000154: Feb 26 23:42:09.078 PCTime: ISAKMP:(0): SA request profile is (NULL) 000155: Feb 26 23:42:09.078 PCTime: ISAKMP: Created a peer struct for 194.215.92.1, peer port 500 000156: Feb 26 23:42:09.078 PCTime: ISAKMP: New peer created peer = 0x82AF328C peer_handle = 0x80000003 000157: Feb 26 23:42:09.078 PCTime: ISAKMP: Locking peer struct 0x82AF328C, refcount 1 for isakmp_initiator 000158: Feb 26 23:42:09.078 PCTime: ISAKMP: local port 500, remote port 500 000159: Feb 26 23:42:09.078 PCTime: ISAKMP: set new node 0 to QM_IDLE 000160: Feb 26 23:42:09.078 PCTime: insert sa successfully sa = 822F7E78 000161: Feb 26 23:42:09.078 PCTime: ISAKMP:(0):Can not start Aggressive mode, trying Main mode. 000162: Feb 26 23:42:09.078 PCTime: ISAKMP:(0):found peer pre-shared key matching 194.215.92.1 000163: Feb 26 23:42:09.082 PCTime: ISAKMP:(0): constructed NAT-T vendor-07 ID 000164: Feb 26 23:42:09.082 PCTime: ISAKMP:(0): constructed NAT-T vendor-03 ID 000165: Feb 26 23:42:09.082 PCTime: ISAKMP:(0): constructed NAT-T vendor-02 ID 000166: Feb 26 23:42:09.082 PCTime: ISAKMP:(0):Input = IKE_MESG_FROM_IPSEC, IKE_SA_REQ_MM 000167: Feb 26 23:42:09.082 PCTime: ISAKMP:(0):Old State = IKE_READY New State = IKE_I_MM1 000168: Feb 26 23:42:09.082 PCTime: ISAKMP:(0): beginning Main Mode exchange 000169: Feb 26 23:42:09.082 PCTime: ISAKMP:(0): sending packet to 194.215.92.1 my_port 500 peer_port 500 (I) MM_NO_STATE 000170: Feb 26 23:42:09.130 PCTime: %SEC-6-IPACCESSLOGP: list hyyremote permitted udp 194.215.92.1(500) -> 87.108.10.17(500), 1 packet 000171: Feb 26 23:42:09.130 PCTime: ISAKMP (0:0): received packet from 194.215.92.1 dport 500 sport 500 Global (I) MM_NO_STATE 000172: Feb 26 23:42:09.130 PCTime: ISAKMP:(0):Notify has no hash. Rejected. 000173: Feb 26 23:42:09.134 PCTime: ISAKMP (0:0): Unknown Input IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY: state = IKE_I_MM1 000174: Feb 26 23:42:09.134 PCTime: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY 000175: Feb 26 23:42:09.134 PCTime: ISAKMP:(0):Old State = IKE_I_MM1 New State = IKE_I_MM1 000176: Feb 26 23:42:09.134 PCTime: %CRYPTO-6-IKMP_MODE_FAILURE: Processing of Informational mode failed with peer at 194.215.92.1 no service pad service tcp-keepalives-in service tcp-keepalives-out service timestamps debug datetime msec localtime show-timezone service timestamps log datetime msec localtime show-timezone service password-encryption service sequence-numbers ! hostname adsl-unicafe-olivia ! boot-start-marker boot-end-marker ! logging buffered 262144 debugging logging rate-limit 10 logging console critical enable secret 5 $1$Y.1x$KiQSASuYiJZBbHrQ1dpyB. ! aaa new-model ! ! aaa group server radius rad_eap ! aaa group server radius rad_mac ! aaa group server radius rad_acct ! aaa group server radius rad_admin ! aaa group server tacacs+ tac_admin ! aaa group server radius rad_pmip ! aaa group server radius dummy ! aaa authentication login default group tacacs+ enable aaa authentication login eap_methods group rad_eap aaa authentication login mac_methods local aaa authentication login console enable aaa authentication enable default enable aaa authorization exec default group tacacs+ if-authenticated aaa accounting exec default start-stop group tacacs+ aaa accounting commands 15 default start-stop group tacacs+ aaa accounting network acct_methods start-stop group rad_acct aaa accounting system default start-stop group tacacs+ ! aaa session-id common ! resource policy ! clock timezone PCTime 2 clock summer-time PCTime date Mar 30 2003 3:00 Oct 26 2003 4:00 ip subnet-zero no ip source-route ip cef no ip dhcp use vrf connected ! ! ! ip tcp synwait-time 10 no ip bootp server no ip domain lookup ip domain name customer.academica.fi ip name-server 217.64.177.177 ip name-server 217.64.177.178 ip ssh time-out 60 ip ssh authentication-retries 2 ! ! crypto pki trustpoint TP-self-signed-2644435013 enrollment selfsigned subject-name cn=IOS-Self-Signed-Certificate-2644435013 revocation-check none rsakeypair TP-self-signed-2644435013 ! ! ! ! crypto isakmp policy 10 encr 3des hash md5 authentication pre-share crypto isakmp key "salausavain" address 194.x.x.x ! ! crypto map YYyyYY 10 ipsec-isakmp set peer 194.x.x.x set security-association lifetime seconds 86400 match address acl-vpn ! bridge irb ! ! interface ATM0 no ip address no atm ilmi-keepalive dsl operating-mode auto ! interface ATM0.1 point-to-point description ATM0.1 ptp ip address 87.x.x.x 255.255.255.252 ip access-group xxxx in atm route-bridged ip pvc 0/100 encapsulation aal5snap ! crypto map YYyyYY ! interface FastEthernet0 ! interface FastEthernet1 ! interface FastEthernet2 ! interface FastEthernet3 ! interface Dot11Radio0 no ip address shutdown ! encryption mode ciphers tkip ! ! speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0 54.0 channel 2412 station-role root bridge-group 1 bridge-group 1 subscriber-loop-control bridge-group 1 spanning-disabled bridge-group 1 block-unknown-source no bridge-group 1 source-learning no bridge-group 1 unicast-flooding ! interface Vlan1 description vlan1 no ip address ip tcp adjust-mss 1452 bridge-group 1 ! interface BVI1 description LAN ip address 82.x.x.x 255.255.255.248 ! ip classless ip route 0.0.0.0 0.0.0.0 87.x.x.x ! no ip http server ip http access-class 23 ip http authentication local no ip http secure-server ip http timeout-policy idle 60 life 86400 requests 10000 ! ip access-list extended acl-vpn permit ip 82.x.x.x 0.0.0.7 194.x.x.x.0 0.0.0.63 ip access-list extended hyyremote permit ip 194.215.92.0 0.0.0.63 any log deny ip any any ! logging trap debugging snmp-server view pingmib ciscoPingEntry included snmp-server community G00F00R1T view pingmib RW 2 snmp-server community G11F11r0T RO 2 snmp-server location snmp-server location snmp-server contact snmp-server enable traps tty no cdp run tacacs-server directed-request tacacs-server key 7 08241A450B2E202F1F radius-server attribute 32 include-in-access-req format %h radius-server vsa send accounting ! control-plane ! bridge 1 protocol ieee bridge 1 route ip banner login ^CCCAuthorized access only! Disconnect IMMEDIATELY if you are not an authorized user!^C banner motd ^CCCC $(hostname).$(domain) Unauthorized access prohibited. ^C ! line con 0 password 7 053B1059035A572A16 login authentication console modem enable transport preferred none transport output none stopbits 1 line aux 0 transport output all line vty 0 4 access-class 1 in exec-timeout 60 0 privilege level 15 transport input telnet ssh transport output all ! scheduler max-task-time 5000 scheduler allocate 4000 1000 scheduler interval 500 ntp clock-period 17175006 ntp server 217.64.177.129 end Lokituksia: 000097: Feb 26 23:20:06.040 PCTime: No peer struct to get peer description 000098: Feb 26 23:20:06.396 PCTime: No peer struct to get peer description 000099: Feb 26 23:20:06.740 PCTime: No peer struct to get peer description 000100: Feb 26 23:20:07.092 PCTime: No peer struct to get peer description 000101: Feb 26 23:20:07.388 PCTime: No peer struct to get peer description 000102: Feb 26 23:20:07.732 PCTime: No peer struct to get peer description 000103: Feb 26 23:20:08.068 PCTime: No peer struct to get peer description 000104: Feb 26 23:20:08.404 PCTime: No peer struct to get peer description 000105: Feb 26 23:20:51.023 PCTime: IPSEC(crypto_map_check_encrypt_core): CRYPTO: Packet dropped because cryptomap is currently being created 000106: Feb 26 23:21:08.043 PCTime: %CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd packet not an IPSEC packet. (ip) vrf/dest_addr= /82.133.128.225, src_addr= 194.215.92.1, prot= 17 000107: Feb 26 23:21:51.006 PCTime: %SEC-6-IPACCESSLOGP: list hyyremote permitted udp 194.215.92.1(500) -> 82.133.128.225(500), 21 packets 000108: Feb 26 23:22:07.626 PCTime: %SYS-5-CONFIG_I: Configured from console by aki on vty0 (82.133.252.1) 000109: Feb 26 23:22:09.573 PCTime: %CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd packet not an IPSEC packet. (ip) vrf/dest_addr= /82.133.128.225, src_addr= 194.215.92.1, prot= 17 000110: Feb 26 23:23:39.548 PCTime: %CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd packet not an IPSEC packet. (ip) vrf/dest_addr= /82.133.128.225, src_addr= 194.215.92.1, prot= 17 000111: Feb 26 23:24:41.542 PCTime: %CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd packet not an IPSEC packet. (ip) vrf/dest_addr= /82.133.128.225, src_addr= 194.215.92.1, prot= 17 000112: Feb 26 23:25:23.758 PCTime: %SYS-5-CONFIG_I: Configured from console by aki on vty0 (82.133.252.1) 000113: Feb 26 23:25:41.541 PCTime: %CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd packet not an IPSEC packet. (ip) vrf/dest_addr= /82.133.128.225, src_addr= 194.215.92.1, prot= 17 000114: Feb 26 23:26:41.544 PCTime: %CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd packet not an IPSEC packet. (ip) vrf/dest_addr= /82.133.128.225, src_addr= 194.215.92.1, prot= 17 000115: Feb 26 23:26:50.922 PCTime: %SEC-6-IPACCESSLOGP: list hyyremote permitted udp 194.215.92.1(500) -> 82.133.128.225(500), 15 packets 000116: Feb 26 23:27:04.010 PCTime: %SYS-5-CONFIG_I: Configured from console by aki on vty0 (82.133.252.1) 000117: Feb 26 23:27:43.547 PCTime: %CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd packet not an IPSEC packet. (ip) vrf/dest_addr= /82.133.128.225, src_addr= 194.215.92.1, prot= 17