Checkpoint SPLAT Manual Proxy ARP Configuration Example

Checkpoint manual NAT configuration is a quite useful method to remedy the weakness of auto nat . For me, I always mix them according to different scenarios although there are quite discussion which is better in a dispute  CPUG post. Use auto nat as possible as I can when starting projects or network, then slowly to roll out manually NAT when complexity components added.

Here is a recent scenario which manual NAT used. Client need to use 10.94.30.53 to access DMZ sftp server 172.17.3.53. Auto NAT should be able to resolve it in 30 seconds configuration. Unfortunately, sftp server 172.17.3.53 is facing multiple checkpoint firewalls and it has to be nat-ed to another segment as well. So manually nat will be the only choice here.

1. Enable Manual NAT from global properties

2. Create Manual NAT rule

3. Add manual proxy arp entry into local.arp file
echo "10.94.30.53 AA:BB:CC:DD:EE" >> $FWDIR/conf/local.arp
note: AA:BB:CC:DD:EE is the mac address of your SPLAT firewall 10.94.30.42 interface. If use clustering implementation, all of cluster members local.arp file need to be modified based on member's interface mac address.

4. Push policy to enable NAT rule and merge this manual NAT record into arp table.

5. Verify with fw ctl arp command

[CP-FW]# fw ctl arp
 (10.94.30.53) at AA:BB:CC:DD:EE

Checkpoint SPLAT Timezone Configuration Difference on WebUI and CMD

When setting up Checkpoint Smart-1 / SPLAT / UTM gateway, there is one thing always confusing admin - how to set up correct timezone with daylight saving. Usually WebUI is the first interface to start setting up checkpoint gateway. Unfortunately, the NTP configuration is not that straightforward.

As the screenshot shows, it only allows admin to set time zone to GMT+-12 format. How about daylight saving configuration? Will you change time zone manually twice per year?

The better solution for this is not to use WebUI for NTP settings at all. There is quick wizard configuration method through CLI which listed below including all steps used in our environment.

1. Enter into Expert mode
2. type ntp command to configure NTP source and update frequency.
ntp -n 60 172.1.3.83
note: 172.1.3.83 is our internal NTP server. Gateway will update time every 60 minutes.
3. Sysconfig

Choose a configuration item ('e' to exit):
------------------------------------------------------------------
1) Host name                    5) Network Connections         9) Export Setup
2) Domain name                  6) Routing                    10) Products Installation
3) Domain name servers          7) DHCP Server Configuration  11) Products Configuration
4) Time and Date                8) DHCP Relay Configuration
------------------------------------------------------------------
(Note: configuration changes are automatically saved)
Your choice: 4


Choose a time and date configuration item ('e' to exit):
------------------------------------------------------------------
1) Set time zone                3) Set local time
2) Set date                     4) Show date and time settings
------------------------------------------------------------------
(Note: configuration changes are automatically saved)
Your choice: 1



Identify a location so that time zone rules can be set correctly.
Select a continent or ocean.
 1) Africa
 2) Americas
 3) Antarctica
 4) Arctic Ocean
 5) Asia
 6) Atlantic Ocean
 7) Australia
 8) Europe
 9) Indian Ocean
10) Pacific Ocean
11) none - I want to specify the time zone using GMT<+|->N format.
12) cancel - I want to quit without changing the time zone.
#? 2



Select a country.
 1) Anguilla                 19) El Salvador              37) Puerto Rico
 2) Antigua & Barbuda        20) French Guiana            38) St Barthelemy
 3) Argentina                21) Greenland                39) St Kitts & Nevis
 4) Aruba                    22) Grenada                  40) St Lucia
 5) Bahamas                  23) Guadeloupe               41) St Martin (French part)
 6) Barbados                 24) Guatemala                42) St Pierre & Miquelon
 7) Belize                   25) Guyana                   43) St Vincent
 8) Bolivia                  26) Haiti                    44) Suriname
 9) Brazil                   27) Honduras                 45) Trinidad & Tobago
10) Canada                   28) Jamaica                  46) Turks & Caicos Is
11) Cayman Islands           29) Martinique               47) United States
12) Chile                    30) Mexico                   48) Uruguay
13) Colombia                 31) Montserrat               49) Venezuela
14) Costa Rica               32) Netherlands Antilles     50) Virgin Islands (UK)
15) Cuba                     33) Nicaragua                51) Virgin Islands (US)
16) Dominica                 34) Panama                   52) cancel
17) Dominican Republic       35) Paraguay
18) Ecuador                  36) Peru
#? 10
Select one of the following time zone regions.
 1) Newfoundland Time, including SE Labrador
 2) Atlantic Time - Nova Scotia (most places), PEI
 3) Atlantic Time - Nova Scotia - places that did not observe DST 1966-1971
 4) Atlantic Time - New Brunswick
 5) Atlantic Time - Labrador - most locations
 6) Atlantic Standard Time - Quebec - Lower North Shore
 7) Eastern Time - Quebec - most locations
 8) Eastern Time - Ontario - most locations
 9) Eastern Time - Ontario & Quebec - places that did not observe DST 1967-1973
10) Eastern Time - Thunder Bay, Ontario
11) Eastern Time - east Nunavut - most locations
12) Eastern Time - Pangnirtung, Nunavut
13) Eastern Standard Time - Resolute, Nunavut
14) Eastern Standard Time - Atikokan, Ontario and Southampton I, Nunavut
15) Central Time - central Nunavut
16) Central Time - Manitoba & west Ontario
17) Central Time - Rainy River & Fort Frances, Ontario
18) Central Standard Time - Saskatchewan - most locations
19) Central Standard Time - Saskatchewan - midwest
20) Mountain Time - Alberta, east British Columbia & west Saskatchewan
21) Mountain Time - west Nunavut
22) Mountain Time - central Northwest Territories
23) Mountain Time - west Northwest Territories
24) Mountain Standard Time - Dawson Creek & Fort Saint John, British Columbia
25) Pacific Time - west British Columbia
26) Pacific Time - south Yukon
27) Pacific Time - north Yukon
28) cancel
#? 8


The following information has been given:

        Canada
        Eastern Time - Ontario - most locations

Therefore TZ='America/Toronto' will be used.
Is the above information OK?
1) Yes
2) No
3) Cancel
#? 1
Updating time zone succeeded.

Time zone is set.


4. verify the configuration

[Expert@CP-1]# cat /etc/sysconfig/ntp
SERVER1=172.1.3.83
SERVER2=
SERVER3=
INTERVAL=60
MD5_SECRET=
USE_NTP=true
[Expert@CP-1]# hwclock --show
Tue Mar 13 22:07:57 2012  -0.147808 seconds
[Expert@CP-1]# date
03-13-2012
[Expert@CP-1]# /bin/date
Tue Mar 13 22:08:14 EDT 2012


[Expert@CP-1]# ntpdate 172.1.3.83
13 Mar 22:55:33 ntpdate[15774]: step time server 172.1.3.83 offset 78.457643 sec

note: ntpdate can be used to update time right away with ntp server.

Update:
There is time configuration difference between WebUI and Command Line, please be aware of this and never touch webui's Date and Time configuration anymore:
From SPLAT box, when you select 4) to show date and time settings, it will show it is EDT (Eastern Daylight Time).

But from webui, it show GMT+0 although time is right. If you change the settings in WebUI, the Command Line configuration will be gone.

----------------------------------------------------------------------------------------------------------
Cisco Switch NTP tip: 
The Catalyst 2950, 2955, 3550 and 3560 switches do not have a hardware-supported clock, and they cannot function as an NTP master clock to which peers synchronize themselves when an external NTP source is not available. These switches also have no hardware support for a calendar. As a result, the ntp update-calendar and the ntp master global configuration commands are not available.

Checkpoint Management Center Snapshot, Backup and Log file location

Our management server Smart-1 is running at standalone mode, not have another HA standby for redundancy. If not having a decent backup for disaster recovery, our situation will be dangerous. Usually I do upgrade_export  from command line and backup checkpoint from WebUI, then ftp both files out in a safe place. Image file at Smart-1 seems not exportable from appliance.

[Expert@CP-Management]# cd /opt/CPsuite-R75.20/fw1/bin/

or cd $FWDIR/bin

[Expert@CP-Management]# cd upgrade_tools/
[Expert@CP-Management]# dir
migrate  migrate.conf  upgrade_export  upgrade_import
[Expert@CP-Management]# ./upgrade_export

'upgrade_export' and 'upgrade_import' have been replaced by the 'migrate' utility.
Run 'migrate' to export and import the Check Point Security Management Server database.
Running 'migrate export' is equivalent to 'upgrade_export'.
Running 'migrate import' is equivalent to 'upgrade_import'.

[Expert@CP-Management]# ./migrate export

Use the migrate utility to export and import Check Point Security Management Server database.

Usage: migrate <ACTION> [OPTIONS] <FILE>

Action (required parameter):

    export - exports database.

    import - imports database.

Options (optional parameters):

    -l - Export/import SmartView Tracker logs.

        Note: only closed logs are exported/imported.

    -n - Run non-interactively

File (required parameter):

    Name of archived file to export/import database to/from. 
Path to archive should exist.

Note: Run the utility either from the current directory or using an absolute path.

[Expert@CP-Management]# ./migrate export CP_SMART_20120308

You are required to close all clients to Security Management Server

or execute 'cpstop' before the Export operation begins.

Do you want to continue? (y/n) [n]? y

Copying required files...

Compressing files...

The operation completed successfully.

Location of archive with exported database: /opt/CPsuite-R75.20/fw1/bin/upgrade_tools/CP_SMART_20120308.tgz

Note: After ftp it out, remember to use md5sum to verify md5 value. 

----------------------------------------------------------------------

[Expert@CP-Management]# cd $FWDIR/log

[Expert@CP-Management]# ls

2011-04-28_171131.log             2011-10-05_235900.loginitial_ptr  2011-10-16_000000.log             2012-01-01_010000.loginitial_ptr  fw.loginitial_ptr   john-ips.tar.gz

2011-04-28_171131.logaccount_ptr  2011-10-05_235900.logptr          2011-10-16_000000.logaccount_ptr  2012-01-01_010000.logptr          fw.logptr           ldap_pid_14310.stats

2011-04-28_171131.loginitial_ptr  2011-10-06_235900.log             2011-10-16_000000.loginitial_ptr  2012-02-01_010000.log             fw.logtrack         ldap_pid_15171.stats

2011-04-28_171131.logptr          2011-10-06_235900.logaccount_ptr  2011-10-16_000000.logptr          2012-02-01_010000.logaccount_ptr  fw.vlog             ldap_pid_23124.stats

2011-07-05_102750.log             2011-10-06_235900.loginitial_ptr  2011-10-21_162716.log             2012-02-01_010000.loginitial_ptr  fw.vlogaccount_ptr  ldap_pid_2410.stats

2011-07-05_102750.logaccount_ptr  2011-10-06_235900.logptr          2011-10-21_162716.logaccount_ptr  2012-02-01_010000.logptr          fw.vloginitial_ptr  ldap_pid_2416.stats

2011-07-05_102750.loginitial_ptr  2011-10-07_235900.log             2011-10-21_162716.loginitial_ptr  2012-03-01_010000.log             fw.vlogptr          ldap_pid_2577.stats

2011-07-05_102750.logptr          2011-10-07_235900.logaccount_ptr  2011-10-21_162716.logptr          2012-03-01_010000.logaccount_ptr  fwd.elg             ldap_pid_2584.stats

2011-10-02_103702.log             2011-10-07_235900.loginitial_ptr  2011-10-23_000000.log             2012-03-01_010000.loginitial_ptr  fwd.elg.0           ldap_pid_2585.stats

2011-10-02_103702.logaccount_ptr  2011-10-07_235900.logptr          2011-10-23_000000.logaccount_ptr  2012-03-01_010000.logptr          fwd.elg.1           ldap_pid_2594.stats

2011-10-02_103702.loginitial_ptr  2011-10-08_235900.log             2011-10-23_000000.loginitial_ptr  BVUuidDB                          fwd.elg.2           ldap_pid_2599.stats

2011-10-02_103702.logptr          2011-10-08_235900.logaccount_ptr  2011-10-23_000000.logptr          actlog.time                       fwd.elg.3           ldap_pid_2621.stats

2011-10-02_235900.log             2011-10-08_235900.loginitial_ptr  2011-10-30_000000.log             connectra_rulenums.html           fwd.elg.4           ldap_pid_2622.stats

2011-10-02_235900.logaccount_ptr  2011-10-08_235900.logptr          2011-10-30_000000.logaccount_ptr  cpca.elg                          fwd.elg.5           ldap_pid_2662.stats

2011-10-02_235900.loginitial_ptr  2011-10-09_235900.log             2011-10-30_000000.loginitial_ptr  cplmd.elg                         fwm.elg             ldap_pid_2744.stats

2011-10-02_235900.logptr          2011-10-09_235900.logaccount_ptr  2011-10-30_000000.logptr          cpmad.err                         fwm.elg.0           ldap_pid_2760.stats

2011-10-03_235900.log             2011-10-09_235900.loginitial_ptr  2011-11-03_160050.log             cpstat_monitor.elg                fwm.elg.1           ldap_pid_2851.stats

2011-10-03_235900.logaccount_ptr  2011-10-09_235900.logptr          2011-11-03_160050.logaccount_ptr  dbver.elg                         fwm.elg.2           ldap_pid_30029.stats

2011-10-03_235900.loginitial_ptr  2011-10-10_235900.log             2011-11-03_160050.loginitial_ptr  dlp_blob_cache.db                 fwm.elg.3           ldap_pid_8465.stats

2011-10-03_235900.logptr          2011-10-10_235900.logaccount_ptr  2011-11-03_160050.logptr          fw.adtlog                         fwm.elg.4           ldap_pid_9655.stats

2011-10-04_235900.log             2011-10-10_235900.loginitial_ptr  2011-12-01_010000.log             fw.adtlogaccount_ptr              fwm.elg.5           log

2011-10-04_235900.logaccount_ptr  2011-10-10_235900.logptr          2011-12-01_010000.logaccount_ptr  fw.adtloginitial_ptr              fwm.elg.6           status_proxy.elg

2011-10-04_235900.loginitial_ptr  2011-10-11_235900.log             2011-12-01_010000.loginitial_ptr  fw.adtlogptr                      fwm.elg.7           upgrade_log.elg

2011-10-04_235900.logptr          2011-10-11_235900.logaccount_ptr  2011-12-01_010000.logptr          fw.log                            fwm.elg.8

2011-10-05_235900.log             2011-10-11_235900.loginitial_ptr  2012-01-01_010000.log             fw.logLuuidDB                     fwui.log

2011-10-05_235900.logaccount_ptr  2011-10-11_235900.logptr          2012-01-01_010000.logaccount_ptr  fw.logaccount_ptr                 ipscntr.elg

--------------------------------------

Faq: Where is WebUI backup/restore file location?

use find command to find it out:

find / -name \*.tgz -mtime -1 -ls 

 /var/log/CPbackup/backups/NGX_R65_/xyz.tgz

---------------------------------------

Faq: Where is WebUI image file location?  - no location

When an image is created blocks are written to the unpartitioned space, there is no actual file.

note (added on July 20 2012) for re-sizing WebUI Image partition:
Found a good explanation regarding how to resize partition on R75 from Michael Thompson in Linedin Post

"Kernel version 2.6 supports online partition resizing, R75 is at version 2.6, to verify issue the command
uname -r 
Depending on your appliance model, it should be outfitted with a 160GB HDD upwards which is should have physical volumes and logical volumes, issue the commands
pvs - to view physical hdd config, take note of vg_splat volume group (VG) and free space available as this would indicate how much your vg_splat/lv_current volume can be resized to
vgs - to view volume groups config, take note of number of logical volumes (LV)
lvs - to view logical volumes
df -h - to view mounted volumes, size, used and free space
Now for resizing
lvresize -L XXGB vg_splat/lv_current 
output should say
Extending logical volume lv_current to XX.00 GB
Logical volume lv_current successfully resized
then issue
resize2fs /dev/mapper/vg_splat-lv_current 
finally issue vgscan and df -h to verify successful resizing

As a side note, R65 requires offline resizing with a slightly more complicated procedure but can also be done."

Enable Checkpoint SmartWorkflow on Management Server

Just enabled SmartWorkflow and have some steps recorded here to share

Enable SmartWorkflow steps:

1. Create two Permission Profiles for normal administrators and managers. Only difference is Manager profile has manage administrators permission.

2. Create two users , Admin1 and manager. Admin1 is used to perform daily routing work and it is associated with permission profile Admin. manager is in Manager group and will be used to do approval and of course changes.

3. Check License from SmartWorkflow menu:

4. Enable SmartWorkflow from SmartWorkflow dropdown menu:

5. After saved configiration and SmartDashboard restarted, SmartWorkflow Session Management window pops up.

Create a new session, system will automatically build a new database baseline revision for your new session.Depending your revision database size and your management server's power, the revision creating time will take a couple of seconds to one minute.
6. Menu for SmartWorkflow:

7. First change and submit for approval:
Make some changes, and those changes will automatically be highlighted with a vivid green color.

At Submit Session for Approval window, click Submit button. You can add some notes to explain your changes which your approval group may like to see.

Comparing the databases window will show up after submitted your changes. It will run a couple of minutes on my case. Not sure if it is because my smart-1 appliance resource not enough or my revision database is more than 300m.
8.  Surprised Session Management window coming up:
I was surprised when this window comes up with approval option. I though SmartWorkflow has segregated the role with task performer and approvals. It seems normal admin user can approval themselves.

9. Change SmartWorkflow settings on Global Properties:

This time looks better. Normal admin could not have option to approve themselves now.

10. Log in SmartDashboard again with manager account. You will see there is a session waiting approve, clieck approve button. Then it will show approved. Save Changes. Then you can either open a new session or go ahead without session to push policy, either exit SmartDashboard.

11. Remember, there is always only one in process session exist. If you quit your session without send an approval request. Once somebody else logged in, either he continue your session or he open a new session for himself.

Refer Documentation:
http://supportcontent.checkpoint.com/documentation_download?ID=12283

Cisco IOU IPsec Site to Site VPN with External Third Party CA (XCA) - Part 3

This is lab part 3 to verify three different  ipsec vpn authentication methods: Pre-share key, RSA key and CA. First two parts has been listed in previous posts. Here is last part - external CA.

Cisco IOU IPsec Site to Site VPN with Pre-shared key, RSA Key, or CA Part 1

Cisco IOU IPsec Site to Site VPN with Pre-shared key, RSA Key, or CA Part 2

This time, I will use CA signed certificates to build IPSec site to site vpn between two Cisco Routers. Topology is same as before and IOS info is in the following:



--------------------------------------------

R2# sh ver
Cisco IOS Software, 2600 Software (C2691-ADVSECURITYK9-M), Version 12.4(11)T2, RELEASE SOFTWARE (fc4)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2007 by Cisco Systems, Inc.
Compiled Mon 30-Apr-07 16:48 by prod_rel_team

ROM: ROMMON Emulation Microcode
ROM: 2600 Software (C2691-ADVSECURITYK9-M), Version 12.4(11)T2, RELEASE SOFTWARE (fc4)

R2 uptime is 9 minutes
System returned to ROM by unknown reload cause - suspect boot_data[BOOT_COUNT] 0x0, BOOT_COUNT 0, BOOTDATA 19
System restarted at 22:40:33 UTC Tue Feb 28 2012
System image file is "tftp://255.255.255.255/unknown"


This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.

A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

If you require further assistance please contact us by sending email to
export@cisco.com.

Cisco 2691 (R7000) processor (revision 0.1) with 124928K/6144K bytes of memory.
Processor board ID XXXXXXXXXXX
R7000 CPU at 160MHz, Implementation 39, Rev 2.1, 256KB L2, 512KB L3 Cache
18 FastEthernet interfaces
6 Serial(sync/async) interfaces
DRAM configuration is 64 bits wide with parity enabled.
55K bytes of NVRAM.
16384K bytes of ATA System CompactFlash (Read/Write)

Configuration register is 0x2102

--------------------------------------------

XCA will be used to generate Private key and Certifications for CA, R1 and R2.

Step1 : Using XCA to create a new CA

a. After installed XCA, create a new database with password.
b. Click New Certificate:

 c. Change subject and generate a new private key

 d. Click ok to generate new CA as shown in following screenshot.

Step2: Create CSR for both Routers:

Step3: Sign CSR to get Certifications:

Step4: Export Certifications with PKCS #12 format. You will get R1.p12 and R2.p12 files:

Step5: Import Certification to each of router

R1(config)#crypto pki trustpoint CA-VPN
R1(ca-trustpoint)#revocation-check none

R1(config)#crypto ca import CA-VPN pkcs12 tftp: Cisco

% Importing pkcs12…
Address or name of remote host []? 1.1.1.1
Source filename [trustpoint]? R1.p12
Reading file from tftp://1.1.1.1/R1.p12
Loading R1.p12 from 1.1.1.1 (via FastEthernet0/0): !
[OK - 1245 bytes]

CRYPTO_PKI: Imported PKCS12 file successful

Step6: Verify and Test:

show crypto pki trustpoints
show crypto pki certificates


R2#ping 1.1.1.1 source 2.2.2.2

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
Packet sent with a source address of 2.2.2.2
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/16/44 ms
R2#show crypto ipsec sa

interface: Serial0/0
    Crypto map tag: P1-P2-Map, local addr 12.1.1.2

   protected vrf: (none)
   local  ident (addr/mask/prot/port): (2.2.2.0/255.255.255.0/0/0)
   remote ident (addr/mask/prot/port): (1.1.1.0/255.255.255.0/0/0)
   current_peer 12.1.1.1 port 500
     PERMIT, flags={origin_is_acl,}
    #pkts encaps: 9, #pkts encrypt: 9, #pkts digest: 9
    #pkts decaps: 9, #pkts decrypt: 9, #pkts verify: 9
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0
    #pkts not decompressed: 0, #pkts decompress failed: 0
    #send errors 1, #recv errors 0

     local crypto endpt.: 12.1.1.2, remote crypto endpt.: 12.1.1.1
     path mtu 1500, ip mtu 1500, ip mtu idb Serial0/0
     current outbound spi: 0xCDFDE82C(3455969324)

     inbound esp sas:
      spi: 0xD5799FF1(3581517809)
        transform: esp-des esp-sha-hmac ,
        in use settings ={Tunnel, }
        conn id: 3, flow_id: 3, crypto map: P1-P2-Map
        sa timing: remaining key lifetime (k/sec): (4603613/2710)
        IV size: 8 bytes
        replay detection support: Y
        Status: ACTIVE

     inbound ah sas:

     inbound pcp sas:

     outbound esp sas:
      spi: 0xCDFDE82C(3455969324)
        transform: esp-des esp-sha-hmac ,
        in use settings ={Tunnel, }
        conn id: 4, flow_id: 4, crypto map: P1-P2-Map
        sa timing: remaining key lifetime (k/sec): (4603613/2709)
        IV size: 8 bytes
        replay detection support: Y
        Status: ACTIVE

     outbound ah sas:

     outbound pcp sas:
R2#

R2#ping 1.1.1.1 source 2.2.2.2

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
Packet sent with a source address of 2.2.2.2

Feb 28 23:03:53.243: ISAKMP:(0): SA request profile is (NULL)
Feb 28 23:03:53.247: ISAKMP: Created a peer struct for 12.1.1.1, peer port 500
Feb 28 23:03:53.247: ISAKMP: New peer created peer = 0x64937F58 peer_handle = 0x80000004
Feb 28 23:03:53.251: ISAKMP: Locking peer struct 0x64937F58, refcount 1 for isakmp_initiator
Feb 28 23:03:53.251: ISAKMP: local port 500, remote port 500
Feb 28 23:03:53.255: ISAKMP: set new node 0 to QM_IDLE
Feb 28 23:03:53.255: ISAKMP: Find a dup sa in the avl tree during calling isadb_insert sa = 6418E444
Feb 28 23:03:53.259: ISAKMP:(0):Can not start Aggressive mode, trying Main mode.
Feb 28 23:03:53.263: ISAKMP:(0):No pre-shared key with 12.1.1.1!
Feb 28 23:03:53.267: ISAKMP:(0): constructed NAT-T vendor-07 ID
Feb 28 23:03:53.271: ISAKMP:(0): constructed NAT-T vendor-03 ID
Feb 28 23:03:53.271: ISAKMP:(0): constructed NAT-T vendor-02 ID
Feb 28 23:03:53.275: ISAKMP:(0):Input = IKE_MESG_FROM_IPSEC, IKE_SA_REQ_MM
Feb 28 23:03:53.275: ISAKMP:(0):Old State = IKE_READY  New State = IKE_I_MM1

Feb 28 23:03:53.279: ISAKMP:(0): beginning Main Mode exchange
Feb 28 23:03:53.283: ISAKMP:(0): sending packet to 12.1.1.1 my_port 500 peer_port 500 (I) MM_NO_STATE
Feb 28 23:03:53.283: ISAKMP:(0):Sending an IKE IPv4 Packet.
Feb 28 23:03:53.367: ISAKMP (0:0): received packet from 12.1.1.1 dport 500 sport 500 Global (I) MM_NO_STATE
Feb 28 23:03:53.375: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
Feb 28 23:03:53.375: ISAKMP:(0):Old State = IKE_I_MM1  New State = IKE_I_MM2

Feb 28 23:03:53.387: ISAKMP:(0): processing SA payload. message ID = 0
Feb 28 23:03:53.391: ISAKMP:(0): proce.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 12/56/140 ms
R2#ssing vendor id payload
Feb 28 23:03:53.391: ISAKMP:(0): vendor ID seems Unity/DPD but major 245 mismatch
Feb 28 23:03:53.395: ISAKMP (0:0): vendor ID is NAT-T v7
Feb 28 23:03:53.395: ISAKMP : Scanning profiles for xauth ...
Feb 28 23:03:53.399: ISAKMP:(0):Checking ISAKMP transform 1 against priority 10 policy
Feb 28 23:03:53.399: ISAKMP:      encryption DES-CBC
Feb 28 23:03:53.399: ISAKMP:      hash SHA
Feb 28 23:03:53.403: ISAKMP:      default group 1
Feb 28 23:03:53.403: ISAKMP:      auth RSA sig
Feb 28 23:03:53.403: ISAKMP:      life type in seconds
Feb 28 23:03:53.403: ISAKMP:      life duration (VPI) of  0x0 0x1 0x51 0x80
Feb 28 23:03:53.403: ISAKMP:(0):atts are acceptable. Next payload is 0
Feb 28 23:03:53.403: ISAKMP:(0): processing vendor id payload
Feb 28 23:03:53.403: ISAKMP:(0): vendor ID seems Unity/DPD but major 245 mismatch
Feb 28 23:03:53.407: ISAKMP (0:0): vendor ID is NAT-T v7
Feb 28 23:03:53.407: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
Feb 28 23:03:53.407: ISAKMP:(0):Old State = IKE_I_MM2  New State = IKE_I_MM2

Feb 28 23:03:53.411: ISAKMP (0:0): constructing CERT_REQ for issuer ea=admin@test.com,cn=IOUCA.test.com,ou=IT,o=GD,st=ON,c=CA
Feb 28 23:03:53.411: ISAKMP:(0): sending packet to 12.1.1.1 my_port 500 peer_port 500 (I) MM_SA_SETUP
Feb 28 23:03:53.411: ISAKMP:(0):Sending an IKE IPv4 Packet.
Feb 28 23:03:53.411: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
Feb 28 23:03:53.415: ISAKMP:(0):Old State = IKE_I_MM2  New State = IKE_I_MM3

Feb 28 23:03:53.507: ISAKMP (0:0): received packet from 12.1.1.1 dport 500 sport 500 Global (I) MM_SA_SETUP
Feb 28 23:03:53.515: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
Feb 28 23:03:53.515: ISAKMP:(0):Old State = IKE_I_MM3  New State = IKE_I_MM4

Feb 28 23:03:53.527: ISAKMP:(0): processing KE payload. message ID = 0
Feb 28 23:03:53.547: ISAKMP:(0): processing NONCE payload. message ID = 0
Feb 28 23:03:53.547: ISAKMP:(1003): processing CERT_REQ payload. message ID = 0
Feb 28 23:03:53.551: ISAKMP:(1003): peer wants a CT_X509_SIGNATURE cert
Feb 28 23:03:53.555: ISAKMP:(1003): peer wants cert issued by ea=admin@test.com,cn=IOUCA.test.com,ou=IT,o=GD,st=ON,c=CA
Feb 28 23:03:53.555:  Choosing trustpoint CA-VPN as issuer
Feb 28 23:03:53.555: ISAKMP:(1003): processing vendor id payload
Feb 28 23:03:53.555: ISAKMP:(1003): vendor ID is Unity
Feb 28 23:03:53.555: ISAKMP:(1003): processing vendor id payload
Feb 28 23:03:53.555: ISAKMP:(1003): vendor ID is DPD
Feb 28 23:03:53.555: ISAKMP:(1003): processing vendor id payload
Feb 28 23:03:53.555: ISAKMP:(1003): speaking to another IOS box!
Feb 28 23:03:53.555: ISAKMP:(1003):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
Feb 28 23:03:53.559: ISAKMP:(1003):Old State = IKE_I_MM4  New State = IKE_I_MM4

Feb 28 23:03:53.567: ISAKMP:(1003):Send initial contact
Feb 28 23:03:53.583: ISAKMP:(1003):My ID configured as IPv4 Addr, but Addr not in Cert!
Feb 28 23:03:53.583: ISAKMP:(1003):Using FQDN as My ID
Feb 28 23:03:53.583: ISAKMP:(1003):SA is doing RSA signature authentication using id type ID_FQDN
Feb 28 23:03:53.583: ISAKMP (0:1003): ID payload
        next-payload : 6
        type         : 2
        FQDN name    : R2.gd.com
        protocol     : 17
        port         : 500
        length       : 17
Feb 28 23:03:53.583: ISAKMP:(1003):Total payload length: 17
Feb 28 23:03:53.587: ISAKMP (0:1003): constructing CERT payload for ea=R2@gd.com,cn=R2.gd.com,ou=GD,o=IT,st=ON,c=CA
Feb 28 23:03:53.591: ISAKMP:(1003): using the EXAMPLE-VPN trustpoint's keypair to sign
Feb 28 23:03:53.643: ISAKMP:(1003): sending packet to 12.1.1.1 my_port 500 peer_port 500 (I) MM_KEY_EXCH
Feb 28 23:03:53.643: ISAKMP:(1003):Sending an IKE IPv4 Packet.
Feb 28 23:03:53.647: ISAKMP:(1003):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
Feb 28 23:03:53.647: ISAKMP:(1003):Old State = IKE_I_MM4  New State = IKE_I_MM5

Feb 28 23:03:53.811: ISAKMP (0:1003): received packet from 12.1.1.1 dport 500 sport 500 Global (I) MM_KEY_EXCH
Feb 28 23:03:53.819: ISAKMP:(1003): processing ID payload. message ID = 0
Feb 28 23:03:53.819: ISAKMP (0:1003): ID payload
        next-payload : 6
        type         : 2
        FQDN name    : R1.gd.com
        protocol     : 17
        port         : 500
        length       : 17
Feb 28 23:03:53.827: ISAKMP:(0):: peer matches *none* of the profiles
Feb 28 23:03:53.827: ISAKMP:(1003): processing CERT payload. message ID = 0
Feb 28 23:03:53.831: ISAKMP:(1003): processing a CT_X509_SIGNATURE cert
Feb 28 23:03:53.863: ISAKMP:(1003): peer's pubkey isn't cached
Feb 28 23:03:53.887: ISAKMP:(1003): OU = IT
Feb 28 23:03:53.887: ISAKMP:(0):: peer matches *none* of the profiles
Feb 28 23:03:53.891: ISAKMP:(1003): processing SIG payload. message ID = 0
Feb 28 23:03:53.895: ISAKMP:(1003):SA authentication status:
        authenticated
Feb 28 23:03:53.895: ISAKMP:(1003):SA has been authenticated with 12.1.1.1
Feb 28 23:03:53.899: ISAKMP: Trying to insert a peer 12.1.1.2/12.1.1.1/500/,  and inserted successfully 64937F58.
Feb 28 23:03:53.903: ISAKMP:(1003):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
Feb 28 23:03:53.903: ISAKMP:(1003):Old State = IKE_I_MM5  New State = IKE_I_MM6

Feb 28 23:03:53.911: ISAKMP:(1003):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
Feb 28 23:03:53.911: ISAKMP:(1003):Old State = IKE_I_MM6  New State = IKE_I_MM6

Feb 28 23:03:53.915: ISAKMP:(1003):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
Feb 28 23:03:53.915: ISAKMP:(1003):Old State = IKE_I_MM6  New State = IKE_P1_COMPLETE

Feb 28 23:03:53.919: ISAKMP:(1003):beginning Quick Mode exchange, M-ID of -1497599522
Feb 28 23:03:53.923: ISAKMP:(1003):QM Initiator gets spi
Feb 28 23:03:53.927: ISAKMP:(1003): sending packet to 12.1.1.1 my_port 500 peer_port 500 (I) QM_IDLE
Feb 28 23:03:53.927: ISAKMP:(1003):Sending an IKE IPv4 Packet.
Feb 28 23:03:53.931: ISAKMP:(1003):Node -1497599522, Input = IKE_MESG_INTERNAL, IKE_INIT_QM
Feb 28 23:03:53.931: ISAKMP:(1003):Old State = IKE_QM_READY  New State = IKE_QM_I_QM1
Feb 28 23:03:53.935: ISAKMP:(1003):Input = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE
Feb 28 23:03:53.939: ISAKMP:(1003):Old State = IKE_P1_COMPLETE  New State = IKE_P1_COMPLETE

Feb 28 23:03:53.983: ISAKMP (0:1003): received packet from 12.1.1.1 dport 500 sport 500 Global (I) QM_IDLE
Feb 28 23:03:53.995: ISAKMP:(1003): processing HASH payload. message ID = -1497599522
Feb 28 23:03:53.995: ISAKMP:(1003): processing SA payload. message ID = -1497599522
Feb 28 23:03:53.999: ISAKMP:(1003):Checking IPSec proposal 1
Feb 28 23:03:53.999: ISAKMP: transform 1, ESP_DES
Feb 28 23:03:53.999: ISAKMP:   attributes in transform:
Feb 28 23:03:54.003: ISAKMP:      encaps is 1 (Tunnel)
Feb 28 23:03:54.003: ISAKMP:      SA life type in seconds
Feb 28 23:03:54.003: ISAKMP:      SA life duration (basic) of 3600
Feb 28 23:03:54.007: ISAKMP:      SA life type in kilobytes
Feb 28 23:03:54.007: ISAKMP:      SA life duration (VPI) of  0x0 0x46 0x50 0x0
Feb 28 23:03:54.011: ISAKMP:      authenticator is HMAC-SHA
Feb 28 23:03:54.015: ISAKMP:(1003):atts are acceptable.
Feb 28 23:03:54.019: ISAKMP:(1003): processing NONCE payload. message ID = -1497599522
Feb 28 23:03:54.023: ISAKMP:(1003): processing ID payload. message ID = -1497599522
Feb 28 23:03:54.023: ISAKMP:(1003): processing ID payload. message ID = -1497599522
Feb 28 23:03:54.039: ISAKMP:(1003): Creating IPSec SAs
Feb 28 23:03:54.039:         inbound SA from 12.1.1.1 to 12.1.1.2 (f/i)  0/ 0
        (proxy 1.1.1.0 to 2.2.2.0)
Feb 28 23:03:54.039:         has spi 0x2F50201E and conn_id 0
Feb 28 23:03:54.039:         lifetime of 3600 seconds
Feb 28 23:03:54.039:         lifetime of 4608000 kilobytes
Feb 28 23:03:54.039:         outbound SA from 12.1.1.2 to 12.1.1.1 (f/i) 0/0
        (proxy 2.2.2.0 to 1.1.1.0)
Feb 28 23:03:54.039:         has spi  0x9FC207B5 and conn_id 0
Feb 28 23:03:54.039:         lifetime of 3600 seconds
Feb 28 23:03:54.039:         lifetime of 4608000 kilobytes
Feb 28 23:03:54.043: ISAKMP:(1003): sending packet to 12.1.1.1 my_port 500 peer_port 500 (I) QM_IDLE
Feb 28 23:03:54.043: ISAKMP:(1003):Sending an IKE IPv4 Packet.
Feb 28 23:03:54.047: ISAKMP:(1003):deleting node -1497599522 error FALSE reason "No Error"
Feb 28 23:03:54.051: ISAKMP:(1003):Node -1497599522, Input = IKE_MESG_FROM_PEER, IKE_QM_EXCH
Feb 28 23:03:54.055: ISAKMP:(1003):Old State = IKE_QM_I_QM1  New State = IKE_QM_PHASE2_COMPLETE

R1#sh run
Building configuration...

Current configuration : 5322 bytes
!
! Last configuration change at 22:41:38 UTC Tue Feb 28 2012
! NVRAM config last updated at 22:41:39 UTC Tue Feb 28 2012
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R1
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
memory-size iomem 5
ip cef
!
!
!
!
ip domain name gd.com
!
multilink bundle-name authenticated
!
!
crypto pki trustpoint CA-VPN
 revocation-check none
 rsakeypair CA-VPN
!
!
crypto pki certificate chain CA-VPN
 certificate 02
  30820242 308201AB A0030201 02020102 300D0609 2A864886 F70D0101 05050030
  6C310B30 09060355 04061302 4341310B 30090603 55040813 024F4E31 0B300906
  0355040A 13024744 310B3009 06035504 0B130249 54311730 15060355 0403130E
  494F5543 412E7465 73742E63 6F6D311D 301B0609 2A864886 F70D0109 01160E61
  646D696E 40746573 742E636F 6D301E17 0D313230 32323631 32303530 305A170D
  31333032 32363132 30353030 5A306231 0B300906 03550406 13024341 310B3009
  06035504 0813024F 4E310B30 09060355 040A1302 4744310B 30090603 55040B13
  02495431 12301006 03550403 13095231 2E67642E 636F6D31 18301606 092A8648
  86F70D01 09011609 52314067 642E636F 6D30819F 300D0609 2A864886 F70D0101
  01050003 818D0030 81890281 8100CA0A 54AE595E 801B2C6A A17BD53E EB2DCFE2
  6024860B 5129AEDA D47D275E F734EA92 2F10CBC2 F85CCBD0 306AA185 EA754449
  6DF36140 FCC22B15 75F8D037 F937381F 8FA7A21E 58659BD4 CCC1EEA5 5DB1F974
  3B6A7AD5 A7EF3210 3F89ED90 83E5B664 415B2BD9 F897C6C3 5006F5EF AD66476B
  D6612696 70488749 3EF15737 8AF30203 01000130 0D06092A 864886F7 0D010105
  05000381 8100A469 1FCF0C5B 270CFD73 20FBA365 7BF161DD D067D56C AEB9AA75
  A8726E7B D0D98A71 686723A7 3A11FAD5 A270A6D8 ECDABBFE 3508FD2D 98D9363D
  A4C825FE A0316093 25F0B74E FB338E88 A76F9FB8 DCE2AD64 8D36D8BA 6D38A247
  9B41D785 6D6C4568 696B740A EC3564C4 13E6E010 C745D1C2 9BA2C3C7 32DF393B
  0CC89CDB DDB1
  quit
 certificate ca 01
  3082028D 308201F6 A0030201 02020101 300D0609 2A864886 F70D0101 05050030
  6C310B30 09060355 04061302 4341310B 30090603 55040813 024F4E31 0B300906
  0355040A 13024744 310B3009 06035504 0B130249 54311730 15060355 0403130E
  494F5543 412E7465 73742E63 6F6D311D 301B0609 2A864886 F70D0109 01160E61
  646D696E 40746573 742E636F 6D301E17 0D313230 32323631 31343230 305A170D
  32323032 32363131 34323030 5A306C31 0B300906 03550406 13024341 310B3009
  06035504 0813024F 4E310B30 09060355 040A1302 4744310B 30090603 55040B13
  02495431 17301506 03550403 130E494F 5543412E 74657374 2E636F6D 311D301B
  06092A86 4886F70D 01090116 0E61646D 696E4074 6573742E 636F6D30 819F300D
  06092A86 4886F70D 01010105 0003818D 00308189 02818100 D9212BBE A32192CA
  8D70EB0E AEDFA75C EA8C9246 2DE029C2 F49437CD 68A642B3 BFE6C8D0 5690A00B
  A1754E59 0D325D14 5559C2B6 1F9E4B25 84833FF8 E6655095 5F1145AF 950F4268
  025A1BED 963A62AA 8E3097B0 617683AB 1B9F2BC4 795E9FDA 2D75A45B E8189352
  EB6830C2 9DC5ECF6 36FD17E0 229CCF87 57042DE7 1EF0AE67 02030100 01A33F30
  3D300F06 03551D13 0101FF04 05300301 01FF301D 0603551D 0E041604 14E1EDA6
  1FF8FD33 EAB1F0CE 68A3003C 0A33EB05 D3300B06 03551D0F 04040302 0106300D
  06092A86 4886F70D 01010505 00038181 00878CFA 9EE53C82 9870147C 7CCC2495
  071E6F25 56A5D0BA 94FA3BCE D429E02C 443B1830 762AE21A AAA9A809 CA1F534E
  7396AC3B 98983729 08974DB3 849173CC 640F4E48 8A664153 D42987FD CD46874B
  90090B32 36086E9D F39FF6B8 5EB0030D CDD4BEEA 4249C6EB ED09061F 881C7C23
  07CEE9A3 331091C6 7C8F4616 959844E4 85
  quit
!
!
!
!
!
crypto isakmp policy 10
!
!
crypto ipsec transform-set P2-Transform esp-des esp-sha-hmac
!
crypto map P2-Transform 10 ipsec-isakmp
 set peer 12.1.1.2
 set transform-set P2-Transform
 match address acl_vpn
!
interface Loopback0
 ip address 1.1.1.1 255.255.255.0
!
interface Serial0/0
 ip address 12.1.1.1 255.255.255.0
 no fair-queue
 clock rate 2000000
 crypto map P2-Transform
!
interface FastEthernet1/0
 no switchport
 ip address 10.50.2.100 255.255.255.0
!
interface FastEthernet1/1
!

interface Vlan1
 no ip address
!
ip route 0.0.0.0 0.0.0.0 10.50.2.1
ip route 2.2.2.0 255.255.255.0 12.1.1.2
!
!
ip http server
no ip http secure-server
!
ip access-list extended acl_vpn
 permit ip 1.1.1.0 0.0.0.255 2.2.2.0 0.0.0.255

!
control-plane
!
!
!
line con 0
line aux 0
line vty 0 4
!
ntp master
!
end

R1#