Russian Users MikroTik | Форум пользователей MikroTik

Код: Выделить всё

add chain=input action=accept protocol=icmp
add chain=forward action=accept protocol=icmp
add chain=input action=accept connection-state=established
add chain=forward action=accept connection-state=established
add chain=input action=accept connection-state=related
add chain=forward action=accept connection-state=related

Код: Выделить всё

ip firewall nat add action=masquerade chain=srcnat comment=NAT src address=10.10.188.0/24

Код: Выделить всё

crypto ipsec ikev1 transform-set ESP-AES256-SHA1_TRANS esp-aes-256 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES256-SHA1_TRANS mode transport
crypto ipsec ikev1 transform-set ESP-AES128-SHA1_TRANS esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES128-SHA1_TRANS mode transport
crypto ipsec ikev1 transform-set ESP-AES256-SHA1 esp-aes-256 esp-sha-hmac
crypto dynamic-map DYN_OUTSIDE 10000 set ikev1 transform-set ESP-AES256-SHA1_TRANS ESP-AES128-SHA1_TRANS ESP-AES256-SHA1
!
crypto map MAP_OUTSIDE 10000 ipsec-isakmp dynamic DYN_OUTSIDE
crypto map MAP_OUTSIDE interface outside
crypto ikev1 enable outside
!
crypto ikev1 policy 1000
authentication pre-share
encryption aes-256
hash sha
group 2
lifetime 86400
crypto ikev1 policy 2000
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto ikev1 policy 3000
authentication pre-share
encryption aes
hash sha
group 2
lifetime 86400
!
group-policy EMPLOYEES_L2TP_IPSEC internal
group-policy EMPLOYEES_L2TP_IPSEC attributes
dns-server value 8.8.8.8
vpn-tunnel-protocol l2tp-ipsec
default-domain value domain.local
!
username vlad password uEwG7U3yQ+zmShyEXyAkEQ== nt-encrypted
!
tunnel-group DefaultRAGroup general-attributes
address-pool POOL1
default-group-policy EMPLOYEES_L2TP_IPSEC
tunnel-group DefaultRAGroup ipsec-attributes
ikev1 pre-shared-key *****
tunnel-group DefaultRAGroup ppp-attributes
authentication ms-chap-v2

Код: Выделить всё

%ASA-6-713172: Group = DefaultRAGroup, IP = 31.Y.Y.Y, Automatic NAT Detection Status:     Remote end   IS   behind a NAT device     This   end is NOT behind a NAT device
%ASA-6-713905: Group = DefaultRAGroup, IP = 31.Y.Y.Y, Floating NAT-T from 31.Y.Y.Y port 1025 to 31.Y.Y.Y port 4500
%ASA-6-113009: AAA retrieved default group policy (L2TP_IPSEC) for user = DefaultRAGroup
%ASA-5-713119: Group = DefaultRAGroup, IP = 31.Y.Y.Y, PHASE 1 COMPLETED

%ASA-5-713904: Group = DefaultRAGroup, IP = 31.Y.Y.Y, All IPSec SA proposals found unacceptable!
%ASA-3-713902: Group = DefaultRAGroup, IP = 31.Y.Y.Y, QM FSM error (P2 struct &0xae9c0758, mess id 0xef18049d)!
%ASA-3-713902: Group = DefaultRAGroup, IP = 31.Y.Y.Y, Removing peer from correlator table failed, no match!
%ASA-6-713905: Group = DefaultRAGroup, IP = 31.Y.Y.Y, Warning: Ignoring IKE SA (src) without VM bit set
%ASA-5-713259: Group = DefaultRAGroup, IP = 31.Y.Y.Y, Session is being torn down. Reason: Phase 2 Mismatch
%ASA-4-113019: Group = DefaultRAGroup, Username = , IP = 31.Y.Y.Y, Session disconnected. Session Type: IKEv1, Duration: 0h:00m:00s, Bytes xmt: 0, Bytes rcv: 0, Reason: Phase 2 Mismatch

Код: Выделить всё

crypto dynamic-map DYN_OUTSIDE 10000 set pfs

Код: Выделить всё

%ASA-5-713904: Group = DefaultRAGroup, IP = 31.Y.Y.Y, All IPSec SA proposals found unacceptable!
%ASA-3-713902: Group = DefaultRAGroup, IP = 31.Y.Y.Y, QM FSM error (P2 struct &0xae9c0758, mess id 0xef18049d)!

Код: Выделить всё

sha1 - auth algorithms
3des - encr algorithms
pfs group - none

Код: Выделить всё

md5 - auth algorithms
3des - encr algorithms
pfs group - none

Код: Выделить всё

sha1 - auth algorithms
3des - encr algorithms
pfs group - modp1024

Код: Выделить всё

/ip ipsec proposal print 

Код: Выделить всё

/ip ipsec proposal print
Flags: X - disabled, * - default
 0  * name="default" auth-algorithms=md5 enc-algorithms=3des lifetime=1d
      pfs-group=none

Код: Выделить всё

auth-algorithms=sha256,sha1,md5 enc-algorithms=aes-256-cbc,aes-192-cbc,aes-128-cbc,3des