Код: Выделить всё
add chain=input action=accept protocol=icmp
add chain=forward action=accept protocol=icmp
add chain=input action=accept connection-state=established
add chain=forward action=accept connection-state=established
add chain=input action=accept connection-state=related
add chain=forward action=accept connection-state=relatedКод: Выделить всё
ip firewall nat add action=masquerade chain=srcnat comment=NAT src address=10.10.188.0/2410.10.188.0 - сеть за микротиком
2) cisco l2tp server
Код: Выделить всё
crypto ipsec ikev1 transform-set ESP-AES256-SHA1_TRANS esp-aes-256 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES256-SHA1_TRANS mode transport
crypto ipsec ikev1 transform-set ESP-AES128-SHA1_TRANS esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES128-SHA1_TRANS mode transport
crypto ipsec ikev1 transform-set ESP-AES256-SHA1 esp-aes-256 esp-sha-hmac
crypto dynamic-map DYN_OUTSIDE 10000 set ikev1 transform-set ESP-AES256-SHA1_TRANS ESP-AES128-SHA1_TRANS ESP-AES256-SHA1
!
crypto map MAP_OUTSIDE 10000 ipsec-isakmp dynamic DYN_OUTSIDE
crypto map MAP_OUTSIDE interface outside
crypto ikev1 enable outside
!
crypto ikev1 policy 1000
authentication pre-share
encryption aes-256
hash sha
group 2
lifetime 86400
crypto ikev1 policy 2000
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto ikev1 policy 3000
authentication pre-share
encryption aes
hash sha
group 2
lifetime 86400
!
group-policy EMPLOYEES_L2TP_IPSEC internal
group-policy EMPLOYEES_L2TP_IPSEC attributes
dns-server value 8.8.8.8
vpn-tunnel-protocol l2tp-ipsec
default-domain value domain.local
!
username vlad password uEwG7U3yQ+zmShyEXyAkEQ== nt-encrypted
!
tunnel-group DefaultRAGroup general-attributes
address-pool POOL1
default-group-policy EMPLOYEES_L2TP_IPSEC
tunnel-group DefaultRAGroup ipsec-attributes
ikev1 pre-shared-key *****
tunnel-group DefaultRAGroup ppp-attributes
authentication ms-chap-v2
Лог с асы
Код: Выделить всё
%ASA-6-713172: Group = DefaultRAGroup, IP = 31.Y.Y.Y, Automatic NAT Detection Status: Remote end IS behind a NAT device This end is NOT behind a NAT device
%ASA-6-713905: Group = DefaultRAGroup, IP = 31.Y.Y.Y, Floating NAT-T from 31.Y.Y.Y port 1025 to 31.Y.Y.Y port 4500
%ASA-6-113009: AAA retrieved default group policy (L2TP_IPSEC) for user = DefaultRAGroup
%ASA-5-713119: Group = DefaultRAGroup, IP = 31.Y.Y.Y, PHASE 1 COMPLETED
%ASA-5-713904: Group = DefaultRAGroup, IP = 31.Y.Y.Y, All IPSec SA proposals found unacceptable!
%ASA-3-713902: Group = DefaultRAGroup, IP = 31.Y.Y.Y, QM FSM error (P2 struct &0xae9c0758, mess id 0xef18049d)!
%ASA-3-713902: Group = DefaultRAGroup, IP = 31.Y.Y.Y, Removing peer from correlator table failed, no match!
%ASA-6-713905: Group = DefaultRAGroup, IP = 31.Y.Y.Y, Warning: Ignoring IKE SA (src) without VM bit set
%ASA-5-713259: Group = DefaultRAGroup, IP = 31.Y.Y.Y, Session is being torn down. Reason: Phase 2 Mismatch
%ASA-4-113019: Group = DefaultRAGroup, Username = , IP = 31.Y.Y.Y, Session disconnected. Session Type: IKEv1, Duration: 0h:00m:00s, Bytes xmt: 0, Bytes rcv: 0, Reason: Phase 2 Mismatch31.Y.Y.Y - соответственно ip провайдера за которым микротик