取消
显示结果 
搜索替代 
您的意思是: 
cancel
4192
查看次数
0
有帮助
4
回复

ASA L2tp remote vpn

CSCO11269440
Level 1
Level 1
請問各位先進~~新版的ASA Ver 9.X 設定L2TP,
需要注意哪些部份,
按照原廠指令設定還是建立不成功,使用ASDM 精靈跑也是不行,
是否有相關的先進有設定成功的指令~~~
1 个已接受解答

已接受的解答

liyzhao
Cisco Employee
Cisco Employee
CSCO11269440 发表于 2015-1-28 11:28 back.gif
error log
phase 2 mismatch

crypto ipsec ikev1 transform-set my-transform-set-ikev1 esp-des esp-sha-hmac
crypto ipsec ikev1 transform-set my-transform-set-ikev1 mode transport
crypto dynamic-map dyno 10 set ikev1 transform-set trans
transform-set 应该和上面定义的一致,改成my-transform-set-ikev1试一下。
如果还有问题,收集debug crypto isakmp 128

在原帖中查看解决方案

4 条回复4

liyzhao
Cisco Employee
Cisco Employee
CSCO11269440 发表于 2015-1-28 11:28 back.gif
error log
phase 2 mismatch

crypto ipsec ikev1 transform-set my-transform-set-ikev1 esp-des esp-sha-hmac
crypto ipsec ikev1 transform-set my-transform-set-ikev1 mode transport
crypto dynamic-map dyno 10 set ikev1 transform-set trans
transform-set 应该和上面定义的一致,改成my-transform-set-ikev1试一下。
如果还有问题,收集debug crypto isakmp 128

liyzhao
Cisco Employee
Cisco Employee
报什么错?
asa的log看过吗?有报错吗?
客户端是什么设备?
asa具体是怎么配的?

CSCO11269440
Level 1
Level 1
error log
phase 2 mismatch
按照CISCO Configuer
ip local pool sales_addresses 209.165.202.129-209.165.202.158
group-policy sales_policy internal
group-policy sales_policy attributes
wins-server value 209.165.201.3 209.165.201.4
dns-server value 209.165.201.1 209.165.201.2
vpn-tunnel-protocol l2tp-ipsec
tunnel-group DefaultRAGroup general-attributes
default-group-policy sales_policy
address-pool sales_addresses
tunnel-group DefaultRAGroup ipsec-attributes
pre-shared-key *
tunnel-group DefaultRAGroup ppp-attributes
no authentication pap
authentication chap
authentication ms-chap-v1
authentication ms-chap-v2
crypto ipsec ikev1 transform-set my-transform-set-ikev1 esp-des esp-sha-hmac
crypto ipsec ikev1 transform-set my-transform-set-ikev1 mode transport
crypto dynamic-map dyno 10 set ikev1 transform-set trans
crypto map vpn 20 ipsec-isakmp dynamic dyno
crypto map vpn interface outside
crypto ikev1 enable outside
crypto ikev1 policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400

Yanli Sun
Community Manager
Community Manager
您好,不知您的问题是否已经得到满意答复,如果是请您选择“已解决”,感谢您的支持~~~
快捷链接