怎样用DEBUG实现两个路由器之间做LTL的
导语：欢迎大家来到读文网，本文为大带来怎样用DEBUG实现两个路由器之间做LTL的，欢迎大家阅读借鉴。
r1#
r1#
r1ping192.168.20.1 source 192.168.10.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.20.1, timeout is 2 seconds:
Packet sent with a source address of 192.168.10.1
*Aug 8 20:20:40.323: ISAKMP:(0): SA request profile is (NULL)
*Aug 8 20:20:40.323: ISAKMP: Created a peer struct for 202.102.1.2, peer port 5
00
*Aug 8 20:20:40.323: ISAKMP: New peer created peer = 0x6637AAAC peer_handle = 0
x80000003
*Aug 8 20:20:40.323: ISAKMP: Locking peer struct 0x6637AAAC, refcount 1 for isa
kmp_initiator
*Aug 8 20:20:40.323: ISAKMP: local port 500, remote port 500
*Aug 8 20:20:40.323: ISAKMP: set new node 0 to QM_IDLE
*Aug 8 20:20:40.323: insert sa successfully sa = 65D3B7A8
*Aug 8 20:20:40.323: ISAKMP:(0):Can not start Aggressive mode, trying Main mode
.
*Aug 8 20:20:40.323: ISAKMP:(0):found peer pre-shared key matching 202.102.1.2
*Aug 8 20:20:40.323: ISAKMP:(0): constructed NAT-T vendor-07 ID
*Aug 8 20:20:40.323: ISAKMP:(0): constructed NAT-T vendor-03 ID
*Aug 8 20:20:40.323: ISAKMP:(0): constructed NAT-T vendor-02 ID
*Aug 8 20:20:40.323: ISAKMP:(0):Input = IKE_MESG_FROM_IPSEC, IKE_SA_REQ_MM
*Aug 8 20:20:40.323: ISAKMP:(0):Old State = IKE_READY New State = IKE_I_MM1
*Aug 8 20:20:40.323: ISAKMP:(0): beginning Main Mode exchange
*Aug 8 20:20:40.323: ISAKMP:(0): sending packet to 202.102.1.2 my_port 500 peer
_port 500 (I) MM_NO_STATE (发送第一个包)
*Aug 8 20:20:40.351: ISAKMP (0:0): received packet from 202.102.1.2 dport 500 s
port 500 Global (I) MM_NO_STATE (接收第二个包)
*Aug 8 20:20:40.355: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
*Aug 8 20:20:40.355: ISAKMP:(0):Old State = IKE_I_MM1 New State = IKE_I_MM2
*Aug 8 20:20:40.355: ISAKMP:(0): processing SA payload. message ID = 0
*Aug 8 20:20:40.355: ISAKMP:(0): processing vendor id payload
*Aug 8 20:20:40.355: ISAKMP:(0): vendor ID seems Unity/DPD but major 245 mismat
ch
*Aug 8 20:20:40.355: ISAKMP (0:0): vendor ID is NAT-T v7
*Aug 8 20:20:40.355: ISAKMP:(0):found peer pre-shared key matching 202.102.1.2
*Aug 8 20:20:40.355: ISAKMP:(0): local preshared key found
*Aug 8 20:20:40.355: ISAKMP : Scanning profiles for xauth ...
*Aug 8 20:20:40.355: ISAKMP:.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 28/46/72 ms
r1#(0):Checking ISAKMP transform 1 against priority 100 policy
*Aug 8 20:20:40.355: ISAKMP: encryption DES-CBC
*Aug 8 20:20:40.355: ISAKMP: hash SHA
*Aug 8 20:20:40.355: ISAKMP: default group 1
*Aug 8 20:20:40.355: ISAKMP: auth pre-share
*Aug 8 20:20:40.355: ISAKMP: life type in seconds
*Aug 8 20:20:40.355: ISAKMP: life duration (VPI) of 0x0 0x1 0x51 0x80
*Aug 8 20:20:40.355: ISAKMP:(0):atts are acceptable.(双方都是认同的)Next payload is 0
如果老是重传，说明策略不匹配
*Aug 8 20:20:40.355: ISAKMP:(0): processing vendor id payload
*Aug 8 20:20:40.355: ISAKMP:(0): vendor ID seems Unity/DPD but major 245 mismatch
*Aug 8 20:20:40.355: ISAKMP (0:0): vendor ID is NAT-T v7
*Aug 8 20:20:40.355: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MOD
E
*Aug 8 20:20:40.355: ISAKMP:(0):Old State = IKE_I_MM2 New State = IKE_I_MM2
*Aug 8 20:20:40.355: ISAKMP:(0): sending packet to 202.102.1.2 my_port 500 peer
_port 500 (I) MM_SA_SETUP
*Aug 8 20:20:40.355: ISAKMP:(0):Input = IKE_ME
rSG_INTERNAL,IKE_PROCESS_COMPLETE
*Aug 8 20:20:40.355: ISAKMP:(0):Old State = IKE_I_MM2 New State = IKE_I_MM3
发送一个
*Aug 8 20:20:40.403: ISAKMP (0:0): received packet from 202.102.1.2 dport 500 s
port 500 Global (I) MM_SA_SETUP
*Aug 8 20:20:40.407: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
*Aug 8 20:20:40.411: ISAKMP:(0):Old State = IKE_I_MM3 New State = IKE_I_MM4
接收一个
*Aug 8 20:20:40.419: ISAKMP:(0): processing KE payload. message ID = 0 公共值
*Aug 8 20:20:40.423: ISAKMP:(0): processing NONCE payload. message ID = 0 随机数
*Aug 8 20:20:40.423: ISAKMP:(0):found peer pre-shared key matching 202.102.1.2
*Aug 8 20:20:40.423: ISAKMP:(1002): processing vendor id payload
*Aug 8 20:20:40.423: ISAKMP:(1002): vendor ID is Unity
*Aug 8 20:20:40.423: ISAKMP:(1002): processing vendor id payload
*Aug 8 20:20:40.423: ISAKMP:(1002): vendor ID is DPD
*Aug 8 20:20:40.423: ISAKMP:(1002): processing vendor id payload
*Aug 8 20:20:40.423: ISAKMP:(1002): speaking to another IOS box!
*Au
rg8 20:20:40.423: ISAKMP:(1002):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_
MODE
*Aug 8 20:20:40.423: ISAKMP:(1002):Old State = IKE_I_MM4 New State = IKE_I_MM4
*Aug 8 20:20:40.423: ISAKMP:(1002):Send initial contact
*Aug 8 20:20:40.423: ISAKMP:(1002):SA is doing pre-shared key authentication us
ing id type ID_IPV4_ADDR
*Aug 8 20:20:40.423: ISAKMP (0:1002): ID payload
#p#副标题#e#
next-payload : 8
type : 1
address : 202.102.1.1
protocol : 17
port : 500
length : 12
*Aug 8 20:20:40.423: ISAKMP:(1002):Total payload length: 12
*Aug 8 20:20:40.423: ISAKMP:(1002): sending packet to 202.102.1.2 my_port 500 p
eer_port 500 (I) MM_KEY_EXCH 第五个包
*Aug 8 20:20:40.423: ISAKMP:(1002):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPL
ETE
*Aug 8 20:20:40.423: ISAKMP:(1002):Old State = IKE_I_MM4 New State = IKE_I_MM5
*Aug 8 20:20:40.463: ISAKMP (0:1002): received packet from 202.102.1.2 dport 50
0 sport 500 Global (I) MM_KEY_EXCH MM_KEY_EXCH 第六个包
*Aug 8 20:20:40.467: ISA
r1#KMPL1002): processing ID payload. Message ID = 0
*Aug 8 20:20:40.467: ISAKMP (0:1002): ID payload
next-payload : 8
type : 1
address : 202.102.1.2
protocol : 17
port : 500
length : 12
*Aug 8 20:20:40.467: ISAKMPL0):: peer matches *none* of the profiles
*Aug 8 20:20:40.467: ISAKMPL1002): processing HASH payload. Message ID = 0
*Aug 8 20:20:40.467: ISAKMPL1002):SA authentication status:
Authenticated
*Aug 8 20:20:40.467: ISAKMPL1002):SA has been authenticated with 202.102.1.2(最后的结果认证成功，第一阶段成功了)
*Aug 8 20:20:40.467: ISAKMP: Trying to insert a peer 202.102.1.1/202.102.1.2/50
0/, and inserted successfully 6637AAAC.
*Aug 8 20:20:40.467: ISAKMP:(1002):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
*Aug 8 20:20:40.467: ISAKMP:(1002):Old State = IKE_I_MM5 New State = IKE_I_MM6
*Aug 8 20:20:40.467: ISAKMP:(1002):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_
MODE
*Aug 8 20:20:40.467: ISAKMP:(1002):Old State = IKE_I_MM6 New State = IKE_I_MM6
r1#*Aug 8 20:20:40.467: ISAKMP:(1002):Input = IKE_MESG_INTERNAL, IKE_PROCESS_CO
MPLETE
*Aug 8 20:20:40.467: ISAKMP:(1002):Old State = IKE_I_MM6 New State = IKE_P1_CO
MPLETE
*Aug 8 20:20:40.467: ISAKMP:(1002):beginning Quick Mode exchange, M-ID of 10935
59871
*Aug 8 20:20:40.467: ISAKMP:(1002):QM Initiator gets spi
*Aug 8 20:20:40.467: ISAKMP:(1002): sending packet to 202.102.1.2 my_port 500 p
eer_port 500 (I) QM_IDLE 发送第二创段开始的第一个包;QM代表快速模式
*Aug 8 20:20:40.467: ISAKMP:(1002):Node 1093559871, Input = IKE_MESG_INTERNAL,
IKE_INIT_QM
*Aug 8 20:20:40.467: ISAKMP:(1002):Old State = IKE_QM_READY New State = IKE_QM
_I_QM1
*Aug 8 20:20:40.467: ISAKMP:(1002):Input = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLE
TE
*Aug 8 20:20:40.467: ISAKMP:(1002):Old State = IKE_P1_COMPLETE New State = IKE
_P1_COMPLETE
*Aug 8 20:20:40.511: ISAKMP (0:1002): received packet from 202.102.1.2 dport 50
0 sport 500 Global (I) QM_IDLE 收到对方的回应
*Aug 8 20:20:40.519: ISAKMP:(1002): processing HASH payload. message ID = 10935
59871
r1#
*Aug 8 20:20:40.519: ISAKMP:(1002): processing SA payload. message ID = 1093559
871
*Aug 8 20:20:40.523: ISAKMP:(1002):Checking IPSec proposal 1
*Aug 8 20:20:40.523: ISAKMP: transform 1, ESP_DES
*Aug 8 20:20:40.527: ISAKMP: attributes in transform:
*Aug 8 20:20:40.527: ISAKMP: encaps is 1 (Tunnel)
*Aug 8 20:20:40.531: ISAKMP: SA life type in seconds
*Aug 8 20:20:40.531: ISAKMP: SA life duration (basic) of 3600
*Aug 8 20:20:40.531: ISAKMP: SA life type in kilobytes
*Aug 8 20:20:40.535: ISAKMP: SA life duration (VPI) of 0x0 0x46 0x50 0x0
*Aug 8 20:20:40.539: ISAKMP:(1002):atts are acceptable. 第二阶段最终双方都接受的结果
*Aug 8 20:20:40.543: ISAKMP:(1002): processing NONCE payload. message ID = 1093
559871
*Aug 8 20:20:40.547: ISAKMP:(1002): processing ID payload. message ID = 1093559
871
*Aug 8 20:20:40.551: ISAKMP:(1002): processing ID payload. message ID = 1093559
871
*Aug 8 20:20:40.551: ISAKMP:(1002): Creating IPSec SAs
*Aug 8 20:20:40.551: inboun
rdSA from 202.102.1.2 to 202.102.1.1 (f/i) 0/ 0
(proxy 192.168.20.0 to 192.168.10.0)
*Aug 8 20:20:40.551: has spi 0x866A05BA and conn_id 0 SPI是双方最终协商的结果
*Aug 8 20:20:40.551: lifetime of 3600 seconds
*Aug 8 20:20:40.551: lifetime of 4608000 kilobytes
*Aug 8 20:20:40.551: outbound SA from 202.102.1.1 to 202.102.1.2 (f/i)
0/0
(proxy 192.168.10.0 to 192.168.20.0)
*Aug 8 20:20:40.551: has spi 0x2E48CED3 and conn_id 0
*Aug 8 20:20:40.551: lifetime of 3600 seconds
*Aug 8 20:20:40.551: lifetime of 4608000 kilobytes
*Aug 8 20:20:40.551: ISAKMP:(1002): sending packet to 202.102.1.2 my_port 500 p
eer_port 500 (I) QM_IDLE
*Aug 8 20:20:40.551: ISAKMP:(1002):deleting node 1093559871 error FALSE reason
"No Error"
*Aug 8 20:20:40.551: ISAKMP:(1002):Node 1093559871, Input = IKE_MESG_FROM_PEER,IKE_QM_EXCH
*Aug 8 20:20:40.551: ISAKMP:(1002):Old State = IKE_QM_I_QM1 New State = IKE_QM_PHASE2_COMPLETE
r1showcrypto isakmp sa
IPv4 Crypto ISAKMP SA
dst src state conn-id slot status
202.102.1.2 202.102.1.1 QM_IDLE 1002 0 ACTIVE
IPv6 Crypto ISAKMP SA
r1#
*Aug 8 20:21:30.551: ISAKMP:(1002):purging node 1093559871
r1#