質問編集履歴
2
イメージ図を追加しました
title
CHANGED
|
File without changes
|
body
CHANGED
|
@@ -174,4 +174,6 @@
|
|
|
174
174
|
PPPoE接続やNAPTについて知識が乏しくよくわからない状態で設定をしています。
|
|
175
175
|
参考にしたサイトのURLが抜けていたのですが、接続イメージはそこのサイトと同じと考えています。
|
|
176
176
|
外からvyosに繋いで、そこからvyosにつながっているローカル環境へつなげればと考えています。
|
|
177
|
-
http://qiita.com/khayama/items/c63d4d5f02abdf348889
|
|
177
|
+
http://qiita.com/khayama/items/c63d4d5f02abdf348889
|
|
178
|
+
|
|
179
|
+
|
1
ログの追記、接続イメージを追記しました。
title
CHANGED
|
File without changes
|
body
CHANGED
|
@@ -1,6 +1,8 @@
|
|
|
1
1
|
vyosを設定して、外からVPN接続できるようにしようとしています。
|
|
2
2
|
|
|
3
3
|
VPNの設定については以下のサイトを参考にしたのですが、接続できませんでした。
|
|
4
|
+
http://qiita.com/khayama/items/c63d4d5f02abdf348889
|
|
5
|
+
|
|
4
6
|
vyosの設定は以下になるのですが、何か設定が足りないのでしょうか。
|
|
5
7
|
※IPアドレス、パスワードなどは実際とは変更しています。
|
|
6
8
|
```ここに言語を入力
|
|
@@ -127,4 +129,49 @@
|
|
|
127
129
|
}
|
|
128
130
|
```
|
|
129
131
|
|
|
130
|
-
|
|
132
|
+
|
|
133
|
+
|
|
134
|
+
■事前共有キーについて
|
|
135
|
+
vyosへの投入コマンドをテキストに書いてからコピペしていたので、間違えてはいないと思います。
|
|
136
|
+
■ログについて
|
|
137
|
+
ログは以下となっておりました。現在メッセージ内容について調査しています。
|
|
138
|
+
```
|
|
139
|
+
packet from xxx.xxx.xxx.xxx:11711: received Vendor ID payload [MS NT5 ISAKMPOAKLEY 00000008]
|
|
140
|
+
packet from xxx.xxx.xxx.xxx:11711: received Vendor ID payload [RFC 3947]
|
|
141
|
+
packet from xxx.xxx.xxx.xxx:11711: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]
|
|
142
|
+
packet from xxx.xxx.xxx.xxx:11711: ignoring Vendor ID payload [FRAGMENTATION]
|
|
143
|
+
packet from xxx.xxx.xxx.xxx:11711: ignoring Vendor ID payload [MS-Negotiation Discovery Capable]
|
|
144
|
+
packet from xxx.xxx.xxx.xxx:11711: ignoring Vendor ID payload [Vid-Initial-Contact]
|
|
145
|
+
packet from xxx.xxx.xxx.xxx:11711: ignoring Vendor ID payload [IKE CGA version 1]
|
|
146
|
+
"remote-access-mac-zzz"[13] xxx.xxx.xxx.xxx:11711 #7: responding to Main Mode from unknown peer xxx.xxx.xxx.xxx:11711
|
|
147
|
+
"remote-access-mac-zzz"[13] xxx.xxx.xxx.xxx:11711 #7: Oakley Transform [AES_CBC (256), HMAC_SHA1, ECP_384] refused due to strict flag
|
|
148
|
+
"remote-access-mac-zzz"[13] xxx.xxx.xxx.xxx:11711 #7: Oakley Transform [AES_CBC (128), HMAC_SHA1, ECP_256] refused due to strict flag
|
|
149
|
+
"remote-access-mac-zzz"[13] xxx.xxx.xxx.xxx:11711 #7: Oakley Transform [AES_CBC (256), HMAC_SHA1, MODP_2048] refused due to strict flag
|
|
150
|
+
"remote-access-mac-zzz"[13] xxx.xxx.xxx.xxx:11711 #7: Oakley Transform [3DES_CBC (192), HMAC_SHA1, MODP_2048] refused due to strict flag
|
|
151
|
+
"remote-access-mac-zzz"[13] xxx.xxx.xxx.xxx:11711 #7: NAT-Traversal: Result using RFC 3947: peer is NATed
|
|
152
|
+
"remote-access-mac-zzz"[13] xxx.xxx.xxx.xxx:11711 #7: Peer ID is ID_IPV4_ADDR: '192.168.250.111'
|
|
153
|
+
"remote-access-mac-zzz"[14] xxx.xxx.xxx.xxx:11711 #7: deleting connection "remote-access-mac-zzz" instance with peer xxx.xxx.xxx.xxx {isakmp=#0/ipsec=#0}
|
|
154
|
+
"remote-access-mac-zzz"[14] xxx.xxx.xxx.xxx:27258 #7: sent MR3, ISAKMP SA established
|
|
155
|
+
"remote-access-mac-zzz"[14] xxx.xxx.xxx.xxx:27258 #7: cannot respond to IPsec SA request because no connection is known for 111.111.111.111:4500[111.111.111.111]:17/1701...xxx.xxx.xxx.xxx:27258[192.168.250.111]:17/%any===192.168.250.111/32
|
|
156
|
+
"remote-access-mac-zzz"[14] xxx.xxx.xxx.xxx:27258 #7: sending encrypted notification INVALID_ID_INFORMATION to xxx.xxx.xxx.xxx:27258
|
|
157
|
+
"remote-access-mac-zzz"[14] xxx.xxx.xxx.xxx:27258 #7: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0x01000000 (perhaps this is a duplicated packet)
|
|
158
|
+
"remote-access-mac-zzz"[14] xxx.xxx.xxx.xxx:27258 #7: sending encrypted notification INVALID_MESSAGE_ID to xxx.xxx.xxx.xxx:27258
|
|
159
|
+
"remote-access-mac-zzz"[14] xxx.xxx.xxx.xxx:27258 #7: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0x01000000 (perhaps this is a duplicated packet)
|
|
160
|
+
"remote-access-mac-zzz"[14] xxx.xxx.xxx.xxx:27258 #7: sending encrypted notification INVALID_MESSAGE_ID to xxx.xxx.xxx.xxx:27258
|
|
161
|
+
"remote-access-mac-zzz"[14] xxx.xxx.xxx.xxx:27258 #7: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0x01000000 (perhaps this is a duplicated packet)
|
|
162
|
+
"remote-access-mac-zzz"[14] xxx.xxx.xxx.xxx:27258 #7: sending encrypted notification INVALID_MESSAGE_ID to xxx.xxx.xxx.xxx:27258
|
|
163
|
+
"remote-access-mac-zzz"[14] xxx.xxx.xxx.xxx:27258 #7: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0x01000000 (perhaps this is a duplicated packet)
|
|
164
|
+
"remote-access-mac-zzz"[14] xxx.xxx.xxx.xxx:27258 #7: sending encrypted notification INVALID_MESSAGE_ID to xxx.xxx.xxx.xxx:27258
|
|
165
|
+
"remote-access-mac-zzz"[14] xxx.xxx.xxx.xxx:27258 #7: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0x01000000 (perhaps this is a duplicated packet)
|
|
166
|
+
"remote-access-mac-zzz"[14] xxx.xxx.xxx.xxx:27258 #7: sending encrypted notification INVALID_MESSAGE_ID to xxx.xxx.xxx.xxx:27258
|
|
167
|
+
"remote-access-mac-zzz"[14] xxx.xxx.xxx.xxx:27258 #7: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0x01000000 (perhaps this is a duplicated packet)
|
|
168
|
+
"remote-access-mac-zzz"[14] xxx.xxx.xxx.xxx:27258 #7: sending encrypted notification INVALID_MESSAGE_ID to xxx.xxx.xxx.xxx:27258
|
|
169
|
+
"remote-access-mac-zzz"[14] xxx.xxx.xxx.xxx:27258 #7: received Delete SA payload: deleting ISAKMP State #7
|
|
170
|
+
"remote-access-mac-zzz"[14] xxx.xxx.xxx.xxx:27258: deleting connection "remote-access-mac-zzz" instance with peer xxx.xxx.xxx.xxx {isakmp=#0/ipsec=#0}
|
|
171
|
+
```
|
|
172
|
+
|
|
173
|
+
■接続設定に関して
|
|
174
|
+
PPPoE接続やNAPTについて知識が乏しくよくわからない状態で設定をしています。
|
|
175
|
+
参考にしたサイトのURLが抜けていたのですが、接続イメージはそこのサイトと同じと考えています。
|
|
176
|
+
外からvyosに繋いで、そこからvyosにつながっているローカル環境へつなげればと考えています。
|
|
177
|
+
http://qiita.com/khayama/items/c63d4d5f02abdf348889
|