IPSCE的debug和show命令.docx

通过 DEBUG 与 SHOW 来学习 IPSEC-VPN 第一阶段指两个 ISAKMP 实体建立一个安全、验证过的信道来进行通信。这被称为 ISAKMP 安全联盟（SA）。“主模式”和“积极模式”都能完成第一阶段的交换。“主模式”和“积极模式”只能在第一阶段中使用。*Mar 1 00:43:53.455: ISAKMP:(0:2:SW:1):purging SA., sa=63E0FA04, delme=63E0FA04 *Mar 1 00:44:05.639: ISAKMP:(0:3:SW:1):purging node 304912037 *Mar 1 00:44:07.279: ISAKMP: received ke message (1/1) *Mar 1 00:44:07.283: ISAKMP:(0:0:N/A:0): SA request profile is (NULL) SA 是有一个或多个提议的 SA 协商负载。发起方可能提供多个协商的提议；应答方只能用一个提议来回答。安全联盟（SA）是一组用来保护信息的策略和密钥。在本协议中，ISAKMP SA 是协商双方为保护之间的通信而使用的共享的策略和密钥。*Mar 1 00:44:07.283: ISAKMP: Created a peer struct for 34.34.34.4, peer port 500 *Mar 1 00:44:07.283: ISAKMP: New peer created peer = 0x64A20E00 peer_handle = 0x80000005 *Mar 1 00:44:07.283: ISAKMP: Locking peer struct 0x64A20E00, IKE refcount 1 for isakmp_initiator *Mar 1 00:44:07.287: ISAKMP: local port 500, remote port 500 *Mar 1 00:44:07.287: ISAKMP: set new node 0 to QM_IDLE *Mar 1 00:44:07.287: ISAKMP: Find a dup sa in the avl tree during calling isadb_insert sa = 64219D2C *Mar 1 00:44:07.287: ISAKMP:(0:0:N/A:0):Can not start Aggressive mode, trying Main mode. “主模式”和“积极模式”都能完成第一阶段的交换。“主模式”和“积极模式”只能在第一阶段中使用。主模式是 ISAKMP 身份保护交换的实现：头两个消息协商策略；下两个消息交换 DiffieHellman 的公共值和必要的辅助数据（当前时间（nonce）；最后的两个消息验证 DiffieHellman 交换。*Mar 1 00:44:07.291: ISAKMP:(0:0:N/A:0):found peer preshared key matching 34.34.34.4 *Mar 1 00:44:07.291: ISAKMP:(0:0:N/A:0): constructed NATT vendor07 ID *Mar 1 00:44:07.295: ISAKMP:(0:0:N/A:0): constructed NATT vendor03 ID *Mar 1 00:44:07.295: ISAKMP:(0:0:N/A:0): constructed NATT vendor02 ID 头两个消息协商策略；（开始）*Mar 1 00:44:07.295: ISAKMP:(0:0:N/A:0):Input = IKE_MESG_FROM_IPSEC, IKE_SA_REQ_MM *Mar 1 00:44:07.295: ISAKMP:(0:0:N/A:0):Old State = IKE_READY New State = IKE_I_MM1 主模式（开始）；*Mar 1 00:44:07.299: ISAKMP:(0:0:N/A:0): beginning Main Mode exchange *Mar 1 00:44:07.299: ISAKMP:(0:0:N/A:0): sending packet to 34.34.34.4 my_port 500 peer_port 500 (I) MM_NO_STATE *Mar 1 00:44:07.931: ISAKMP (0:0): received packet from 34.34.34.4 dport 500 sport 500 Global (I) MM_NO_STATE *Mar 1 00:44:07.935: ISAKMP:(0:0:N/A:0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH *Mar 1 00:44:07.935: ISAKMP:(0:0:N/A:0):Old State = IKE_I_MM1 New State = IKE_I_MM2 *Mar 1 00:44:07.939: ISAKMP:(0:0:N/A:0): processing SA payload. message ID = 0 第一个传输往返的交换中的负载交换。发起者可以提出多个提议；响应者只能用一个来回答。*Mar 1 00:44:07.939: ISAKMP:(0:0:N/A:0): processing vendor id payload *Mar 1 00:44:07.939: ISAKMP:(0:0:N/A:0): vendor ID seems Unity/DPD but major 245 mismatch *Mar 1 00:44:07.939: ISAKMP (0:0): vendor ID is NATT v7 *Mar 1 00:44:07.943: ISAKMP:(0:0:N/A:0):found peer preshared key matching 34.34.34.4 *Mar 1 00:44:07.943: ISAKMP:(0:0:N/A:0): local preshared key found *Mar 1 00:44:07.943: ISAKMP : Scanning profiles for xauth . *Mar 1 00:44:07.943: ISAKMP:(0:0:N/A:0):Checking ISAKMP transform 1 against priority 1 policy 响应者选择一个转换的（transform）提议（ISAKMP SA 的属性）来应答。*Mar 1 00:44:07.947: ISAKMP: encryption 3DESCBC*Mar 1 00:44:07.947: ISAKMP: hash SHA *Mar 1 00:44:07.947: ISAKMP: default group 2 *Mar 1 00:44:07.947: ISAKMP: auth preshare *Mar 1 00:44:07.947: ISAKMP: life type in seconds *Mar 1 00:44:07.947: ISAKMP: life duration (VPI) of 0x0 0x1 0x51 0x80 *Mar 1 00:44:07.951: ISAKMP:(0:0:N/A:0):atts are acceptable. Next payload is 0 *Mar 1 00:44:08.023: ISAKMP:(0:4:SW:1): processing vendor id payload *Mar 1 00:44:08.023: ISAKMP:(0:4:SW:1): vendor ID seems Unity/DPD but major 245 mismatch *Mar 1 00:44:08.023: ISAKMP (0:134217732): vendor ID is NATT v7 *Mar 1 00:44:08.027: ISAKMP:(0:4:SW:1):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE *Mar 1 00:44:08.027: ISAKMP:(0:4:SW:1):Old State = IKE_I_MM2 New State = IKE_I_MM2 头两个消息协商策略；（结束）下两个消息交换 DiffieHellman 的公共值和必要的辅助数据（开始）*Mar 1 00:44:08.035: ISAKMP:(0:4:SW:1): sending packet to 34.34.34.4 my_port 500 peer_port 500 (I) MM_SA_SETUP *Mar 1 00:44:08.035: ISAKMP:(0:4:SW:1):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE *Mar 1 00:44:08.039: ISAKMP:(0:4:SW:1):Old State = IKE_I_MM2 New State = IKE_I_MM3 *Mar 1 00:44:08.627: ISAKMP (0:134217732): received packet from 34.34.34.4 dport 500 sport 500 Global (I) MM_SA_SETUP *Mar 1 00:44:08.627: ISAKMP:(0:4:SW:1):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH *Mar 1 00:44:08.627: ISAKMP:(0:4:SW:1):Old State = IKE_I_MM3 New State = IKE_I_MM4 *Mar 1 00:44:08.631: ISAKMP:(0:4:SW:1): processing KE payload. message ID = 0 KE 是包含了用于 DiffieHellman 交换的公共信息的密钥交换负载。*Mar 1 00:44:08.711: ISAKMP:(0:4:SW:1): processing NONCE payload. message ID = 0 必要的辅助数据（当前时间（nonce）*Mar 1 00:44:08.715: ISAKMP:(0:4:SW:1):found peer preshared key matching 34.34.34.4 共享密钥 SKEYID 现用于保护和验证所有后继的通信。注意 SKEYID 未经过验证。SKEYID 是从秘密材料中衍生出的字符串，只有某次交换中的活跃双方才知道。*Mar 1 00:44:08.719: ISAKMP:(0:4:SW:1):SKEYID state generated *Mar 1 00:44:08.719: ISAKMP:(0:4:SW:1): processing vendor id payload 必要的辅助数据*Mar 1 00:44:08.719: ISAKMP:(0:4:SW:1): vendor ID is Unity *Mar 1 00:44:08.723: ISAKMP:(0:4:SW:1): processing vendor id payload 必要的辅助数据*Mar 1 00:44:08.723: ISAKMP:(0:4:SW:1): vendor ID is DPD *Mar 1 00:44:08.723: ISAKMP:(0:4:SW:1): processing vendor id payload 必要的辅助数据*Mar 1 00:44:08.727: ISAKMP:(0:4:SW:1): speaking to another IOS box! *Mar 1 00:44:08.727: ISAKMP:(0:4:SW:1):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE *Mar 1 00:44:08.727: ISAKMP:(0:4:SW:1):Old State = IKE_I_MM4 New State = IKE_I_MM4 下两个消息交换 DiffieHellman 的公共值和必要的辅助数据（结束）最后的两个消息验证 DiffieHellman 交换。（开始）*Mar 1 00:44:08.735: ISAKMP:(0:4:SW:1):Send initial contact *Mar 1 00:44:08.739: ISAKMP:(0:4:SW:1):SA is doing preshared key authentication using id type ID_IPV4_ADDR 当使用共享密钥的主模式时，密钥只能通过双方的 IP 地址来进行识别，因为 HASH_I 必须在发起者处理 IDir 之前计算出来。*Mar 1 00:44:08.739: ISAKMP (0:134217732): ID payload nextpayload : 8 type : 1 address : 12.12.12.1 protocol : 17 port : 500 length : 12*Mar 1 00:44:08.739: ISAKMP:(0:4:SW:1):Total payload length: 12 *Mar 1 00:44:08.747: ISAKMP:(0:4:SW:1): sending packet to 34.34.34.4 my_port 500 peer_port 500 (I) MM_KEY_EXCH *Mar 1 00:44:08.747: ISAKMP:(0:4:SW:1):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE *Mar 1 00:44:08.747: ISAKMP:(0:4:SW:1):Old State = IKE_I_MM4 New State = IKE_I_MM5 *Mar 1 00:44:09.343: ISAKMP (0:134217732): received packet from 34.34.34.4 dport 500 sport 500 Global (I) MM_KEY_EXCH *Mar 1 00:44:09.347: ISAKMP:(0:4:SW:1): processing ID payload. message ID = 0 *Mar 1 00:44:09.351: ISAKMP (0:134217732): ID payload nextpayload : 8 type : 1 address : 34.34.34.4 protocol : 17 port : 500 length : 12 *Mar 1 00:44:09.351: ISAKMP:(0:4:SW:1): peer matches *none* of the profiles *Mar 1 00:44:09.351: ISAKMP:(0:4:SW:1): processing HASH payload. message ID = 0 密钥交换是用签名的 hash 来验证的。一旦签名使用作为 ISAKMP SA 协商的一部分的验证算法来校验且通过了则共享密钥、SKEYID 可以被认为经过验证了。*Mar 1 00:44:09.355: ISAKMP:(0:4:SW:1):SA authentication status:authenticated *Mar 1 00:44:09.355: ISAKMP:(0:4:SW:1):SA has been authenticated with 34.34.34.4 *Mar 1 00:44:09.359: ISAKMP: Trying to insert a peer 12.12.12.1/34.34.34.4/500/, and inserted successfully 64A20E00. *Mar 1 00:44:09.359: ISAKMP:(0:4:SW:1):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH *Mar 1 00:44:09.359: ISAKMP:(0:4:SW:1):Old State = IKE_I_MM5 New State = IKE_I_MM6 *Mar 1 00:44:09.367: ISAKMP:(0:4:SW:1):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE *Mar 1 00:44:09.367: ISAKMP:(0:4:SW:1):Old State = IKE_I_MM6 New State = IKE_I_MM6 *Mar 1 00:44:09.371: ISAKMP:(0:4:SW:1):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE*Mar 1 00:44:09.371: ISAKMP:(0:4:SW:1):Old State = IKE_I_MM6 New State = IKE_P1_COMPLETE 主模式（结束）；最后的两个消息验证 DiffieHellman 交换。（结束）isakmp 协商过程(第二阶段） 快速模式基本上是一次 SA 协商和提供重放（replay）保护的当前时间（nonce）交换。当前时间（nonce）用于产生新的密钥材料并阻止通过重放攻击产生虚假的安全联盟。*Mar 1 00:44:09.375: ISAKMP:(0:4:SW:1):beginning Quick Mode exchange, MID of 857538544 *Mar 1 00:44:09.383: ISAKMP:(0:4:SW:1): sending packet to 34.34.34.4 my_port 500 peer_port 500 (I) QM_IDLE *Mar 1 00:44:09.387: ISAKMP:(0:4:SW:1):Node 857538544, Input = IKE_MESG_INTERNAL, IKE_INIT_QM *Mar 1 00:44:09.387: ISAKMP:(0:4:SW:1):Old State = IKE_QM_READY New State = IKE_QM_I_QM1 *Mar 1 00:44:09.387: ISAKMP:(0:4:SW:1):Input = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE *Mar 1 00:44:09.391: ISAKMP:(0:4:SW:1):Old State = IKE_P1_COMPLETE New State = IKE_P1_COMPLETE *Mar 1 00:44:10.259: ISAKMP (0:134217732): received packet from 34.34.34.4 dport 500 sport 500 Global (I) QM_IDLE 响应者使用只包含一个转换的相似消息来应答选择的 ESP 转换（transform）。*Mar 1 00:44:10.263: ISAKMP:(0:4:SW:1): processing HASH payload. message ID = 857538544 *Mar 1 00:44:10.263: ISAKMP:(0:4:SW:1): processing SA payload. message ID = 857538544 *Mar 1 00:44:10.267: ISAKMP:(0:4:SW:1):Checking IPSec proposal 1 *Mar 1 00:44:10.267: ISAKMP: transform 1, ESP_3DES 选择的 ESP 转换（transform）*Mar 1 00:44:10.267: ISAKMP: attributes in transform: *Mar 1 00:44:10.267: ISAKMP: encaps is 1 (Tunnel) *Mar 1 00:44:10.267: ISAKMP: SA life type in seconds *Mar 1 00:44:10.271: ISAKMP: SA life duration (basic) of 3600 *Mar 1 00:44:10.271: ISAKMP: SA life type in kilobytes *Mar 1 00:44:10.271: ISAKMP: SA life duration (VPI) of 0x0 0x46 0x50 0x0*Mar 1 00:44:10.271: ISAKMP: authenticator is HMACSHA *Mar 1 00:44:10.271: ISAKMP:(0:4:SW:1):atts are acceptable. 当前时间（nonce）交换*Mar 1 00:44:10.275: ISAKMP:(0:4:SW:1): processing NONCE payload. message ID = 857538544 *Mar 1 00:44:10.279: ISAKMP:(0:4:SW:1): processing ID payload. message ID = 857538544 *Mar 1 00:44:10.279: ISAKMP:(0:4:SW:1): processing ID payload. message ID = 857538544 *Mar 1 00:44:10.287: ISAKMP: Locking peer struct 0x64A20E00, IPSEC refcount 1 for for stuff_ke 单个 SA 协商导致两个安全联盟 一个入一个出*Mar 1 00:44:10.287: ISAKMP:(0:4:SW:1): Creating IPSec SAs 一个入(inbound) *Mar 1 00:44:10.287: inbound SA from 34.34.34.4 to 12.12.12.1 (f/i) 0/ 0 (proxy 10.1.1.0 to 192.168.1.0) 在任一种情况下，“协议”和“SPI”是从包含协商的转换（transform）负载的 ISAKMP 提议负载中得到的。每个 SA（一个由发起者选择，另一个有响应者选择）的不同的 SPI 保证了每个方向有不同的密钥。SA 的目的地选择的 spi 用于衍生 SA 的 KEYMAT。*Mar 1 00:44:10.291: has spi 0x20B7D334 and conn_id 0 and flags 2 *Mar 1 00:44:10.291: lifetime of 3600 seconds ISAKMP 的实现可以要求私有组在建立的它的 SA 中设置超时*Mar 1 00:44:10.291: lifetime of 4608000 kilobytes *Mar 1 00:44:10.291: has client flags 0x0 一个出(outbound) *Mar 1 00:44:10.291: outbound SA from 12.12.12.1 to 34.34.34.4 (f/i) 0/0 (proxy 192.168.1.0 to 10.1.1.0) *Mar 1 00:44:10.295: has spi 845172765 and conn_id 0 and flags A *Mar 1 00:44:10.295: lifetime of 3600 seconds ISAKMP 的实现可以要求私有组在建立的它的 SA 中设置超时*Mar 1 00:44:10.295: lifetime of 4608000 kilobytes *Mar 1 00:44:10.295: has client flags 0x0 要为密钥和全部的身份提供完全后继保密，双方要执行下列操作：1.一次主模式交换来保护 ISAKMP 双方的身份。 这就建立了一个 ISAKMP SA。2.一次快速模式交换来协商其它安全协议保护。 这就在这个协议的两端建立了一个 SA。3.删除 ISAKMP SA 和与它相关的状态。因为在非 ISAKMP SA 中使用的密钥是从单个临时 DiffieHellman 交换中衍生出的，PFS 是保留的。*Mar 1 00:44:10.299: ISAKMP:(0:4:SW:1): sending packet to 34.34.34.4 my_port 500 peer_port 500 (I) QM_IDLE *Mar 1 00:44:10.299: ISAKMP:(0:4:SW:1):deleting node 857538544 error FALSE reason No Error 删除 ISAKMP SA 和与它相关的状态。*Mar 1 00:44:10.303: ISAKMP:(0:4:SW:1):Node 857538544, Input = IKE_MESG_FROM_PEER, IKE_QM_EXCH *Mar 1 00:44:10.303: ISAKMP:(0:4:SW:1):Old State = IKE_QM_I_QM1 New State = IKE_QM_PHASE2_COMPLETE *Mar 1 00:44:10.307: ISAKMP: Locking peer struct 0x64A20E00, IPSEC refcount 2 for from create_transforms *Mar 1 00:44:10.311: ISAKMP: Unlocking IPSEC struct 0x64A20E00 from create_transforms, count 1 *Mar 1 00:44:15.639: ISAKMP:(0:3:SW:1):purging SA., sa=63E13D50, delme=63E13D50 删除 ISAKMP SA 和与它相关的状态。加密/解密加密前的明文*Mar 1 01:11:00.323: Before encryption: 05DBEE70: 4500003C CD4B0000 E.MK. 05DBEE80: 3F01E1C7 C0A80103 0A010102 08000E5B ?.aG(. 05DBEE90: 04003B01 61626364 65666768 696A6B6C .?.abcdefghijkl 05DBEEA0: 6D6E6F70 71727374 75767761 62636465 mnopqrstuvwabcde 05DBEEB0: 66676869 01020204 41434143 41434141 fghi.ACACACAA 05DBEEC0: 4100 A. 加密后的密文*Mar 1 01:11:00.339: After encryption: 05DC1DB0: 45000070 03630000 E.p.c. 05DC1DC0: FF325BC6 0C0C0C01 22222204 CD9FAFE3 .2F.M./c 05DC1DD0: 0000001E D37309EF D7A23924 5A8A4A7A .Ss.oW9$Z.Jz 05DC1DE0: ECC99061 FAD9B67C 81103DDA 335E5BF2 lI.azY6|.=Z3r 05DC1DF0: 390D69E5 2146DB40 9347A51C B38E9765 9.ie!F.G%.3.e 05DC1E00: B75C9F8B CC64DB6A B6F8EEE0 6600C7B6 7.Ldj6xnf.G6 05DC1E10: 05F0169F 2F2631C8 803FAE76 271700B6 .p./&1H.?.v.6 05DC1E20: 028973E4 7F4C0923 .sd.L.# *Mar 1 01:11:00.355: post_crypto_ip_encrypt: Data just encrypted, 112 bytes *Mar 1 01:11:00.355: Process switched encrypted packet 解密前的密文*Mar 1 01:11:00.707: Before decryption: *Mar 1 01:11:00.707: Dump particle #01 for 112 bytes 05D33100: 4500 E. 05D33110: 00700546 0000FC32 5CE32222 22040C0C .p.F.|2c. 05D33120: 0C0120B7 D3340000 00240344 CEC53381 . 7S4.$.DNE3. 05D33130: 2E363AC2 352D23E2 E402EFCD A7DD92D0 .6:B5#bd.oM.P 05D33140: 4F030FFD 36B8357A 736095D1 40A37BCE O.685zs.Q#N 05D33150: 90847961 3B0FBBA9 FDCDA883 C072921F .ya?.?)M(.r. 05D33160: B877BA29 00BFE41B EEC9639A D404E9F6 8w:).?d.nIc.T.iv 05D33170: E96CB05B 9E743BF1 D6F136E8 8BBC il0.t?qVq6h. 解密后的明文*Mar 1 01:11:00.723: After decryption: *Mar 1 01:11:00.723: Dump particle #01 for 60 bytes 05D01660: 4500003C CD4B0000 3D01E3C7 E.MK.=.cG 05D01670: 0A010102 C0A80103 0000165B 04003B01 .(.?. 05D01680: 61626364 65666768 696A6B6C 6D6E6F70 abcdefghijklmnop 05D01690: 71727374 75767761 62636465 66676869 qrstuvwabcdefghi 05D016A0: *Mar 1 01:11:00.735: post_crypto_ip_decrypt: Data just decrypted, 60 bytes *Mar 1 01:11:00.735: PostDecrypt: Particle based pak cef switched 3 *Mar 1 01:11:00.735: PostDecrypt: pak cef switched Router#sh crypto isakmp policy 查看 ISAKMP 策略Global IKE policy Protection suite of priority 1 encryption algorithm: Three key triple DES hash algorithm: Secure Hash Standard authentication method: PreShared Key DiffieHellman group: #2 (1024 bit) lifetime: 86400 seconds, no volume limit Default protection suite encryption algorithm: DES Data Encryption Standard (56 bit keys). hash algorithm: Secure Hash Standard authentication method: RivestShamirAdleman Signature DiffieHellman group: #1 (768 bit) lifetime: 86400 seconds, no volume limit Router#sh crypto isakmp sa 查看 ISAKMP 的安全关联dst src state connid slot status 34.34.34.4 12.12.12.1 QM_IDLE 4 0 ACTIVE Router#sh crypto isakmp key 查看对等体共享密钥匙Keyring Hostname/Address Preshared Keydefault 34.34.34.4 cisco Router#sh crypto isakmp peers 查看对等体Peer: 34.34.34.4 Port: 500 Local: 12.12.12.1 Phase1 id: 34.34.34.4 Router#sh crypto ipsec transformset 查看转换集Transform set ESP3DESSHA: esp3des espshahmac will negotiate = Tunnel, , Router#sh crypto engine connections active 查看加密解密情况ID Interface IPAddress State Algorithm Encrypt Decrypt 4 Ethernet0/0 12.12.12.1 set HMAC_SHA+3DES_56_C 0 0 2001 Ethernet0/0 12.12.12.1 set 3DES+SHA 0 37 2002 Ethernet0/0 12.12.12.1 set 3DES+SHA 37 0 Router#sh crypto ipsec sa 查看 IPSEC 的安全关联interface: Ethernet0/0 Crypto map tag: MAP, local addr