思科ASA 5505和Juniper ssg5的ipsec问题

Question

我正试图在我们的ASA 5505和Juniper ssg5之间建立一个ipsec隧道。隧道已经开始运行，但我无法通过它获取任何数据。

我所在的本地网络是172.16.1.0，远程是192.168.70.0。但我不能在他们的网络上播放任何东西。当我设置ipsec时，我会收到一个“第二阶段确定”。

我认为这是配置中适用的部分。数据似乎不是通过隧道传送的，但我不确定.

object network our-network
 subnet 172.16.1.0 255.255.255.0
object network their-network
 subnet 192.168.70.0 255.255.255.0
access-list outside_cryptomap extended permit ip object our-network object their-network 
crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac 
crypto map outside_map 1 match address outside_cryptomap
crypto map outside_map 1 set pfs 
crypto map outside_map 1 set peer THEIR_IP
crypto map outside_map 1 set ikev1 phase1-mode aggressive 
crypto map outside_map 1 set ikev1 transform-set ESP-3DES-MD5
crypto map outside_map 1 set ikev2 pre-shared-key *****
crypto map outside_map 1 set reverse-route
crypto map outside_map interface outside

webvpn
group-policy GroupPolicy_THEIR_IP internal
group-policy GroupPolicy_THEIR_IP attributes
 vpn-filter value outside_cryptomap
 ipv6-vpn-filter none
 vpn-tunnel-protocol ikev1 
tunnel-group THEIR_IP type ipsec-l2l
tunnel-group THEIR_IP general-attributes
 default-group-policy GroupPolicy_THEIR_IP
tunnel-group THEIR_IP ipsec-attributes
 ikev1 pre-shared-key *****
 ikev2 remote-authentication pre-shared-key *****
 ikev2 local-authentication pre-shared-key *****
crypto ikev1 enable outside
crypto ikev1 policy 10
 authentication crack
 encryption aes-256
 hash sha
 group 2
 lifetime 86400

Tihis是数据包跟踪器的输出。我使用我的ip作为源，他们的防火墙作为目标，IP与协议0在接口上

ROUTE-LOOKUP
Type -ROUTE-LOOKUP Action -ALLOW
Info
in 0.0.0.0 0.0.0.0 outsied
IT-OPTIONS
Type -IP-OPtions Action -ALLOW
NAT
Tyope -NAT Action -DROP Show rule in NAT Rules table.
Config
object network obj_any
nat (any,outside) dynamic interface
RESULT - The packet is dropped
Input Interface: OUR
Output  Interface:outside
Info: (acl-drop) Flow is denied by configured rule

Answer 1

乍一看，您的配置看起来很正常，尽管我不认为需要反向路由。您忘记添加以"crypto策略“开头的isakmp策略，尽管进入阶段2显然意味着阶段1完成。

1)您是否允许它绕过正常的ACL (通过config: sysopt连接许可-vpn)？

( 2)你能做一个包追踪器并粘贴结果吗？

Answer 2

好吧，有两件事我需要解决：

1)穿越nat (any,any) source static their-network their-network no-proxy-arp隧道的流量

2)更新ACL，使其双向运行：

access-list outside_cryptomap extended permit ip object our-network object their-network 
access-list outside_cryptomap extended permit ip object their-network object our-network 

现在它运转得很好。