ASA5510 Version 8.3(1) built by builders on Thu 04-Mar-10 16:56


82     23:30:59.056  02/21/17  Sev=Info/5    IKE/0x6300000D
MODE_CFG_REPLY: Attribute = MODECFG_UNITY_SMARTCARD_REMOVAL_DISCONNECT: , value = 0x00000001


83     23:30:59.056  02/21/17  Sev=Info/5    IKE/0x6300000D
MODE_CFG_REPLY: Attribute = Received and using NAT-T port number , value = 0x00001194


84     23:30:59.058  02/21/17  Sev=Info/4    CM/0x63100019
Mode Config data received


85     23:30:59.064  02/21/17  Sev=Info/4    IKE/0x63000056
Received a key request from Driver: Local IP = 10.10.10.4, GW IP = 12.34.56.78, Remote IP = 0.0.0.0


86     23:30:59.065  02/21/17  Sev=Info/4    IKE/0x63000013
SENDING >>> ISAKMP OAK QM *(HASH, SA, NON, ID, ID) to 12.34.56.78


87     23:30:59.105  02/21/17  Sev=Info/5    IKE/0x6300002F
Received ISAKMP packet: peer = 12.34.56.78


88     23:30:59.105  02/21/17  Sev=Info/4    IKE/0x63000014
RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:STATUS_RESP_LIFETIME) from 12.34.56.78


89     23:30:59.105  02/21/17  Sev=Info/5    IKE/0x63000045
RESPONDER-LIFETIME notify has value of 86400 seconds


90     23:30:59.105  02/21/17  Sev=Info/5    IKE/0x63000047
This SA has already been alive for 4 seconds, setting expiry to 86396 seconds from now


91     23:30:59.105  02/21/17  Sev=Info/5    IKE/0x6300002F
Received ISAKMP packet: peer = 12.34.56.78


92     23:30:59.105  02/21/17  Sev=Info/4    IKE/0x63000014
RECEIVING <<< ISAKMP OAK QM *(HASH, SA, NON, ID, ID, NOTIFY:STATUS_RESP_LIFETIME) from 12.34.56.78


93     23:30:59.105  02/21/17  Sev=Info/5    IKE/0x63000045
RESPONDER-LIFETIME notify has value of 28800 seconds


94     23:30:59.105  02/21/17  Sev=Info/4    IKE/0x63000013
SENDING >>> ISAKMP OAK QM *(HASH) to 12.34.56.78


95     23:30:59.105  02/21/17  Sev=Info/5    IKE/0x63000059
Loading IPsec SA (MsgID=26673DC4 OUTBOUND SPI = 0x65A1F1B8 INBOUND SPI = 0x0A184A50)


96     23:30:59.106  02/21/17  Sev=Info/5    IKE/0x63000025
Loaded OUTBOUND ESP SPI: 0x65A1F1B8


97     23:30:59.106  02/21/17  Sev=Info/5    IKE/0x63000026
Loaded INBOUND ESP SPI: 0x0A184A50


98     23:30:59.137  02/21/17  Sev=Info/5    CVPND/0x63400013
    Destination           Netmask           Gateway         Interface   Metric
        0.0.0.0           0.0.0.0      192.168.96.1    192.168.96.118       20
      127.0.0.0         255.0.0.0         127.0.0.1         127.0.0.1      306
      127.0.0.1   255.255.255.255         127.0.0.1         127.0.0.1      306
127.255.255.255   255.255.255.255         127.0.0.1         127.0.0.1      306
    169.254.0.0       255.255.0.0   169.254.177.217   169.254.177.217      276
169.254.177.217   255.255.255.255   169.254.177.217   169.254.177.217      276
169.254.255.255   255.255.255.255   169.254.177.217   169.254.177.217      276
   192.168.96.0     255.255.255.0    192.168.96.118    192.168.96.118      276
 192.168.96.118   255.255.255.255    192.168.96.118    192.168.96.118      276
 192.168.96.255   255.255.255.255    192.168.96.118    192.168.96.118      276
  192.168.232.0     255.255.255.0     192.168.232.1     192.168.232.1      276
  192.168.232.1   255.255.255.255     192.168.232.1     192.168.232.1      276
192.168.232.255   255.255.255.255     192.168.232.1     192.168.232.1      276
      224.0.0.0         240.0.0.0         127.0.0.1         127.0.0.1      306
      224.0.0.0         240.0.0.0   169.254.177.217   169.254.177.217      276
      224.0.0.0         240.0.0.0     192.168.232.1     192.168.232.1      276
      224.0.0.0         240.0.0.0    192.168.96.118    192.168.96.118      276
255.255.255.255   255.255.255.255         127.0.0.1         127.0.0.1      306
255.255.255.255   255.255.255.255   169.254.177.217   169.254.177.217      276
255.255.255.255   255.255.255.255     192.168.232.1     192.168.232.1      276
255.255.255.255   255.255.255.255    192.168.96.118    192.168.96.118      276




99     23:30:59.459  02/21/17  Sev=Info/6    CVPND/0x63400001
Launch VAInst64 to control IPSec Virtual Adapter


100    23:31:01.605  02/21/17  Sev=Info/4    CM/0x63100034
The Virtual Adapter was enabled: 
    IP=10.10.10.4/255.255.255.0
    DNS=10.192.84.10,0.0.0.0
    WINS=0.0.0.0,0.0.0.0
    Domain=stg.simstor.co.uk
    Split DNS Names=


101    23:31:01.621  02/21/17  Sev=Info/5    CVPND/0x63400013
    Destination           Netmask           Gateway         Interface   Metric
        0.0.0.0           0.0.0.0      192.168.96.1    192.168.96.118       20
      127.0.0.0         255.0.0.0         127.0.0.1         127.0.0.1      306
      127.0.0.1   255.255.255.255         127.0.0.1         127.0.0.1      306
127.255.255.255   255.255.255.255         127.0.0.1         127.0.0.1      306
    169.254.0.0       255.255.0.0   169.254.177.217   169.254.177.217      276
169.254.177.217   255.255.255.255   169.254.177.217   169.254.177.217      276
169.254.255.255   255.255.255.255   169.254.177.217   169.254.177.217      276
   192.168.96.0     255.255.255.0    192.168.96.118    192.168.96.118      276
 192.168.96.118   255.255.255.255    192.168.96.118    192.168.96.118      276
 192.168.96.255   255.255.255.255    192.168.96.118    192.168.96.118      276
  192.168.232.0     255.255.255.0     192.168.232.1     192.168.232.1      276
  192.168.232.1   255.255.255.255     192.168.232.1     192.168.232.1      276
192.168.232.255   255.255.255.255     192.168.232.1     192.168.232.1      276
      224.0.0.0         240.0.0.0         127.0.0.1         127.0.0.1      306
      224.0.0.0         240.0.0.0   169.254.177.217   169.254.177.217      276
      224.0.0.0         240.0.0.0     192.168.232.1     192.168.232.1      276
      224.0.0.0         240.0.0.0    192.168.96.118    192.168.96.118      276
      224.0.0.0         240.0.0.0           0.0.0.0           0.0.0.0      266
255.255.255.255   255.255.255.255         127.0.0.1         127.0.0.1      306
255.255.255.255   255.255.255.255   169.254.177.217   169.254.177.217      276
255.255.255.255   255.255.255.255     192.168.232.1     192.168.232.1      276
255.255.255.255   255.255.255.255    192.168.96.118    192.168.96.118      276
255.255.255.255   255.255.255.255           0.0.0.0           0.0.0.0      266




102    23:31:03.639  02/21/17  Sev=Info/4    CM/0x63100038
Successfully saved route changes to file.


103    23:31:03.640  02/21/17  Sev=Info/5    CVPND/0x63400013
    Destination           Netmask           Gateway         Interface   Metric
        0.0.0.0           0.0.0.0      192.168.96.1    192.168.96.118       20
     10.10.10.0     255.255.255.0        10.10.10.4        10.10.10.4      266
     10.10.10.4   255.255.255.255        10.10.10.4        10.10.10.4      266
   10.10.10.255   255.255.255.255        10.10.10.4        10.10.10.4      266
    10.192.52.0     255.255.255.0        10.10.10.1        10.10.10.4      100
    10.192.84.0     255.255.255.0        10.10.10.1        10.10.10.4      100
      127.0.0.0         255.0.0.0         127.0.0.1         127.0.0.1      306
      127.0.0.1   255.255.255.255         127.0.0.1         127.0.0.1      306
127.255.255.255   255.255.255.255         127.0.0.1         127.0.0.1      306
    169.254.0.0       255.255.0.0   169.254.177.217   169.254.177.217      276
169.254.177.217   255.255.255.255   169.254.177.217   169.254.177.217      276
169.254.255.255   255.255.255.255   169.254.177.217   169.254.177.217      276
   192.168.96.0     255.255.255.0    192.168.96.118    192.168.96.118      276
   192.168.96.1   255.255.255.255    192.168.96.118    192.168.96.118      100
 192.168.96.118   255.255.255.255    192.168.96.118    192.168.96.118      276
 192.168.96.255   255.255.255.255    192.168.96.118    192.168.96.118      276
  192.168.232.0     255.255.255.0     192.168.232.1     192.168.232.1      276
  192.168.232.1   255.255.255.255     192.168.232.1     192.168.232.1      276
192.168.232.255   255.255.255.255     192.168.232.1     192.168.232.1      276
  12.34.56.78   255.255.255.255      192.168.96.1    192.168.96.118      100
      224.0.0.0         240.0.0.0         127.0.0.1         127.0.0.1      306
      224.0.0.0         240.0.0.0   169.254.177.217   169.254.177.217      276
      224.0.0.0         240.0.0.0     192.168.232.1     192.168.232.1      276
      224.0.0.0         240.0.0.0    192.168.96.118    192.168.96.118      276
      224.0.0.0         240.0.0.0        10.10.10.4        10.10.10.4      266
255.255.255.255   255.255.255.255         127.0.0.1         127.0.0.1      306
255.255.255.255   255.255.255.255   169.254.177.217   169.254.177.217      276
255.255.255.255   255.255.255.255     192.168.232.1     192.168.232.1      276
255.255.255.255   255.255.255.255    192.168.96.118    192.168.96.118      276
255.255.255.255   255.255.255.255        10.10.10.4        10.10.10.4      266




104    23:31:03.640  02/21/17  Sev=Info/6    CM/0x63100036
The routing table was updated for the Virtual Adapter


105    23:31:03.645  02/21/17  Sev=Info/4    CM/0x6310001A
One secure connection established


106    23:31:03.656  02/21/17  Sev=Info/4    CM/0x6310003B
Address watch added for 192.168.96.118.  Current hostname: MeinComputername, Current address(es): 10.10.10.4, 192.168.96.118, 192.168.232.1, 169.254.177.217.


107    23:31:03.657  02/21/17  Sev=Info/4    CM/0x6310003B
Address watch added for 10.10.10.4.  Current hostname: MeinComputername, Current address(es): 10.10.10.4, 192.168.96.118, 192.168.232.1, 169.254.177.217.


108    23:31:03.657  02/21/17  Sev=Info/5    CM/0x63100001
Did not find the Smartcard to watch for removal


109    23:31:03.657  02/21/17  Sev=Info/4    IPSEC/0x63700014
Deleted all keys


110    23:31:03.657  02/21/17  Sev=Info/4    IPSEC/0x63700010
Created a new key structure


111    23:31:03.657  02/21/17  Sev=Info/4    IPSEC/0x6370000F
Added key with SPI=0xb8f1a165 into key list


112    23:31:03.657  02/21/17  Sev=Info/4    IPSEC/0x63700010
Created a new key structure


113    23:31:03.657  02/21/17  Sev=Info/4    IPSEC/0x6370000F
Added key with SPI=0x504a180a into key list


114    23:31:03.657  02/21/17  Sev=Info/4    IPSEC/0x6370002F
Assigned VA private interface addr 10.10.10.4


115    23:31:03.657  02/21/17  Sev=Info/4    IPSEC/0x63700037
Configure public interface: 192.168.96.118. SG: 12.34.56.78


116    23:31:03.658  02/21/17  Sev=Info/6    CM/0x63100046
Set tunnel established flag in registry to 1.


117    23:31:09.286  02/21/17  Sev=Info/4    IKE/0x63000013
SENDING >>> ISAKMP OAK INFO *(HASH, NOTIFY:DPD_REQUEST) to 12.34.56.78


118    23:31:09.286  02/21/17  Sev=Info/6    IKE/0x6300003D
Sending DPD request to 12.34.56.78, our seq# = 1858735758


119    23:31:09.308  02/21/17  Sev=Info/5    IKE/0x6300002F
Received ISAKMP packet: peer = 12.34.56.78


120    23:31:09.308  02/21/17  Sev=Info/4    IKE/0x63000014
RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:DPD_ACK) from 12.34.56.78


121    23:31:09.308  02/21/17  Sev=Info/5    IKE/0x63000040
Received DPD ACK from 12.34.56.78, seq# received = 1858735758, seq# expected = 1858735758


122    23:31:19.433  02/21/17  Sev=Info/4    IKE/0x63000013
SENDING >>> ISAKMP OAK INFO *(HASH, NOTIFY:DPD_REQUEST) to 12.34.56.78


123    23:31:19.433  02/21/17  Sev=Info/6    IKE/0x6300003D
Sending DPD request to 12.34.56.78, our seq# = 1858735759


124    23:31:19.459  02/21/17  Sev=Info/5    IKE/0x6300002F
Received ISAKMP packet: peer = 12.34.56.78


125    23:31:19.459  02/21/17  Sev=Info/4    IKE/0x63000014
RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:DPD_ACK) from 12.34.56.78


126    23:31:19.459  02/21/17  Sev=Info/5    IKE/0x63000040
Received DPD ACK from 12.34.56.78, seq# received = 1858735759, seq# expected = 1858735759

Leider habe ich keinen Zugriff auf die ASA Konfiguration. Unser "ITler" meinte, er würde sich per Fritz!Box einwählen, hat es die letzten Monate aber nicht geschafft, mir die Konfig zukommen zu lassen

Vermutlich ist es nur eine Klitzekleinigkeit, aber ich finde sie nicht.

Hat wer noch den ein oder anderen Tipp zu meiner Konfig, oder Threads die es sich zu lesen lohnt.

Viele Grüße
steinche

Shirocco88 · 22 Feb 2017

Code:

vpncfg {        connections {                enabled = yes;                conn_type = conntype_out;

[/QUOTE]Gibt es einen Grund warum Du nicht conntype_out verwendest ?

Steinche · 23 Feb 2017

Hallo Shirocco88,

danke für die schnelle Antwort. Der Grund ist schlicht Unwissenheit

Habe den Parameter nur mit conntyp=user oder conntype_lan gefunden. Eine Änderung auf conntype=out hilft leider nicht. Hast Du eine Beschreibung aller Parameter der .cfg Datei? Einige habe ich bereits gefunden, aber bei einigen versuche ich mir es zusammenzureimen

Viele Grüße
Steinche

Micha0815 · 23 Feb 2017

So sieht mein "Spickzettel" aus. VPN->Firmennetzwerk

Code:

vpncfg {
        vpncfg_version = 1;
        connections {
                enabled = yes;
                editable = yes;
                conn_type = conntype_out;
                name = "Test";
                boxuser_id = 0;
                always_renew = no;
                reject_not_encrypted = no;
                dont_filter_netbios = no;
                localip = 0.0.0.0;
                local_virtualip = 0.0.0.0;
                remoteip = 0.0.0.0;
                remote_virtualip = 0.0.0.0;
                remotehostname = "Dyndns oder fixe Ip";
                keepalive_ip = IP-Gegenstelle;
                localid {
                        key_id = ".....";
                }
                mode = phase1_mode_aggressive;
                phase1ss = "all/all/all";
                keytype = connkeytype_pre_shared;
                key = "...";
                cert_do_server_auth = no;
                use_nat_t = yes;
                use_xauth = yes;
                xauth {
                        valid = yes;
                        username = ".....";
                        passwd = ".....";
                }
                use_cfgmode = yes;
                phase2localid {
                        ipnet {
                                ipaddr = 0.0.0.0;
                                mask = 0.0.0.0;
                        }
                }
                phase2remoteid {
                        ipnet {
                                ipaddr = 0.0.0.0;
                                mask = 0.0.0.0;
                        }
                }
                phase2ss = "esp-all-all/ah-none/comp-all/no-pfs";
                accesslist = "permit ip any IP-Bereich1 255.255.255.0",
                             "permit ip any IP-Bereich2 255.255.255.0";
                app_id = 0;
        }
        ike_forward_rules = "udp 0.0.0.0:500 0.0.0.0:500",
                            "udp 0.0.0.0:4500 0.0.0.0:4500";
}

LG und ohne Gewähr

Steinche · 23 Feb 2017

Hallo Micha0815,

bei remotehostname steht die IP in Anführungszeichen, bei keepalive_ip aus? Was ist schon beim Webinterface der Fritz!Box nicht kenne ist bei localid die key_id. Ist bei ipnet die Adresse mit 0.0.0.0 ein Platzhalter?

Habe das mal getestet und ich bekomme einen Timeoit Fehler (0x2020)

Bei key_id hatte ich das gleiche wie beim xauth Benutzernamen eingetragen.

Viele Grüße
Steinche

Languages

Suche

Languages

Suche

[Problem] VPN zwischen Frit!Box 6490 Cable und Cisco ASA 5510

Steinche

Neuer User

Shirocco88

Aktives Mitglied

Steinche

Neuer User

Micha0815

IPPF-Promi

Steinche

Neuer User

Zurzeit aktive Besucher

Neueste Beiträge

Statistik des Forums