Я пытаюсь настроить VPN между межсетевым экраном Cisco ASA и Strongswan. Судя по журналам, этап 1 завершается без каких-либо проблем, но на этапе выдается следующая ошибка: «Получено уведомление об ошибке NO_PROPOSAL_CHOSEN».
Конфигурации Strongswan
conn finvpn
auto=start
authby=secret
type=tunnel
#compress=yes
keyexchange=ikev1
left=SW public IP
leftid=SW public IP
leftsubnet=SW private IP
leftfirewall=yes
right=ASA public IP
rightsubnet=ASA privateIP
rightid=ASA public IP
rekey=yes
#fragmentation=yes
#forceencaps=yes
#dpdaction=clear
#dpddelay=300s
ikelifetime=28800s
ike=aes256-sha1-modp1536
esp=aes256-sha1!
lifetime=3600s
Конфигурации ASA для фазы 2
crypto ipsec transform-set SET_NAME esp-aes-256 esp-sha-hmac crypto map CRYPTO_map 15 match address CRYPTONAME crypto map CRYPTO_map 15 set peer StrongswanIP crypto map CRYPTO_map 15 set transform-set SET_NAME crypto map CRYPTO_map 15 set security-association lifetime seconds 3600
Журналы на Strongswan
initiating Main Mode IKE_SA connid[2] to CiscoIP generating ID_PROT request 0 [ SA V V V V V V ] sending packet: from StrongswanIP[500] to CiscoIP[500] (256 bytes) received packet: from CiscoIP[500] to StrongswanIP[500] (124 bytes) parsed ID_PROT response 0 [ SA V V ] received draft-ietf-ipsec-nat-t-ike-02\n vendor ID received FRAGMENTATION vendor ID generating ID_PROT request 0 [ KE No NAT-D NAT-D ] sending packet: from StrongswanIP[500] to CiscoIP[500] (244 bytes) received packet: from CiscoIP[500] to StrongswanIP[500] (304 bytes) parsed ID_PROT response 0 [ KE No V V V V NAT-D NAT-D ] received Cisco Unity vendor ID received XAuth vendor ID received unknown vendor ID: c1:9b:d6:29:0a:e0:8d:c7:c2:73:f2:49:6a:d6:e5:f1 received unknown vendor ID: 1f:07:f7:0e:aa:65:14:d3:b0:fa:96:54:2a:50:01:00 generating ID_PROT request 0 [ ID HASH N(INITIAL_CONTACT) ] sending packet: from StrongswanIP[500] to CiscoIP[500] (100 bytes) received packet: from CiscoIP[500] to StrongswanIP[500] (84 bytes) parsed ID_PROT response 0 [ ID HASH V ] received DPD vendor ID IKE_SA connid[2] established between StrongswanIP[StrongswanIP]...CiscoIP[CiscoIP] scheduling reauthentication in 28213s maximum IKE_SA lifetime 28753s generating QUICK_MODE request 4231731979 [ HASH SA No ID ID ] sending packet: from StrongswanIP[500] to CiscoIP[500] (196 bytes) received packet: from CiscoIP[500] to StrongswanIP[500] (84 bytes) parsed INFORMATIONAL_V1 request 3001395495 [ HASH N(NO_PROP) ] received NO_PROPOSAL_CHOSEN error notify establishing connection 'connid' failed
Любая помощь будет оценена.