用ASDM或CLI配置IKEv1 IPsec站点到站点隧道在ASA

简介

本文描述如何配置在Cisco 5515-X系列可适应的安全工具(ASA)之间的一条互联网密钥交换版本1 (IKEv1) IPsec站点到站点隧道该运行软件版本9.2.x和运行软件版本8.2.x的Cisco 5510系列ASA。

先决条件

要求

Cisco建议这些需求符合，在您尝试在本文描述的配置前：

必须设立端到端IP连通性。必须允许这些协议：IPsec控制层面的用户数据报协议(UDP) 500和4500IPsec数据层面的封装安全有效载荷(ESP) IP协议50

使用的组件

本文档中的信息基于以下软件和硬件版本：

运行软件版本8.2的Cisco 5510系列ASA运行软件版本9.2的Cisco 5515-X ASA

本文档中的信息都是基于特定实验室环境中的设备编写的。本文档中使用的所有设备最初均采用原始（默认）配置。如果您使用的是真实网络，请确保您已经了解所有命令的潜在影响。

配置

此部分描述如何配置Site to Site VPN隧道通过可适应安全设备管理器(ASDM) VPN向导或通过CLI。

网络图

这是使用示例在本文中的结构：

​​

​​

通过ASDM VPN向导配置

完成这些步骤为了通过ASDM向导设置Site to Site VPN隧道：

打开ASDM并且连接到向导> VPN向导> Site to Site VPN向导：

​​

​​一旦到达向导主页，其次请点击：

​​

​​Note:最最近的ASDM版本提供解释此配置的视频的一条链路。配置对端IP地址。在本例中，对端IP地址设置为在站点B.的192.168.1.1。如果配置在站点A的对端IP地址，必须更改到172.16.1.1。远程终端可以被到达的接口也指定。点击其次一次完整。

​​

​​配置本地和远程网络(数据流源和目的地)。此镜像显示站点B的配置(撤消申请站点A) ：

​​

​​在安全页，请配置预先共享密钥(在两个必须配比末端)。点击其次一次完整。

​​

​​配置数据流的源接口在ASA。ASDM自动地创建根据ASA版本的网络地址转换(NAT)规则并且推进它以配置的其余在最后一步的。Note:对于在本文使用的示例，里面是数据流的来源。​​

​​向导当前提供将被推进对ASA配置的汇总。查看并且验证配置设置和然后点击完成。

​​

​​

通过CLI配置

此部分描述如何通过CLI配置IKEv1 IPsec站点到站点隧道。

配置ASA版本8.4和以上的站点B

在ASA版本8.4和以上，引入IKEv1和互联网密钥交换版本2 (IKEv2)的技术支持。

提示：关于两个版本之间的区别的更多信息，是指​​为什么移植到IKEv2 ？​​IKEv1的很快迁移的部分对IKEv2 L2L隧道配置的在ASA 8.4代码Cisco文档。

提示：关于与ASA的IKEv2配置示例，请是指​​在ASA和路由器配置示例​​Cisco文档之间的​​站点到站点IKEv2隧道​​。

阶段1 (IKEv1)

完成阶段1配置的这些步骤：

输入此命令CLI为了启用在外部接口的IKEv1 ：

crypto ikev1 enable outside

创建定义了使用的算法/方法切细，认证、迪菲─赫尔曼组、寿命和加密的一个IKEv1策略：

crypto ikev1 policy 1
!The 1 in the above command refers to the Policy suite priority
 (1 highest, 65535 lowest)
  authentication pre-share
  encryption aes
  hash sha
  group 2
  lifetime 86400

创建一个隧道组在IPsec属性下并且配置对端IP地址和隧道预先共享密钥：

tunnel-group 192.168.1.1 type ipsec-l2l
tunnel-group 192.168.1.1 ipsec-attributes
 ikev1 pre-shared-key cisco
 ! Note the IKEv1 keyword at the beginning of the pre-shared-key command.

第2阶段(IPsec)

完成第2阶段配置的这些步骤：

建立定义了将加密和被以隧道传输的数据流的一访问列表。在本例中，数据流利益是从从10.2.2.0子网来源到10.1.1.0的隧道的数据流。如果有多个子网介入在站点之间，它能包含多个条目。

在版本8.4和以上，起容器作用对于网络、子网、主机IP地址或者多个对象的对象或对象组可以创建。创建有本机和远程子网的两个对象并且请使用他们加密访问控制表(ACL)和NAT语句。

object network 10.2.2.0_24
 subnet 10.2.2.0 255.255.255.0
object network 10.1.1.0_24
 subnet 10.1.1.0 255.255.255.0

access-list 100 extended permit ip object 10.2.2.0_24 object 10.1.1.0_24

配置转换设置(TS)，必须介入关键字IKEv1。在远程终端必须创建相同的TS。

crypto ipsec ikev1 transform-set myset esp-aes esp-sha-hmac

配置加密映射，包含这些组件：对端IP地址包含数据流利益的定义的访问控制列表TS设置可选的完整转发安全性(PFS)，创建一个新的对迪菲─赫尔曼密钥使用为了保护数据(两边一定是PFS启用的，在第2阶段出现)前应用在外部接口的加密映射：

crypto map outside_map 20 match address 100
crypto map outside_map 20 set peer 192.168.1.1
crypto map outside_map 20 set ikev1 transform-set myset
crypto map outside_map 20 set pfs
crypto map outside_map interface outside

NAT免税

保证VPN流量对其他NAT规则没有被服从。这是使用的NAT规则：

nat (inside,outside) 1 source static 10.2.2.0_24 10.2.2.0_24 destination static
 10.1.1.0_24 10.1.1.0_24 no-proxy-arp route-lookup

Note:当使用时多个子网，您在NAT规则必须用所有包括源和目的地子网创建对象组和使用他们。

object-group  network 10.x.x.x_SOURCE
 network-object  10.4.4.0 255.255.255.0
 network-object  10.2.2.0 255.255.255.0

object network 10.x.x.x_DESTINATION
 network-object  10.3.3.0 255.255.255.0
 network-object  10.1.1.0 255.255.255.0

nat (inside,outside) 1 source static 10.x.x.x_SOURCE 10.x.x.x_SOURCE destination
 static 10.x.x.x_DESTINATION  10.x.x.x_DESTINATION no-proxy-arp route-lookup

完整配置示例

这是站点的B完整的配置：

crypto ikev1 enable outside

crypto ikev1 policy 10
 authentication pre-share
 encryption aes
 hash sha
 group 2
 lifetime 86400

tunnel-group 192.168.1.1 type ipsec-l2l
tunnel-group 192.168.1.1 ipsec-attributes
 ikev1 pre-shared-key cisco
 !Note the IKEv1 keyword at the beginning of the pre-shared-key command.

object network 10.2.2.0_24 
 subnet 10.2.2.0 255.255.255.0 
object network 10.1.1.0_24 
 subnet 10.1.1.0 255.255.255.0

access-list 100 extended permit ip object 10.2.2.0_24 object 10.1.1.0_24

crypto ipsec ikev1 transform-set myset esp-aes esp-sha-hmac

crypto map outside_map 20 match address 100
crypto map outside_map 20 set peer 192.168.1.1
crypto map outside_map 20 set ikev1 transform-set myset
crypto map outside_map 20 set pfs
crypto map outside_map interface outside

nat (inside,outside) 1 source static 10.2.2.0_24 10.2.2.0_24 destination static
 10.1.1.0_24 10.1.1.0_24 no-proxy-arp route-lookup

配置ASA版本8.2和以下的站点A

此部分描述如何配置ASA版本8.2和以下的站点A。

阶段1 (ISAKMP)

完成阶段1配置的这些步骤：

输入此命令CLI为了启用在外部接口的互联网安全协会和密钥管理协议(ISAKMP) ：

crypto isakmp enable outside

Note:由于IKE多个版本(IKEv1和IKEv2)不支持的其中任一更加长， ISAKMP用于为了是指阶段1。

创建定义了使用的算法/方法为了构件阶段1的一个ISAKMP策略。Note:在此配置示例中，从版本9.x的关键字IKEv1用ISAKMP替换。

crypto isakmp policy 1
  authentication pre-share
  encryption aes
  hash sha
  group 2
  lifetime 86400

用预先共享密钥创建对端IP地址的(外部IP地址一个隧道组5515) ：

tunnel-group 172.16.1.1 type ipsec-l2l
 tunnel-group 172.16.1.1 ipsec-attributes 
  pre-shared-key cisco

第2阶段(IPsec)

完成第2阶段配置的这些步骤：

类似于在版本9.x的配置，您必须建立扩展访问列表为了定义数据流利益。

access-list 100 extended permit ip 10.1.1.0 255.255.255.0
 10.2.2.0 255.255.255.0

定义包含所有可用的加密和哈希算法的TS (提供问题请有一个问号)。保证它与在另一边被配置的那是相同的。

crypto ipsec transform-set myset esp-aes esp-sha-hmac

配置一个加密映射，包含这些组件：对端IP地址包含数据流利益的定义的访问控制列表TS一个可选的PFS设置，创建一个新的对迪菲─赫尔曼密钥使用为了保护数据(两边一定是PFS启用的，以便第2阶段出现)应用在外部接口的加密映射：

crypto map outside_map 20 set peer 172.16.1.1
crypto map outside_map 20 match address 100
crypto map outside_map 20 set transform-set myset
crypto map outside_map 20 set pfs
crypto map outside_map interface outside

NAT免税

建立定义了从NAT检查将豁免的数据流的一访问列表。在此版本中，它看起来与您为数据流利益定义的访问列表相似：

access-list nonat line 1 extended permit ip 10.1.1.0 255.255.255.0
 10.2.2.0  255.255.255.0

当使用时多个子网，请添加另一条线路到同一访问列表：

access-list nonat line 1 extended permit ip 10.3.3.0 255.255.255.0 
 10.4.4.0 255.255.255.0

访问列表与NAT一起使用，如显示此处：

nat (inside) 0 access-list nonat

Note:此处里面是指ASA收到数据流匹配访问列表内部接口的名字。

完整配置示例

这是站点回答:的完整的配置

crypto isakmp enable outside
crypto isakmp policy 10
 authentication pre-share
 encryption aes
 hash sha
 group 2
 lifetime 86400

tunnel-group 172.16.1.1 type ipsec-l2l
tunnel-group 172.16.1.1 ipsec-attributes
 pre-shared-key cisco

access-list 100 extended permit ip 10.1.1.0 255.255.255.0
 10.2.2.0 255.255.255.0
crypto ipsec transform-set myset esp-aes esp-sha-hmac

crypto map outside_map 20 set peer
crypto map outside_map 20 match address 100
crypto map outside_map 20 set transform-set myset
crypto map outside_map 20 set pfs
crypto map outside_map interface outside

access-list nonat line 1 extended permit ip 10.1.1.0 255.255.255.0
 10.2.2.0  255.255.255.0

nat (inside) 0 access-list nonat

组策略

组策略用于为了定义适用于隧道的特定设置。这些策略与隧道组一道使用。

组策略可以被定义成内部的二者之一，因此意味着属性从在ASA被定义的那被拉，或者可以被定义成外部，属性从外部服务器被查询。这是使用为了定义组策略的命令：

group-policy SITE_A internal

Note:您能定义在组策略的多个属性。关于所有可能的属性列表，请是指所选的ASDM VPN配置程序的​​配置的组​​策略部分5500系列的Cisco的ASA，版本5.2。

聚合策略可选属性

vpn隧道协议属性确定这些设置应该适用的隧道类型。在本例中，使用IPsec：

vpn-tunnel-protocol ?
  group-policy mode commands/options:
  IPSec       IP Security Protocol
  l2tp-ipsec  L2TP using IPSec for security
  svc         SSL VPN Client
  webvpn      WebVPN

vpn-tunnel-protocol ipsec - Versions 8.2 and prior
vpn-tunnel-protocol ikev1 - Version 8.4 and later

您有配置的选项隧道，以便坚持空闲(没有数据流)和不断开。为了配置此选项，属性值应该使用分钟，或者您能设置值到无，因此意味着隧道从未断开。

示例如下：

group-policy SITE_A attributes
 vpn-idle-timeout ?
 group-policy mode commands/options:
 <1-35791394>  Number of minutes
 none   IPsec VPN: Disable timeout and allow an unlimited idle period;

在隧道组的一般属性的下default-group-policy命令定义了使用为了推进隧道的某些策略设置设立的组策略。您在组策略没有定义的选项的默认设置从一个全局默认组策略被采取：

tunnel-group 172.16.1.1 general-attributes
 default-group-policy SITE_A

验证

请使用在此部分被提供为了验证的信息您的配置适当地工作。

ASDM

为了查看从ASDM的隧道状态，连接对Monitoring> VPN。提供此信息：

对端IP地址使用为了构建隧道的协议使用的加密算法隧道过来和正常运行的时间接收并且被传输信息包的数量

提示：因为数据在实时，不更新点击刷新为了查看最新的值。

​​

​​

​​

​​

CLI

此部分描述如何通过CLI验证您的配置。

第 1 阶段

输入此命令CLI为了验证在站点B (5515)边的阶段1配置：

show crypto ikev1 sa

Active SA: 1
   Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
Total IKE SA: 1

1   IKE Peer: 192.168.1.1
    Type    : L2L             Role    : initiator
    Rekey   : no              State   : MM_ACTIVE

输入此命令CLI为了验证在站点A (5510)边的阶段1配置：

show crypto isakmp sa

Active SA: 1
   Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
Total IKE SA: 1

1   IKE Peer: 172.16.1.1
    Type    : L2L             Role    : initiator
    Rekey   : no              State   : MM_ACTIVE

第 2 阶段

show crypto ipsec sa命令显示被构件在对等体之间的IPSec SAS。加密隧道被构建在流在网络10.1.1.0和10.2.2.0之间的数据流的IP地址192.168.1.1和172.16.1.1之间。您能为入站和出站通流量看到两个ESP SAS被构件。认证报头(AH)，因为没有AH SAS，没有使用。

输入此命令CLI为了验证在站点B (5515)边的第2阶段配置：

interface: FastEthernet0
Crypto map tag: outside_map, local addr. 172.16.1.1
 local ident (addr/mask/prot/port): (10.2.2.0/255.255.255.0/0/0)
 remote ident (addr/mask/prot/port): (10.1.1.0/255.255.255.0/0/0)
 current_peer: 192.168.1.1
   PERMIT, flags={origin_is_acl,}
  #pkts encaps: 20, #pkts encrypt: 20, #pkts digest 20
  #pkts decaps: 20, #pkts decrypt: 20, #pkts verify 20
  #pkts compressed: 0, #pkts decompressed: 0
  #pkts not compressed: 0, #pkts compr. failed: 0, 
  #pkts decompress failed: 0, #send errors 0, #recv errors 0
   local crypto endpt.: 172.16.1.1, remote crypto endpt.: 172.16.1.1
   path mtu 1500, media mtu 1500
   current outbound spi: 3D3
   inbound esp sas:
    spi: 0x136A010F(325714191)
      transform: esp-aes esp-sha-hmac ,
      in use settings ={Tunnel, }
      slot: 0, conn id: 3442, flow_id: 1443, crypto map: outside_map
      sa timing: remaining key lifetime (k/sec): (4608000/52)
      IV size: 8 bytes
      replay detection support: Y
   inbound ah sas:
   inbound pcp sas:
   inbound pcp sas:
   outbound esp sas:
    spi: 0x3D3(979)
      transform: esp-aes esp-sha-hmac ,
      in use settings ={Tunnel, }
      slot: 0, conn id: 3443, flow_id: 1444, crypto map: outside_map
      sa timing: remaining key lifetime (k/sec): (4608000/52)
      IV size: 8 bytes
      replay detection support: Y
   outbound ah sas:
   outbound pcp sas

输入此命令CLI为了验证在站点A (5510)边的第2阶段配置：

interface: FastEthernet0
   Crypto map tag: outside_map, local addr. 192.168.1.1
  local ident (addr/mask/prot/port): (10.1.1.0/255.255.255.0/0/0)
  remote ident (addr/mask/prot/port): (10.2.2.0/255.255.255.0/0/0)
  current_peer: 172.16.1.1
    PERMIT, flags={origin_is_acl,}
   #pkts encaps: 20, #pkts encrypt: 20, #pkts digest 20
   #pkts decaps: 20, #pkts decrypt: 20, #pkts verify 20
   #pkts compressed: 0, #pkts decompressed: 0
   #pkts not compressed: 0, #pkts compr. failed: 0,
   #pkts decompress failed: 0, #send errors 0, #recv errors 0
    local crypto endpt.: 192.168.1.1, remote crypto endpt.: 172.16.1.1
    path mtu 1500, media mtu 1500
    current outbound spi: 3D3
    inbound esp sas:
     spi: 0x136A010F(325714191)
       transform: esp-aes esp-sha-hmac ,
       in use settings ={Tunnel, }
       slot: 0, conn id: 3442, flow_id: 1443, crypto map: outside_map
       sa timing: remaining key lifetime (k/sec): (4608000/52)
       IV size: 8 bytes
       replay detection support: Y
    inbound ah sas:
    inbound pcp sas:
    inbound pcp sas:
    outbound esp sas:
     spi: 0x3D3(979)
       transform: esp-aes esp-sha-hmac ,
       in use settings ={Tunnel, }
       slot: 0, conn id: 3443, flow_id: 1444, crypto map: outside_map
       sa timing: remaining key lifetime (k/sec): (4608000/52)
       IV size: 8 bytes
       replay detection support: Y
    outbound ah sas:
    outbound pcp sas

故障排除

请使用在此部分被提供为了排除配置问题故障的信息。

ASA版本8.4和以上

输入这些调试指令为了确定隧道故障的位置：

debug crypto ikev1 127(第1)阶段debug crypto ipsec 127(第2)阶段

这是一完整示例debug输出：

IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=1,
 saddr=10.2.2.1, sport=19038, daddr=10.1.1.1, dport=19038
IPSEC(crypto_map_check)-3: Checking crypto map outside_map 20: matched.
Feb 13 23:48:56 [IKEv1 DEBUG]Pitcher: received a key acquire message, spi 0x0
IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=1,
 saddr=10.2.2.1, sport=19038, daddr=10.1.1.1, dport=19038
IPSEC(crypto_map_check)-3: Checking crypto map outside_map 20: matched.
Feb 13 23:48:56 [IKEv1]IP = 192.168.1.1, IKE Initiator: New Phase 1, Intf NP
 Identity Ifc, IKE Peer 192.168.1.1  local Proxy Address 10.2.2.0, remote Proxy
 Address 10.1.1.0,  Crypto map (outside_map) Feb 13 23:48:56 [IKEv1 DEBUG]IP =
 192.168.1.1, constructing ISAKMP SA payload Feb 13 23:48:56 [IKEv1 DEBUG]IP =
 192.168.1.1, constructing NAT-Traversal VID ver 02 payload
Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, constructing NAT-Traversal VID
 ver 03 payload
Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, constructing NAT-Traversal VID
 ver RFC payload
Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, constructing Fragmentation VID +
 extended capabilities payload
Feb 13 23:48:56 [IKEv1]IP = 192.168.1.1, IKE_DECODE SENDING Message (msgid=0)
 with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR
 (13) + NONE (0) total length : 172
Feb 13 23:48:56 [IKEv1]IKE Receiver: Packet received on 172.16.1.1:500
 from 192.168.1.1:500
Feb 13 23:48:56 [IKEv1]IP = 192.168.1.1, IKE_DECODE RECEIVED Message (msgid=0)
 with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + NONE (0) total
 length : 132
Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, processing SA payload
Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, Oakley proposal is acceptable
Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, processing VID payload
Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, Received NAT-Traversal ver 02 VID
Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, processing VID payload
Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, Received Fragmentation VID
Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, IKE Peer included IKE
 fragmentation capability flags:  Main Mode: True  Aggressive Mode:  True
Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, constructing ke payload
Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, constructing nonce payload
Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, constructing Cisco Unity
 VID payload
Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, constructing xauth V6
 VID payload
Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, Send IOS VID
Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, Constructing ASA spoofing IOS
 Vendor ID payload (version: 1.0.0, capabilities: 20000001)
Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, constructing VID payload
Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, Send Altiga/Cisco VPN3000/Cisco
 ASA GW VID
Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, constructing NAT-Discovery payload
Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, computing NAT Discovery hash
Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, constructing NAT-Discovery payload
Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, computing NAT Discovery hash
Feb 13 23:48:56 [IKEv1]IP = 192.168.1.1, IKE_DECODE SENDING Message (msgid=0)
 with payloads : HDR + KE (4) + NONCE (10) + VENDOR (13) + VENDOR (13) + VENDOR
 (13) + VENDOR (13) + NAT-D (130) + NAT-D (130) + NONE (0) total length : 304
Feb 13 23:48:56 [IKEv1]IKE Receiver: Packet received on 172.16.1.1:500
 from 192.168.1.1:500
Feb 13 23:48:56 [IKEv1]IP = 192.168.1.1, IKE_DECODE RECEIVED Message (msgid=0)
 with payloads : HDR + KE (4) + NONCE (10) + VENDOR (13) + VENDOR (13) + VENDOR
 (13) + VENDOR (13) + NAT-D (130) + NAT-D (130) + NONE (0) total length : 304
Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, processing ke payload
Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, processing ISA_KE payload
Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, processing nonce payload
Feb 13 23:48:56 [IKEv1 DEBUG]?IP = 192.168.1.1, processing VID payload
Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, Received Cisco Unity client VID
Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, processing VID payload
Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, Received xauth V6 VID
Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, processing VID payload
Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, Processing VPN3000/ASA spoofing
 IOS Vendor ID payload (version: 1.0.0, capabilities: 20000001)
Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, processing VID payload
Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, Received Altiga/Cisco
 VPN3000/Cisco ASA GW VID
Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, processing NAT-Discovery payload
Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, computing NAT Discovery hash
Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, processing NAT-Discovery payload
!
Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, computing NAT Discovery hash
Feb 13 23:48:56 [IKEv1]IP = 192.168.1.1, Connection landed on tunnel_group
 192.168.1.1
Feb 13 23:48:56 [IKEv1 DEBUG]!Group = 192.168.1.1, IP = 192.168.1.1, Generating
 keys for Initiator...
Feb 13 23:48:56 [IKEv1 DEBUG]Group = 192.168.1.1, IP = 192.168.1.1, constructing
 ID payload
Feb 13 23:48:56 [IKEv1 DEBUG]!Group = 192.168.1.1, IP = 192.168.1.1, constructing
 hash payload
Feb 13 23:48:56 [IKEv1 DEBUG]Group = 192.168.1.1, IP = 192.168.1.1, Computing
 hash for ISAKMP
Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, Constructing IOS keep alive
 payload: proposal=32767/32767 sec.
!
Success rate is 80 percent (4/5), round-trip min/avg/max = 1/3/10 ms
ciscoasa# Feb 13 23:48:56 [IKEv1 DEBUG]Group = 192.168.1.1, IP = 192.168.1.1,
 constructing dpd vid payload
Feb 13 23:48:56 [IKEv1]IP = 192.168.1.1, IKE_DECODE SENDING Message (msgid=0)
 with payloads : HDR + ID (5) + HASH (8) + IOS KEEPALIVE (128) + VENDOR (13) +
 NONE (0) total length : 96
Feb 13 23:48:56 [IKEv1]Group = 192.168.1.1, IP = 192.168.1.1, Automatic NAT
 Detection Status: Remote end is NOT behind a NAT device This end is NOT behind
 a NAT device
Feb 13 23:48:56 [IKEv1]IKE Receiver: Packet received on 172.16.1.1:500
 from 192.168.1.1:500
Feb 13 23:48:56 [IKEv1]IP = 192.168.1.1, IKE_DECODE RECEIVED Message (msgid=0)
 with payloads : HDR + ID (5) + HASH (8) + IOS KEEPALIVE (128) + VENDOR (13) +
 NONE (0) total length : 96
Feb 13 23:48:56 [IKEv1 DEBUG]Group = 192.168.1.1, IP = 192.168.1.1, processing
 ID payload
Feb 13 23:48:56 [IKEv1 DECODE]Group = 192.168.1.1, IP = 192.168.1.1,
 ID_IPV4_ADDR ID received 192.168.1.1
Feb 13 23:48:56 [IKEv1 DEBUG]Group = 192.168.1.1, IP = 192.168.1.1,
 processing hash payload
Feb 13 23:48:56 [IKEv1 DEBUG]Group = 192.168.1.1, IP = 192.168.1.1, Computing
 hash for ISAKMP
Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, Processing IOS keep alive payload:
 proposal=32767/32767 sec.
Feb 13 23:48:56 [IKEv1 DEBUG]Group = 192.168.1.1, IP = 192.168.1.1, processing
 VID payload
Feb 13 23:48:56 [IKEv1 DEBUG]Group = 192.168.1.1, IP = 192.168.1.1, Received
 DPD VID
Feb 13 23:48:56 [IKEv1]IP = 192.168.1.1, Connection landed on tunnel_group
 192.168.1.1
Feb 13 23:48:56 [IKEv1 DEBUG]Group = 192.168.1.1, IP = 192.168.1.1, Oakley
 begin quick mode
Feb 13 23:48:56 [IKEv1 DECODE]Group = 192.168.1.1, IP = 192.168.1.1, IKE
 Initiator starting QM: msg id = 4c073b21
Feb 13 23:48:56 [IKEv1]Group = 192.168.1.1, IP = 192.168.1.1, PHASE 1 COMPLETED
Feb 13 23:48:56 [IKEv1]IP = 192.168.1.1, Keep-alive type for this connection: DPD
Feb 13 23:48:56 [IKEv1 DEBUG]Group = 192.168.1.1, IP = 192.168.1.1, Starting P1
 rekey timer: 73440 seconds.
IPSEC: New embryonic SA created @ 0x75298588,
   SCB: 0x75C34F18,
   Direction: inbound
   SPI      : 0x03FC9DB7
   Session ID: 0x00004000
   VPIF num  : 0x00000002
   Tunnel type: l2l
   Protocol   : esp
   Lifetime   : 240 seconds
Feb 13 23:48:56 [IKEv1 DEBUG]Group = 192.168.1.1, IP = 192.168.1.1,
 IKE got SPI from key engine: SPI = 0x03fc9db7
Feb 13 23:48:56 [IKEv1 DEBUG]Group = 192.168.1.1, IP = 192.168.1.1,
 oakley constucting quick mode
Feb 13 23:48:56 [IKEv1 DEBUG]Group = 192.168.1.1, IP = 192.168.1.1,
 constructing blank hash payload
Feb 13 23:48:56 [IKEv1 DEBUG]Group = 192.168.1.1, IP = 192.168.1.1,
 constructing IPSec SA payload
Feb 13 23:48:56 [IKEv1 DEBUG]Group = 192.168.1.1, IP = 192.168.1.1,
 constructing IPSec nonce payload
Feb 13 23:48:56 [IKEv1 DEBUG]Group = 192.168.1.1, IP = 192.168.1.1,
 constructing proxy ID
Feb 13 23:48:56 [IKEv1 DEBUG]Group = 192.168.1.1, IP = 192.168.1.1,
 Transmitting Proxy Id:
   Local subnet:  10.2.2.0  mask 255.255.255.0 Protocol 0  Port 0
   Remote subnet: 10.1.1.0  Mask 255.255.255.0 Protocol 0  Port 0
Feb 13 23:48:56 [IKEv1 DECODE]Group = 192.168.1.1, IP = 192.168.1.1,
 IKE Initiator sending Initial Contact
Feb 13 23:48:56 [IKEv1 DEBUG]Group = 192.168.1.1,
 IP = 192.168.1.1, constructing qm hash payload
Feb 13 23:48:56 [IKEv1 DECODE]Group = 192.168.1.1,
 IP = 192.168.1.1, IKE Initiator sending 1st QM pkt: msg id = 4c073b21
Feb 13 23:48:56 [IKEv1]IP = 192.168.1.1, IKE_DECODE SENDING Message (msgid=4c073b21)
 with payloads : HDR + HASH (8) + SA (1) + NONCE (10) + ID (5) + ID (5) +
 NOTIFY (11) + NONE (0) total length : 200
Feb 13 23:48:56 [IKEv1]IKE Receiver: Packet received on 172.16.1.1:500
 from 192.168.1.1:500
Feb 13 23:48:56 [IKEv1]IP = 192.168.1.1, IKE_DECODE RECEIVED Message (msgid=4c073b21)
 with payloads : HDR + HASH (8) + SA (1) + NONCE (10) + ID (5) + ID (5) + NONE (0)
 total length : 172
Feb 13 23:48:56 [IKEv1 DEBUG]Group = 192.168.1.1, IP = 192.168.1.1,
 processing hash payload
Feb 13 23:48:56 [IKEv1 DEBUG]Group = 192.168.1.1, IP = 192.168.1.1,
 processing SA payload
Feb 13 23:48:56 [IKEv1 DEBUG]Group = 192.168.1.1, IP = 192.168.1.1,
 processing nonce payload
Feb 13 23:48:56 [IKEv1 DEBUG]Group = 192.168.1.1, IP = 192.168.1.1,
 processing ID payload
Feb 13 23:48:56 [IKEv1 DECODE]Group = 192.168.1.1, IP = 192.168.1.1,
 ID_IPV4_ADDR_SUBNET ID received--10.2.2.0--255.255.255.0
Feb 13 23:48:56 [IKEv1 DEBUG]Group = 192.168.1.1, IP = 192.168.1.1,
 processing ID payload
Feb 13 23:48:56 [IKEv1 DECODE]Group = 192.168.1.1, IP = 192.168.1.1,
 ID_IPV4_ADDR_SUBNET ID received--10.1.1.0--255.255.255.0
Feb 13 23:48:56 [IKEv1 DEBUG]Group = 192.168.1.1, IP = 192.168.1.1,
 loading all IPSEC SAs
Feb 13 23:48:56 [IKEv1 DEBUG]Group = 192.168.1.1, IP = 192.168.1.1,
 Generating Quick Mode Key!
Feb 13 23:48:56 [IKEv1 DEBUG]Group = 192.168.1.1, IP = 192.168.1.1,
 NP encrypt rule look up for crypto map outside_map 20 matching ACL
 100: returned cs_id=6ef246d0; encrypt_rule=752972d0;
 tunnelFlow_rule=75ac8020
Feb 13 23:48:56 [IKEv1 DEBUG]Group = 192.168.1.1, IP = 192.168.1.1,
 Generating Quick Mode Key!
IPSEC: New embryonic SA created @ 0x6f0e03f0,
   SCB: 0x75B6DD00,
   Direction: outbound
   SPI      : 0x1BA0C55C
   Session ID: 0x00004000
   VPIF num  : 0x00000002
   Tunnel type: l2l
   Protocol   : esp
   Lifetime   : 240 seconds
IPSEC: Completed host OBSA update, SPI 0x1BA0C55C
IPSEC: Creating outbound VPN context, SPI 0x1BA0C55C
   Flags: 0x00000005
   SA   : 0x6f0e03f0
   SPI  : 0x1BA0C55C
   MTU  : 1500 bytes
   VCID : 0x00000000
   Peer : 0x00000000
   SCB  : 0x0B47D387
   Channel: 0x6ef0a5c0
IPSEC: Completed outbound VPN context, SPI 0x1BA0C55C
   VPN handle: 0x0000f614
IPSEC: New outbound encrypt rule, SPI 0x1BA0C55C
   Src addr: 10.2.2.0
   Src mask: 255.255.255.0
   Dst addr: 10.1.1.0
   Dst mask: 255.255.255.0
   Src ports
     Upper: 0
     Lower: 0
     Op   : ignore
   Dst ports
     Upper: 0
     Lower: 0
     Op   : ignore
   Protocol: 0
   Use protocol: false
   SPI: 0x00000000
   Use SPI: false
IPSEC: Completed outbound encrypt rule, SPI 0x1BA0C55C
   Rule ID: 0x74e1c558
IPSEC: New outbound permit rule, SPI 0x1BA0C55C
   Src addr: 172.16.1.1
   Src mask: 255.255.255.255
   Dst addr: 192.168.1.1
   Dst mask: 255.255.255.255
   Src ports
     Upper: 0
     Lower: 0
     Op   : ignore
   Dst ports
     Upper: 0
     Lower: 0
     Op   : ignore
   Protocol: 50
   Use protocol: true
   SPI: 0x1BA0C55C
   Use SPI: true
IPSEC: Completed outbound permit rule, SPI 0x1BA0C55C
   Rule ID: 0x6f0dec80
Feb 13 23:48:56 [IKEv1 DEBUG]Group = 192.168.1.1, IP = 192.168.1.1, NP encrypt rule
 look up for crypto map outside_map 20 matching ACL 100: returned cs_id=6ef246d0;
 encrypt_rule=752972d0; tunnelFlow_rule=75ac8020
Feb 13 23:48:56 [IKEv1]Group = 192.168.1.1, IP = 192.168.1.1, Security negotiation
 complete for LAN-to-LAN Group (192.168.1.1)  Initiator, Inbound SPI = 0x03fc9db7,
 Outbound SPI = 0x1ba0c55c
Feb 13 23:48:56 [IKEv1 DEBUG]Group = 192.168.1.1, IP = 192.168.1.1, oakley
 constructing final quick mode
Feb 13 23:48:56 [IKEv1 DECODE]Group = 192.168.1.1, IP = 192.168.1.1, IKE Initiator
 sending 3rd QM pkt: msg id = 4c073b21
Feb 13 23:48:56 [IKEv1]IP = 192.168.1.1, IKE_DECODE SENDING Message (msgid=4c073b21)
 with payloads : HDR + HASH (8) + NONE (0) total length : 76
Feb 13 23:48:56 [IKEv1 DEBUG]Group = 192.168.1.1, IP = 192.168.1.1, IKE got a KEY_ADD
 msg for SA: SPI = 0x1ba0c55c
IPSEC: New embryonic SA created @ 0x75298588,
   SCB: 0x75C34F18,
   Direction: inbound
   SPI      : 0x03FC9DB7
   Session ID: 0x00004000
   VPIF num  : 0x00000002
   Tunnel type: l2l
   Protocol   : esp
   Lifetime   : 240 seconds
IPSEC: Completed host IBSA update, SPI 0x03FC9DB7
IPSEC: Creating inbound VPN context, SPI 0x03FC9DB7
   Flags: 0x00000006
   SA   : 0x75298588
   SPI  : 0x03FC9DB7
   MTU  : 0 bytes
   VCID : 0x00000000
   Peer : 0x0000F614
   SCB  : 0x0B4707C7
   Channel: 0x6ef0a5c0
IPSEC: Completed inbound VPN context, SPI 0x03FC9DB7
   VPN handle: 0x00011f6c
IPSEC: Updating outbound VPN context 0x0000F614, SPI 0x1BA0C55C
   Flags: 0x00000005
   SA   : 0x6f0e03f0
   SPI  : 0x1BA0C55C
   MTU  : 1500 bytes
   VCID : 0x00000000
   Peer : 0x00011F6C
   SCB  : 0x0B47D387
   Channel: 0x6ef0a5c0
IPSEC: Completed outbound VPN context, SPI 0x1BA0C55C
   VPN handle: 0x0000f614
IPSEC: Completed outbound inner rule, SPI 0x1BA0C55C
   Rule ID: 0x74e1c558
IPSEC: Completed outbound outer SPD rule, SPI 0x1BA0C55C
   Rule ID: 0x6f0dec80
IPSEC: New inbound tunnel flow rule, SPI 0x03FC9DB7
   Src addr: 10.1.1.0
   Src mask: 255.255.255.0
   Dst addr: 10.2.2.0
   Dst mask: 255.255.255.0
   Src ports
     Upper: 0
     Lower: 0
     Op   : ignore
   Dst ports
     Upper: 0
     Lower: 0
     Op   : ignore
   Protocol: 0
   Use protocol: false
   SPI: 0x00000000
   Use SPI: false
IPSEC: Completed inbound tunnel flow rule, SPI 0x03FC9DB7
   Rule ID: 0x74e1b4a0
IPSEC: New inbound decrypt rule, SPI 0x03FC9DB7
   Src addr: 192.168.1.1
   Src mask: 255.255.255.255
   Dst addr: 172.16.1.1
   Dst mask: 255.255.255.255
   Src ports
     Upper: 0
     Lower: 0
     Op   : ignore
   Dst ports
     Upper: 0
     Lower: 0
     Op   : ignore
   Protocol: 50
   Use protocol: true
   SPI: 0x03FC9DB7
   Use SPI: true
IPSEC: Completed inbound decrypt rule, SPI 0x03FC9DB7
   Rule ID: 0x6f0de830
IPSEC: New inbound permit rule, SPI 0x03FC9DB7
   Src addr: 192.168.1.1
   Src mask: 255.255.255.255
   Dst addr: 172.16.1.1
   Dst mask: 255.255.255.255
   Src ports
     Upper: 0
     Lower: 0
     Op   : ignore
   Dst ports
     Upper: 0
     Lower: 0
     Op   : ignore
   Protocol: 50
   Use protocol: true
   SPI: 0x03FC9DB7
   Use SPI: true
IPSEC: Completed inbound permit rule, SPI 0x03FC9DB7
   Rule ID: 0x6f0de8d8
Feb 13 23:48:56 [IKEv1 DEBUG]Group = 192.168.1.1, IP = 192.168.1.1, Pitcher:
 received KEY_UPDATE, spi 0x3fc9db7
Feb 13 23:48:56 [IKEv1 DEBUG]Group = 192.168.1.1, IP = 192.168.1.1, Starting
 P2 rekey timer: 24480 seconds.
Feb 13 23:48:56 [IKEv1]Group = 192.168.1.1, IP = 192.168.1.1, PHASE 2
 COMPLETED (msgid=4c073b21)

ASA版本8.3和以下

输入这些调试指令为了确定隧道故障的位置：

debug crypto isakmp 127(第1)阶段debug crypto ipsec 127(第2)阶段

这是一完整示例debug输出：

Feb 13 04:19:53 [IKEv1]: IP = 172.16.1.1, IKE_DECODE RECEIVED Message (msgid=0) with
 payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) +
 NONE (0) total length : 172
Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, processing SA payload
Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, Oakley proposal is acceptable
Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, processing VID payload
Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, Received NAT-Traversal ver 02 VID
Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, processing VID payload
Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, Received NAT-Traversal ver 03 VID
Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, processing VID payload
Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, Received NAT-Traversal RFC VID
Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, processing VID payload
Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, Received Fragmentation VID
Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, IKE Peer included IKE fragmentation
 capability flags:  Main Mode:        True  Aggressive Mode:  True
Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, processing IKE SA payload
Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, IKE SA Proposal # 1, Transform # 1
 acceptable  Matches global IKE entry # 1
Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, constructing ISAKMP SA payload
Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, constructing NAT-Traversal VID ver
 02 payload
Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, constructing Fragmentation VID +
 extended capabilities payload
Feb 13 04:19:53 [IKEv1]: IP = 172.16.1.1, IKE_DECODE SENDING Message (msgid=0) with
 payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 132
Feb 13 04:19:53 [IKEv1]: IP = 172.16.1.1, IKE_DECODE RECEIVED Message (msgid=0) with
 payloads : HDR + KE (4) + NONCE (10) + VENDOR (13) + VENDOR (13) + VENDOR (13) +
 VENDOR (13) + NAT-D (130) + NAT-D (130) + NONE (0) total length : 304
Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, processing ke payload
Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, processing ISA_KE payload
Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, processing nonce payload
Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, processing VID payload
Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, Received Cisco Unity client VID
Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, processing VID payload
Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, Received xauth V6 VID
Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, processing VID payload
Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, Processing VPN3000/ASA spoofing IOS
 Vendor ID payload (version: 1.0.0, capabilities: 20000001)
Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, processing VID payload
Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, Received Altiga/Cisco VPN3000/Cisco
 ASA GW VID
Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, processing NAT-Discovery payload
Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, computing NAT Discovery hash
Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, processing NAT-Discovery payload
Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, computing NAT Discovery hash
Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, constructing ke payload
Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, constructing nonce payload
Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, constructing Cisco Unity VID payload
Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, constructing xauth V6 VID payload
Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, Send IOS VID
Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, Constructing ASA spoofing IOS Vendor
 ID payload (version: 1.0.0, capabilities: 20000001)
Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, constructing VID payload
Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, Send Altiga/Cisco VPN3000/Cisco
 ASA GW VID
Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, constructing NAT-Discovery payload
Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, computing NAT Discovery hash
Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, constructing NAT-Discovery payload
Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, computing NAT Discovery hash
Feb 13 04:19:53 [IKEv1]: IP = 172.16.1.1, Connection landed on tunnel_group 172.16.1.1
Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1, Generating keys
 for Responder...
Feb 13 04:19:53 [IKEv1]: IP = 172.16.1.1, IKE_DECODE SENDING Message (msgid=0) with
 payloads : HDR + KE (4) + NONCE (10) + VENDOR (13) + VENDOR (13) + VENDOR (13) +
 VENDOR (13) + NAT-D (130) + NAT-D (130) + NONE (0) total length : 304
Feb 13 04:19:53 [IKEv1]: IP = 172.16.1.1, IKE_DECODE RECEIVED Message (msgid=0) with
 payloads : HDR + ID (5) + HASH (8) + IOS KEEPALIVE (128) + VENDOR (13) + NONE (0)
 total length : 96
Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1, processing
 ID payload
Feb 13 04:19:53 [IKEv1 DECODE]: Group = 172.16.1.1, IP = 172.16.1.1, ID_IPV4_ADDR
 ID received 172.16.1.1
Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1, processing
 hash payload
Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1, Computing
 hash for ISAKMP
Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, Processing IOS keep alive payload:
 proposal=32767/32767 sec.
Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1, processing
 VID payload
Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1, Received DPD VID
Feb 13 04:19:53 [IKEv1]: Group = 172.16.1.1, IP = 172.16.1.1, Automatic NAT Detection
 Status:     Remote end is NOT behind a NAT device     This   end is NOT behind
 a NAT device
Feb 13 04:19:53 [IKEv1]: IP = 172.16.1.1, Connection landed on tunnel_group 172.16.1.1
Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1,
 constructing ID payload
Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1,
 constructing hash payload
Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1,
 Computing hash for ISAKMP
Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, Constructing IOS keep alive payload:
 proposal=32767/32767 sec.
Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1,
 constructing dpd vid payload
Feb 13 04:19:53 [IKEv1]: IP = 172.16.1.1, IKE_DECODE SENDING Message (msgid=0) with
 payloads : HDR + ID (5) + HASH (8) + IOS KEEPALIVE (128) + VENDOR (13) + NONE (0)
 total length : 96
Feb 13 04:19:53 [IKEv1]: Group = 172.16.1.1, IP = 172.16.1.1, PHASE 1 COMPLETED
Feb 13 04:19:53 [IKEv1]: IP = 172.16.1.1, Keep-alive type for this connection: DPD
Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1, Starting P1
 rekey timer: 82080 seconds.
Feb 13 04:19:53 [IKEv1 DECODE]: IP = 172.16.1.1, IKE Responder starting QM: msg id =
 4c073b21
Feb 13 04:19:53 [IKEv1]: IP = 172.16.1.1, IKE_DECODE RECEIVED Message
 (msgid=4c073b21) with payloads : HDR + HASH (8) + SA (1) + NONCE (10) + ID (5) +
 ID (5) + NOTIFY (11) + NONE (0) total length : 200
Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1,
 processing hash payload
Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1,
 processing SA payload
Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1,
 processing nonce payload
Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1,
 processing ID payload
Feb 13 04:19:53 [IKEv1 DECODE]: Group = 172.16.1.1, IP = 172.16.1.1,
 ID_IPV4_ADDR_SUBNET ID received--10.2.2.0--255.255.255.0
Feb 13 04:19:53 [IKEv1]: Group = 172.16.1.1, IP = 172.16.1.1, Received remote IP
 Proxy Subnet data in ID Payload:   Address 10.2.2.0, Mask 255.255.255.0,
 Protocol 0, Port 0
Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1,
 processing ID payload
Feb 13 04:19:53 [IKEv1 DECODE]: Group = 172.16.1.1, IP = 172.16.1.1,
 ID_IPV4_ADDR_SUBNET ID received--10.1.1.0--255.255.255.0
Feb 13 04:19:53 [IKEv1]: Group = 172.16.1.1, IP = 172.16.1.1, Received local IP
 Proxy Subnet data in ID Payload:   Address 10.1.1.0, Mask 255.255.255.0,
 Protocol 0, Port 0
Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1, processing
 notify payload
Feb 13 04:19:53 [IKEv1]: Group = 172.16.1.1, IP = 172.16.1.1, QM IsRekeyed old sa
 not found by addr
Feb 13 04:19:53 [IKEv1]: Group = 172.16.1.1, IP = 172.16.1.1, Static Crypto Map
 check, checking map = outside_map, seq = 20...
Feb 13 04:19:53 [IKEv1]: Group = 172.16.1.1, IP = 172.16.1.1, Static Crypto Map
 check, map outside_map, seq = 20 is a successful match
Feb 13 04:19:53 [IKEv1]: Group = 172.16.1.1, IP = 172.16.1.1, IKE Remote Peer
 configured for crypto map: outside_map
Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1, processing
 IPSec SA payload
Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1, IPSec SA
 Proposal # 1, Transform # 1 acceptable  Matches global IPSec SA entry # 20
Feb 13 04:19:53 [IKEv1]: Group = 172.16.1.1, IP = 172.16.1.1, IKE: requesting SPI!
IPSEC: New embryonic SA created @ 0xAB5C63A8,
    SCB: 0xABD54E98,
    Direction: inbound
    SPI      : 0x1BA0C55C
    Session ID: 0x00004000
    VPIF num  : 0x00000001
    Tunnel type: l2l
    Protocol   : esp
    Lifetime   : 240 seconds
Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1, IKE got SPI
 from key engine: SPI = 0x1ba0c55c
Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1, oakley
 constucting quick mode
Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1, constructing
 blank hash payload
Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1, constructing
 IPSec SA payload
Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1, constructing
 IPSec nonce payload
Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1, constructing
 proxy ID
Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1, Transmitting
 Proxy Id:
   Remote subnet: 10.2.2.0  Mask 255.255.255.0 Protocol 0  Port 0
   Local subnet:  10.1.1.0  mask 255.255.255.0 Protocol 0  Port 0
Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1, constructing
 qm hash payload
Feb 13 04:19:53 [IKEv1 DECODE]: Group = 172.16.1.1, IP = 172.16.1.1, IKE Responder
 sending 2nd QM pkt: msg id = 4c073b21
Feb 13 04:19:53 [IKEv1]: IP = 172.16.1.1, IKE_DECODE SENDING Message
 (msgid=4c073b21) with payloads : HDR + HASH (8) + SA (1) + NONCE (10) + ID (5) +
 ID (5) + NONE (0) total length : 172
Feb 13 04:19:53 [IKEv1]: IP = 172.16.1.1, IKE_DECODE RECEIVED Message
 (msgid=4c073b21) with payloads : HDR + HASH (8) + NONE (0) total length : 52
Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1, processing
 hash payload
Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1, loading all
 IPSEC SAs
Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1, Generating
 Quick Mode Key!
Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1, NP encrypt
 rule look up for crypto map outside_map 20 matching ACL 100: returned
 cs_id=ab9302f0; rule=ab9309b0
Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1, Generating
 Quick Mode Key!
IPSEC: New embryonic SA created @ 0xAB570B58,
    SCB: 0xABD55378,
    Direction: outbound
    SPI      : 0x03FC9DB7
    Session ID: 0x00004000
    VPIF num  : 0x00000001
    Tunnel type: l2l
    Protocol   : esp
    Lifetime   : 240 seconds
IPSEC: Completed host OBSA update, SPI 0x03FC9DB7
IPSEC: Creating outbound VPN context, SPI 0x03FC9DB7
    Flags: 0x00000005
    SA   : 0xAB570B58
    SPI  : 0x03FC9DB7
    MTU  : 1500 bytes
    VCID : 0x00000000
    Peer : 0x00000000
    SCB  : 0x01512E71
    Channel: 0xA7A98400
IPSEC: Completed outbound VPN context, SPI 0x03FC9DB7
    VPN handle: 0x0000F99C
IPSEC: New outbound encrypt rule, SPI 0x03FC9DB7
    Src addr: 10.1.1.0
    Src mask: 255.255.255.0
    Dst addr: 10.2.2.0
    Dst mask: 255.255.255.0
    Src ports
      Upper: 0
      Lower: 0
      Op   : ignore
    Dst ports
      Upper: 0
      Lower: 0
      Op   : ignore
    Protocol: 0
    Use protocol: false
    SPI: 0x00000000
    Use SPI: false
IPSEC: Completed outbound encrypt rule, SPI 0x03FC9DB7
    Rule ID: 0xABD557B0
IPSEC: New outbound permit rule, SPI 0x03FC9DB7
    Src addr: 192.168.1.1
    Src mask: 255.255.255.255
    Dst addr: 172.16.1.1
    Dst mask: 255.255.255.255
    Src ports
      Upper: 0
      Lower: 0
      Op   : ignore
    Dst ports
      Upper: 0
      Lower: 0
      Op   : ignore
    Protocol: 50
    Use protocol: true
    SPI: 0x03FC9DB7
    Use SPI: true
IPSEC: Completed outbound permit rule, SPI 0x03FC9DB7
    Rule ID: 0xABD55848
Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1, NP encrypt rule
 look up for crypto map outside_map 20 matching ACL 100: returned cs_id=ab9302f0;
 rule=ab9309b0
Feb 13 04:19:53 [IKEv1]: Group = 172.16.1.1, IP = 172.16.1.1, Security negotiation
 complete for LAN-to-LAN Group (172.16.1.1)  Responder, Inbound SPI = 0x1ba0c55c,
 Outbound SPI = 0x03fc9db7
Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1, IKE got a
 KEY_ADD msg for SA: SPI = 0x03fc9db7
IPSEC: Completed host IBSA update, SPI 0x1BA0C55C
IPSEC: Creating inbound VPN context, SPI 0x1BA0C55C
    Flags: 0x00000006
    SA   : 0xAB5C63A8
    SPI  : 0x1BA0C55C
    MTU  : 0 bytes
    VCID : 0x00000000
    Peer : 0x0000F99C
    SCB  : 0x0150B419
    Channel: 0xA7A98400
IPSEC: Completed inbound VPN context, SPI 0x1BA0C55C
    VPN handle: 0x0001169C
IPSEC: Updating outbound VPN context 0x0000F99C, SPI 0x03FC9DB7
    Flags: 0x00000005
    SA   : 0xAB570B58
    SPI  : 0x03FC9DB7
    MTU  : 1500 bytes
    VCID : 0x00000000
    Peer : 0x0001169C
    SCB  : 0x01512E71
    Channel: 0xA7A98400
IPSEC: Completed outbound VPN context, SPI 0x03FC9DB7
    VPN handle: 0x0000F99C
IPSEC: Completed outbound inner rule, SPI 0x03FC9DB7
    Rule ID: 0xABD557B0
IPSEC: Completed outbound outer SPD rule, SPI 0x03FC9DB7
    Rule ID: 0xABD55848
IPSEC: New inbound tunnel flow rule, SPI 0x1BA0C55C
    Src addr: 10.2.2.0
    Src mask: 255.255.255.0
    Dst addr: 10.1.1.0
    Dst mask: 255.255.255.0
    Src ports
      Upper: 0
      Lower: 0
      Op   : ignore
    Dst ports
      Upper: 0
      Lower: 0
      Op   : ignore
    Protocol: 0
    Use protocol: false
    SPI: 0x00000000
    Use SPI: false
IPSEC: Completed inbound tunnel flow rule, SPI 0x1BA0C55C
    Rule ID: 0xAB8D98A8
IPSEC: New inbound decrypt rule, SPI 0x1BA0C55C
    Src addr: 172.16.1.1
    Src mask: 255.255.255.255
    Dst addr: 192.168.1.1
    Dst mask: 255.255.255.255
    Src ports
      Upper: 0
      Lower: 0
      Op   : ignore
    Dst ports
      Upper: 0
      Lower: 0
      Op   : ignore
    Protocol: 50
    Use protocol: true
    SPI: 0x1BA0C55C
    Use SPI: true
IPSEC: Completed inbound decrypt rule, SPI 0x1BA0C55C
    Rule ID: 0xABD55CB0
IPSEC: New inbound permit rule, SPI 0x1BA0C55C
    Src addr: 172.16.1.1
    Src mask: 255.255.255.255
    Dst addr: 192.168.1.1
    Dst mask: 255.255.255.255
    Src ports
      Upper: 0
      Lower: 0
      Op   : ignore
    Dst ports
      Upper: 0
      Lower: 0
      Op   : ignore
    Protocol: 50
    Use protocol: true
    SPI: 0x1BA0C55C
    Use SPI: true
IPSEC: Completed inbound permit rule, SPI 0x1BA0C55C
    Rule ID: 0xABD55D48
Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1, Pitcher: received
 KEY_UPDATE, spi 0x1ba0c55c
Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1, Starting P2 rekey
 timer: 27360 seconds.
Feb 13 04:19:53 [IKEv1]: Group = 172.16.1.1, IP = 172.16.1.1, PHASE 2 COMPLETED
 (msgid=4c073b21)

摘录自Cisco support;

​​用ASDM或CLI配置IKEv1 IPsec站点到站点隧道在ASA - Cisco​​