IPSEC ***的配置步骤

试验目的：熟悉配置IPSEC ***的步骤

试验拓扑：

配置步骤：

R1:lo0:1.1.1.1/24

lo1:192.168.12.2/24

ser1/1:202.100.12.2

R2:ser1/0:202.100.12.1

ser1/1:202.100.23.1

R3:lo0:3.3.3.3/24

ser1/0:202.100.23.3

配置文件；

R1:

ip route 0.0.0.0 0.0.0.0 Serial1/1

第一步：

ip access-list extended *** ／／定义感兴趣的流量通过ＩＰＳＥＣ的隧道

permit ip 192.168.12.0 0.0.0.255 192.168.23.0 0.0.0.255／／允许源１９２.１６８.１２.０到目的地址 位１９２.１６８.２３.０的地址

第二步：

ＩＳＡＫＭＰ的 策略：

R1(config)#crypto isakmp policy 10

R1(config-isakmp)#?

ISAKMP commands:

authentication Set authentication method for protection suite

default Set a command to its defaults

encryption Set encryption algorithm for protection suite

exit Exit from ISAKMP protection suite configuration mode

group Set the Diffie-Hellman group

hash Set hash algorithm for protection suite

lifetime Set lifetime for ISAKMP security association

no Negate a command or set its defaults

R1(config-isakmp)#au

R1(config-isakmp)#authentication ?

pre-share Pre-Shared Key

rsa-encr Rivest-Shamir-Adleman Encryption

rsa-sig Rivest-Shamir-Adleman Signature

R1(config-isakmp)#authentication pr

R1(config-isakmp)#authentication pre-share ?

<cr>

R1(config-isakmp)#authentication pre-share ／／配置验证方法

R1(config-isakmp)#hash ?

md5 Message Digest 5

sha Secure Hash Standard

R1(config-isakmp)#hash md5 ?／／配置散列算法

<cr>

R1(config-isakmp)#enc

R1(config-isakmp)#encryption ?

3des Three key triple DES

aes AES - Advanced Encryption Standard.

des DES - Data Encryption Standard (56 bit keys).

R1(config-isakmp)#encryption des ?

<cr>

R1(config-isakmp)#encryption des ／／配置加密算法

R1(config-isakmp)#lis

R1(config-isakmp)#lif

R1(config-isakmp)#lifetime ?

<60-86400> lifetime in seconds

R1(config-isakmp)#lifetime ／／默认是８６４００，即一天的生存时间

R1(config)#crypto isakmp key 0 cisco address 202.100.23.3 ／／配置ＩＳＡＫＭＰ预共享密钥

意思是与对等体２０２.１００.２３.３共享的预共享密钥配置位ｃｉｓｃｏ，并且是明文的。其中ＫＥＹ后面的数字有２个：０－－－代表不加密，６－－－代表加密

R1(config)#crypto isakmp key ?

0 Specifies an UNENCRYPTED password will follow

6 Specifies an ENCRYPTED password will follow

第三步：

配置ＩＰＳＥＣ变换集：

R1(config)#crypto ipsec transform-set myset esp-3des esp-md5-hmac ／／ｉｐｓｅｃ变换集中指定了ＩＫＥ阶段２期间协商的ＩＰＳＥＣ ＳＡ使用的加密参数，定义的参数包括安全和压缩协议，散列算法和加密算法

／／此例中定义了一个名为ｍｙｓｅｔ的变换集，他指定了２种变换，使用３ｄｅｓ算法进行加密的ＥＳＰ ，使用ＭＤ５－ＨＭＡＣ算法的认证

R1(cfg-crypto-trans)#mode tunnel

第四步：

配置加密映射表：

R1(config)#crypto map mymap 10 ipsec-isakmp ／／创建ｍｙｍａｐ的加密映射表，并配置了序号位１０的条目

R1(config-crypto-map)#match address *** ／／指定加密列表为命名的访问控制列表ＶＰＮ

R1(config-crypto-map)#set transform-set myset ?／／指定ＩＰＳＥＣ的变换集ｍｙｓｅｔ

WORD Proposal tag

<cr>

R1(config-crypto-map)#set transform-set myset

R1(config-crypto-map)#set peer 202.100.23.3／／指定对等体的ＩＰ地址，这里指的是Ｒ３的ｓ１／０的接口地址

加密映射表将对等体地址，变换集和加密访问控制列表组合在一起，指定了要保护那些数据流，以及向ＩＰＳＥＣ对等体发送数据流和接受来自该对等体的数据流时如何对他们进行加密。

第五步：

将加密映射表应用于外部接口：

interface Serial1/1

ip address 202.100.12.2 255.255.255.0

serial restart-delay 0

crypto map mymap

查看命令：

R1#show crypto isakmp sa ／／查看第一阶段的ｓａ

IPv4 Crypto ISAKMP SA

dst src state conn-id slot status

202.100.12.2 202.100.23.3 QM_IDLE 1002 0 ACTIVE

IPv6 Crypto ISAKMP SA／／说明ＩＫＥ中模式协商成功了，快速模式处于空闲状态，如果不是这个状态（MM_NO_STATE）说明协商有问题。

R1#show crypto isakmp sa

IPv4 Crypto ISAKMP SA

dst src state conn-id slot status

202.100.12.2 202.100.23.3 MM_NO_STATE 1002 0 ACTIVE (deleted)

R1# show crypto ipsec sa ／／产科第二阶段的转换集

interface: Serial1/1

Crypto map tag: mymap, local addr 202.100.12.2

protected vrf: (none)

local ident (addr/mask/prot/port): (192.168.12.0/255.255.255.0/0/0)

remote ident (addr/mask/prot/port): (192.168.23.0/255.255.255.0/0/0)

current_peer 202.100.23.3 port 500

PERMIT, flags={origin_is_acl,}

#pkts encaps: 63, #pkts encrypt: 63, #pkts digest: 63

#pkts decaps: 62, #pkts decrypt: 62, #pkts verify: 62

#pkts compressed: 0, #pkts decompressed: 0

#pkts not compressed: 0, #pkts compr. failed: 0

#pkts not decompressed: 0, #pkts decompress failed: 0

#send errors 0, #recv errors 0

local crypto endpt.: 202.100.12.2, remote crypto endpt.: 202.100.23.3

path mtu 1500, ip mtu 1500, ip mtu idb Serial1/1

current outbound spi: 0x2FD22A7A(802302586)

inbound esp sas:

spi: 0xC4CCBD8F(3301752207) 这个值应该和Ｒ３的ｏｕｔｂｏｕｎｄ一致，意思是双方通过这个值的计算，从而知道双方用的是什么认证方法，什么加密算法。

transform: esp-3des esp-md5-hmac ,

--More--

*Jun 8 17:12:22.135: ISAKMP:(1003):purging node -482876207

in use settings ={Tunnel, }

conn id: 5, flow_id: 5, crypto map: mymap

sa timing: remaining key lifetime (k/sec): (4605658/3556)

IV size: 8 bytes

replay detection support: Y

Status: ACTIVE

inbound ah sas:

inbound pcp sas:

outbound esp sas:

spi: 0x2FD22A7A(802302586)

transform: esp-3des esp-md5-hmac ,

in use settings ={Tunnel, }

conn id: 6, flow_id: 6, crypto map: mymap

sa timing: remaining key lifetime (k/sec): (4605658/3520)

IV size: 8 bytes

replay detection support: Y

Status: ACTIVE

outbound ah sas:

outbound pcp sas:

R1#

R1#sho crypto engine connections active ／／显示第二阶段ＳＡ的概要信息

Crypto Engine Connections

ID Interface Type Algorithm Encrypt Decrypt IP-Address

5 Se1/1 IPsec 3DES+MD5 0 4 202.100.12.2

6 Se1/1 IPsec 3DES+MD5 4 0 202.100.12.2

1003 Se1/1 IKE MD5+DES 0 0 202.100.12.2

隧道的终结：

分两种形式：１.自动终结 ２.手动终结

自动终结通过下面的ｌｉｆｅｔｉｍｅ终结，他有两种方法进行修改：sa timing: remaining key lifetime (k/sec): (4605658/3520)一种是通过流量（即当该隧道接收一定的流量阀值后，隧道将自动的更改两边的共享密钥）和通过时间修改

R1(config)#crypto map mymap 10

R1(config-crypto-map)#set

R1(config-crypto-map)#set se

R1(config-crypto-map)#set security-association ?

idle-time Automatically delete IPSec SAs after a given idle period.

level specify a security association granularity level for identities

lifetime security association lifetime

replay Set replay checking.

R1(config-crypto-map)#set security-association lif

R1(config-crypto-map)#set security-association lifetime ?

kilobytes Volume-based key duration

seconds Time-based key duration

R1(config-crypto-map)#set security-association lifetime

R1#show crypto isakmp policy

Global IKE policy

Protection suite of priority 10

encryption algorithm: DES - Data Encryption Standard (56 bit keys).

hash algorithm: Message Digest 5

authentication method: Pre-Shared Key

Diffie-Hellman group: #1 (768 bit)

lifetime: 86400 seconds, no volume limit

Default protection suite

encryption algorithm: DES - Data Encryption Standard (56 bit keys).

hash algorithm: Secure Hash Standard

authentication method: Rivest-Shamir-Adleman Signature

Diffie-Hellman group: #1 (768 bit)

lifetime: 86400 seconds, no volume limit ／／意思是如果一天都没有流量通过的话，系统自动将中断这个隧道。

手动终结：

R3#clear crypto isakmp ／／手动清除第一阶段的

R3#clear crypto sa ? ／／手动清除第二阶段的

手动清除后Ｒ１上的debug crypto isakmp后的调试信息：

*Jun 8 17:22:45.111: ISAKMP (0:1003): received packet from 202.100.23.3 dport 500 sport 500 Global (R) QM_IDLE

*Jun 8 17:22:45.115: ISAKMP: set new node -1433032546 to QM_IDLE

*Jun 8 17:22:45.119: ISAKMP:(1003): processing HASH payload. message ID = -1433032546

*Jun 8 17:22:45.123: ISAKMP:received payload type 18

*Jun 8 17:22:45.123: ISAKMP:(1003): processing DELETE_WITH_REASON payload, message ID = -1433032546, reason: Unknown delete reason!

*Jun 8 17:22:45.127: ISAKMP:(1003):peer does not do paranoid keepalives.

*Jun 8 17:22:45.131: ISAKMP:(1003):deleting SA reason "Death by tree-walk" state (R) QM_IDLE (peer 202.100.23.3)

*Jun 8 17:22:45.135: ISAKMP:(1003):deleting node -1433032546 error FALSE reason "Informational (in) state 1"

*Jun 8 17:22:45.135: ISAKMP: set new node 1529654592 to QM_IDLE

*Jun 8 17:22:45.135: ISAKMP:(1003): sending packet to 202.100.23.3 my_port 500 peer_port 500 (R) QM_IDLE

*Jun 8 17:22:45.135: ISAKMP:(1003

R1#):purging node 1529654592

*Jun 8 17:22:45.135: ISAKMP:(1003):Input = IKE_MESG_INTERNAL, IKE_PHASE1_DEL

*Jun 8 17:22:45.135: ISAKMP:(1003):Old State = IKE_P1_COMPLETE New State = IKE_DEST_SA

*Jun 8 17:22:45.135: ISAKMP:(1003):deleting SA reason "Death by tree-walk" state (R) QM_IDLE (peer 202.100.23.3)

*Jun 8 17:22:45.135: ISAKMP: Unlocking peer struct 0x66392FD0 for isadb_mark_sa_deleted(), count 0

*Jun 8 17:22:45.135: ISAKMP:(1003):deleting node -1433032546 error FALSE reason "IKE deleted"

*Jun 8 17:22:45.135: ISAKMP:(1003):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH

*Jun 8 17:22:45.135: ISAKMP:(1003):Old State = IKE_DEST_SA New State = IKE_DEST_SA

在Ｒ３上激活：

R3#ping 192.168.12.2 source lo1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.12.2, timeout is 2 seconds:

Packet sent with a source address of 192.168.23.3

.!!!!

Success rate is 80 percent (4/5), round-trip min/avg/max = 52/84/120 ms

R3#show cry

R3#show crypto is

R3#show crypto isakmp sa

IPv4 Crypto ISAKMP SA

dst src state conn-id slot status

202.100.12.2 202.100.23.3 QM_IDLE 1004 0 ACTIVE

IPv6 Crypto ISAKMP SA

R1#

*Jun 8 17:24:08.455: ISAKMP (0:0): received packet from 202.100.23.3 dport 500 sport 500 Global (N) NEW SA

*Jun 8 17:24:08.459: ISAKMP: Found a peer struct for 202.100.23.3, peer port 500

*Jun 8 17:24:08.463: ISAKMP: Locking peer struct 0x66392FD0, refcount 1 for crypto_isakmp_process_block

*Jun 8 17:24:08.467: ISAKMP: local port 500, remote port 500

*Jun 8 17:24:08.471: insert sa successfully sa = 65568894

*Jun 8 17:24:08.471: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH

*Jun 8 17:24:08.475: ISAKMP:(0):Old State = IKE_READY New State = IKE_R_MM1

*Jun 8 17:24:08.487: ISAKMP:(0): processing SA payload. message ID = 0

*Jun 8 17:24:08.491: ISAKMP:(0): processing vendor id payload

*Jun 8 17:24:08.491: ISAKMP:(0): vendor ID seems Unity/DPD but major 245 mismatch

*Jun 8 17:24:08.495: ISAKMP (0:0): vendor ID is NAT-T v7

*Jun 8 17:24:08.495: ISAKMP:(0): processing vendor id payload

*Jun 8 17:24:08.499: ISAKMP:(0): vendor ID seems Unity/DPD but major 157 mi

R1#smatch

*Jun 8 17:24:08.499: ISAKMP:(0): vendor ID is NAT-T v3

*Jun 8 17:24:08.503: ISAKMP:(0): processing vendor id payload

*Jun 8 17:24:08.503: ISAKMP:(0): vendor ID seems Unity/DPD but major 123 mismatch

*Jun 8 17:24:08.503: ISAKMP:(0): vendor ID is NAT-T v2

*Jun 8 17:24:08.503: ISAKMP:(0):found peer pre-shared key matching 202.100.23.3

*Jun 8 17:24:08.503: ISAKMP:(0): local preshared key found

*Jun 8 17:24:08.503: ISAKMP : Scanning profiles for xauth ...

*Jun 8 17:24:08.503: ISAKMP:(0):Checking ISAKMP transform 1 against priority 10 policy

*Jun 8 17:24:08.503: ISAKMP: encryption DES-CBC

*Jun 8 17:24:08.503: ISAKMP: hash MD5

*Jun 8 17:24:08.503: ISAKMP: default group 1

*Jun 8 17:24:08.503: ISAKMP: auth pre-share

*Jun 8 17:24:08.503: ISAKMP: life type in seconds

*Jun 8 17:24:08.503: ISAKMP: life duration (VPI) of 0x0 0x1 0x51 0x80

*Jun 8 17:24:08.503: ISAKMP:(0):atts are acceptable. Next payload is 0

*Jun 8 17:24:08.503:

R1# ISAKMP:(0): processing vendor id payload

*Jun 8 17:24:08.503: ISAKMP:(0): vendor ID seems Unity/DPD but major 245 mismatch

*Jun 8 17:24:08.503: ISAKMP (0:0): vendor ID is NAT-T v7

*Jun 8 17:24:08.503: ISAKMP:(0): processing vendor id payload

*Jun 8 17:24:08.503: ISAKMP:(0): vendor ID seems Unity/DPD but major 157 mismatch

*Jun 8 17:24:08.503: ISAKMP:(0): vendor ID is NAT-T v3

*Jun 8 17:24:08.503: ISAKMP:(0): processing vendor id payload

*Jun 8 17:24:08.503: ISAKMP:(0): vendor ID seems Unity/DPD but major 123 mismatch

*Jun 8 17:24:08.503: ISAKMP:(0): vendor ID is NAT-T v2

*Jun 8 17:24:08.503: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE

*Jun 8 17:24:08.503: ISAKMP:(0):Old State = IKE_R_MM1 New State = IKE_R_MM1

*Jun 8 17:24:08.515: ISAKMP:(0): constructed NAT-T vendor-07 ID

*Jun 8 17:24:08.519: ISAKMP:(0): sending packet to 202.100.23.3 my_port 500 peer_port 500 (R) MM_SA_SETUP

*Jun 8 17:24:08.523: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_

R1#PROCESS_COMPLETE

*Jun 8 17:24:08.523: ISAKMP:(0):Old State = IKE_R_MM1 New State = IKE_R_MM2

*Jun 8 17:24:08.655: ISAKMP (0:0): received packet from 202.100.23.3 dport 500 sport 500 Global (R) MM_SA_SETUP

*Jun 8 17:24:08.659: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH

*Jun 8 17:24:08.663: ISAKMP:(0):Old State = IKE_R_MM2 New State = IKE_R_MM3

*Jun 8 17:24:08.675: ISAKMP:(0): processing KE payload. message ID = 0

*Jun 8 17:24:08.687: ISAKMP:(0): processing NONCE payload. message ID = 0

*Jun 8 17:24:08.695: ISAKMP:(0):found peer pre-shared key matching 202.100.23.3

*Jun 8 17:24:08.703: ISAKMP:(1004): processing vendor id payload

*Jun 8 17:24:08.703: ISAKMP:(1004): vendor ID is Unity

*Jun 8 17:24:08.703: ISAKMP:(1004): processing vendor id payload

*Jun 8 17:24:08.703: ISAKMP:(1004): vendor ID is DPD

*Jun 8 17:24:08.703: ISAKMP:(1004): processing vendor id payload

*Jun 8 17:24:08.703: ISAKMP:(1004): speaking to another IOS box!

*Jun 8 17:24:08.7

R1#03: ISAKMP:(1004):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE

*Jun 8 17:24:08.703: ISAKMP:(1004):Old State = IKE_R_MM3 New State = IKE_R_MM3

*Jun 8 17:24:08.703: ISAKMP:(1004): sending packet to 202.100.23.3 my_port 500 peer_port 500 (R) MM_KEY_EXCH

*Jun 8 17:24:08.703: ISAKMP:(1004):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE

*Jun 8 17:24:08.703: ISAKMP:(1004):Old State = IKE_R_MM3 New State = IKE_R_MM4

*Jun 8 17:24:08.755: ISAKMP (0:1004): received packet from 202.100.23.3 dport 500 sport 500 Global (R) MM_KEY_EXCH

*Jun 8 17:24:08.763: ISAKMP:(1004):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH

*Jun 8 17:24:08.763: ISAKMP:(1004):Old State = IKE_R_MM4 New State = IKE_R_MM5

*Jun 8 17:24:08.767: ISAKMP:(1004): processing ID payload. message ID = 0

*Jun 8 17:24:08.767: ISAKMP (0:1004): ID payload

next-payload : 8

type : 1

address : 202.100.23.3

protocol : 17

port : 500

length : 12

*Jun 8 17:24:08.767: ISA

R1#KMP:(0):: peer matches *none* of the profiles

*Jun 8 17:24:08.767: ISAKMP:(1004): processing HASH payload. message ID = 0

*Jun 8 17:24:08.767: ISAKMP:(1004): processing NOTIFY INITIAL_CONTACT protocol 1

spi 0, message ID = 0, sa = 65568894

*Jun 8 17:24:08.767: ISAKMP:(1004):SA authentication status:

authenticated

*Jun 8 17:24:08.767: ISAKMP:(1004):SA has been authenticated with 202.100.23.3

*Jun 8 17:24:08.767: ISAKMP:(1004):SA authentication status:

authenticated

*Jun 8 17:24:08.767: ISAKMP:(1004): Process initial contact,

bring down existing phase 1 and 2 SA's with local 202.100.12.2 remote 202.100.23.3 remote port 500

*Jun 8 17:24:08.767: ISAKMP:(1004):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE

*Jun 8 17:24:08.767: ISAKMP:(1004):Old State = IKE_R_MM5 New State = IKE_R_MM5

*Jun 8 17:24:08.783: ISAKMP:(1004):SA is doing pre-shared key authentication using id type ID_IPV4_ADDR

*Jun 8 17:24:08.783: ISAKMP (0:1004): ID payload

next-payload : 8

t

R1#ype : 1

address : 202.100.12.2

protocol : 17

port : 500

length : 12

*Jun 8 17:24:08.791: ISAKMP:(1004):Total payload length: 12

*Jun 8 17:24:08.795: ISAKMP:(1004): sending packet to 202.100.23.3 my_port 500 peer_port 500 (R) MM_KEY_EXCH

*Jun 8 17:24:08.799: ISAKMP:(1004):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE

*Jun 8 17:24:08.803: ISAKMP:(1004):Old State = IKE_R_MM5 New State = IKE_P1_COMPLETE

*Jun 8 17:24:08.819: ISAKMP: set new node -527725077 to QM_IDLE

*Jun 8 17:24:08.827: ISAKMP:(1004): sending packet to 202.100.23.3 my_port 500 peer_port 500 (R) MM_KEY_EXCH

*Jun 8 17:24:08.831: ISAKMP:(1004):purging node -527725077

*Jun 8 17:24:08.831: ISAKMP:(1004):Input = IKE_MESG_FROM_IPSEC, IKE_PHASE2_DEL

*Jun 8 17:24:08.835: ISAKMP:(1004):Old State = IKE_P1_COMPLETE New State = IKE_P1_COMPLETE

*Jun 8 17:24:08.839: ISAKMP:(1004):Input = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE

*Jun 8 17:24:08.843: ISAKMP:(10

R1#04):Old State = IKE_P1_COMPLETE New State = IKE_P1_COMPLETE

*Jun 8 17:24:09.023: ISAKMP (0:1004): received packet from 202.100.23.3 dport 500 sport 500 Global (R) QM_IDLE

*Jun 8 17:24:09.027: ISAKMP: set new node -1887564288 to QM_IDLE

*Jun 8 17:24:09.031: ISAKMP:(1004): processing HASH payload. message ID = -1887564288

*Jun 8 17:24:09.031: ISAKMP:(1004): processing SA payload. message ID = -1887564288

*Jun 8 17:24:09.031: ISAKMP:(1004):Checking IPSec proposal 1

*Jun 8 17:24:09.031: ISAKMP: transform 1, ESP_3DES

*Jun 8 17:24:09.031: ISAKMP: attributes in transform:

*Jun 8 17:24:09.031: ISAKMP: encaps is 1 (Tunnel)

*Jun 8 17:24:09.031: ISAKMP: SA life type in seconds

*Jun 8 17:24:09.031: ISAKMP: SA life duration (basic) of 3600

*Jun 8 17:24:09.031: ISAKMP: SA life type in kilobytes

*Jun 8 17:24:09.031: ISAKMP: SA life duration (VPI) of 0x0 0x46 0x50 0x0

*Jun 8 17:24:09.031: ISAKMP: authenticator is HMAC-MD5

*J

R1#un 8 17:24:09.031: ISAKMP:(1004):atts are acceptable.

*Jun 8 17:24:09.031: ISAKMP:(1004): processing NONCE payload. message ID = -1887564288

*Jun 8 17:24:09.031: ISAKMP:(1004): processing ID payload. message ID = -1887564288

*Jun 8 17:24:09.031: ISAKMP:(1004): processing ID payload. message ID = -1887564288

*Jun 8 17:24:09.031: ISAKMP:(1004):QM Responder gets spi

*Jun 8 17:24:09.035: ISAKMP:(1004):Node -1887564288, Input = IKE_MESG_FROM_PEER, IKE_QM_EXCH

*Jun 8 17:24:09.035: ISAKMP:(1004):Old State = IKE_QM_READY New State = IKE_QM_SPI_STARVE

*Jun 8 17:24:09.055: ISAKMP:(1004): Creating IPSec SAs

*Jun 8 17:24:09.055: inbound SA from 202.100.23.3 to 202.100.12.2 (f/i) 0/ 0

(proxy 192.168.23.0 to 192.168.12.0)

*Jun 8 17:24:09.059: has spi 0xAAD36E3E and conn_id 0

*Jun 8 17:24:09.059: lifetime of 3600 seconds

*Jun 8 17:24:09.063: lifetime of 4608000 kilobytes

*Jun 8 17:24:09.067: outbound SA from 202.100.12.2 to

R1#202.100.23.3 (f/i) 0/0

(proxy 192.168.12.0 to 192.168.23.0)

*Jun 8 17:24:09.067: has spi 0x1DC528BB and conn_id 0

*Jun 8 17:24:09.071: lifetime of 3600 seconds

*Jun 8 17:24:09.071: lifetime of 4608000 kilobytes

*Jun 8 17:24:09.075: ISAKMP:(1004): sending packet to 202.100.23.3 my_port 500 peer_port 500 (R) QM_IDLE

*Jun 8 17:24:09.079: ISAKMP:(1004):Node -1887564288, Input = IKE_MESG_INTERNAL, IKE_GOT_SPI

*Jun 8 17:24:09.079: ISAKMP:(1004):Old State = IKE_QM_SPI_STARVE New State = IKE_QM_R_QM2

*Jun 8 17:24:09.143: ISAKMP (0:1004): received packet from 202.100.23.3 dport 500 sport 500 Global (R) QM_IDLE

*Jun 8 17:24:09.151: ISAKMP:(1004):deleting node -1887564288 error FALSE reason "QM done (await)"

*Jun 8 17:24:09.151: ISAKMP:(1004):Node -1887564288, Input = IKE_MESG_FROM_PEER, IKE_QM_EXCH

*Jun 8 17:24:09.155: ISAKMP:(1004):Old State = IKE_QM_R_QM2 New State = IKE_QM_PHASE2_COMPLETE