53726


ネットワーク初心者です。  
現在構成図のような「Cisco WAN
実践ケーススタディ（インプレスジャパン）」に記載されている設定内容と同じ設定をGNS3というシュミレーションソフトでIPSec
VPNを設定しているのですが、PC1からPC2へpingが通りません。  
大変お手数ですが、原因と解決策をご教示いただけないでしょうか。  
設定内容についても記載します。  
よろしくお願い致します。  
※access-listについては自分で追加しました。

[![構成図](https://i.stack.imgur.com/KS1uX.png)](https://i.stack.imgur.com/KS1uX.png)  
・WAN1

[code]

    WAN1#show run line
    Building configuration...
    
    Current configuration : 2252 bytes
         1 : !
         2 : version 12.4
         3 : service timestamps debug datetime msec
         4 : service timestamps log datetime msec
         5 : no service password-encryption
         6 : !
         7 : hostname WAN1
         8 : !
         9 : boot-start-marker
        10 : boot-end-marker
        11 : !
        12 : !
        13 : no aaa new-model
        14 : memory-size iomem 5
        15 : no ip icmp rate-limit unreachable
        16 : ip cef
        17 : !
        18 : !
        19 : !
        20 : !
        21 : no ip domain lookup
        22 : !
        23 : multilink bundle-name authenticated
        24 : !
        25 : !
        26 : !
        27 : !
        28 : !
        29 : !
        30 : !
        31 : !
        32 : !
        33 : !
        34 : !
        35 : !
        36 : !
        37 : !
        38 : !
        39 : !
        40 : !
        41 : !
        42 : !
        43 : !
        44 : !
        45 : archive
        46 :  log config
        47 :   hidekeys
        48 : !
        49 : !
        50 : crypto isakmp policy 1
        51 :  encr 3des
        52 :  hash md5
        53 :  authentication pre-share
        54 : crypto isakmp key cisco address 64.100.2.1
        55 : crypto isakmp keepalive 30 periodic
        56 : !
        57 : !
        58 : crypto ipsec transform-set IPSEC esp-3des esp-md5-hmac
        59 : !
        60 : crypto map IPSECL2L 1 ipsec-isakmp
        61 :  set peer 64.100.2.1
        62 :  set transform-set IPSEC
        63 :  match address 100
        64 : !
        65 : !
        66 : !
        67 : ip tcp synwait-time 5
        68 : !
        69 : !
        70 : !
        71 : !
        72 : interface Loopback0
        73 :  ip address 64.100.1.1 255.255.255.0
        74 : !
        75 : interface FastEthernet0/0
        76 :  no ip address
        77 :  ip access-group 101 in
        78 :  ip access-group 101 out
        79 :  duplex auto
        80 :  speed auto
        81 :  pppoe enable group global
        82 :  pppoe-client dial-pool-number 1
        83 : !
        84 : interface Serial0/0
        85 :  no ip address
        86 :  shutdown
        87 :  clock rate 2000000
        88 : !
        89 : interface FastEthernet0/1
        90 :  no ip address
        91 :  shutdown
        92 :  duplex auto
        93 :  speed auto
        94 : !
        95 : interface Serial0/1
        96 :  no ip address
        97 :  shutdown
        98 :  clock rate 2000000
        99 : !
       100 : interface FastEthernet1/0
       101 :  no ip address
       102 :  shutdown
       103 :  duplex auto
       104 :  speed auto
       105 : !
       106 : interface FastEthernet2/0
       107 :  ip address 192.168.1.254 255.255.255.0
       108 :  ip access-group 101 in
       109 :  ip access-group 101 out
       110 :  ip tcp adjust-mss 1356
       111 :  duplex auto
       112 :  speed auto
       113 : !
       114 : interface Dialer1
       115 :  ip unnumbered Loopback0
       116 :  ip mtu 1454
       117 :  encapsulation ppp
       118 :  dialer pool 1
       119 :  dialer-group 1
       120 :  ppp authentication chap callin
       121 :  ppp chap hostname 2811@cisco.com
       122 :  ppp chap password 0 cisco
       123 :  crypto map IPSECL2L
       124 : !
       125 : ip forward-protocol nd
       126 : ip route 0.0.0.0 0.0.0.0 Dialer1
       127 : !
       128 : !
       129 : no ip http server
       130 : no ip http secure-server
       131 : !
       132 : access-list 100 permit ip any any
       133 : access-list 101 permit ip any any
       134 : access-list 101 permit icmp any any
       135 : access-list 101 permit udp any any eq isakmp
       136 : access-list 101 permit esp any any
       137 : dialer-list 1 protocol ip permit
       138 : no cdp log mismatch duplex
       139 : !
       140 : !
       141 : !
       142 : !
       143 : !
       144 : !
       145 : control-plane
       146 : !
       147 : !
       148 : !
       149 : !
       150 : !
       151 : !
       152 : !
       153 : !
       154 : !
       155 : !
       156 : gatekeeper
       157 :  shutdown
       158 : !
       159 : !
       160 : line con 0
       161 :  exec-timeout 0 0
       162 :  privilege level 15
       163 :  logging synchronous
       164 : line aux 0
       165 :  exec-timeout 0 0
       166 :  privilege level 15
       167 :  logging synchronous
       168 : line vty 0 4
       169 :  login
       170 : !
       171 : !
       172 : end
    WAN1#
    
[/code]

・WAN2

[code]

    WAN2#show run line
    Building configuration...
    
    Current configuration : 2252 bytes
         1 : !
         2 : version 12.4
         3 : service timestamps debug datetime msec
         4 : service timestamps log datetime msec
         5 : no service password-encryption
         6 : !
         7 : hostname WAN2
         8 : !
         9 : boot-start-marker
        10 : boot-end-marker
        11 : !
        12 : !
        13 : no aaa new-model
        14 : memory-size iomem 5
        15 : no ip icmp rate-limit unreachable
        16 : ip cef
        17 : !
        18 : !
        19 : !
        20 : !
        21 : no ip domain lookup
        22 : !
        23 : multilink bundle-name authenticated
        24 : !
        25 : !
        26 : !
        27 : !
        28 : !
        29 : !
        30 : !
        31 : !
        32 : !
        33 : !
        34 : !
        35 : !
        36 : !
        37 : !
        38 : !
        39 : !
        40 : !
        41 : !
        42 : !
        43 : !
        44 : !
        45 : archive
        46 :  log config
        47 :   hidekeys
        48 : !
        49 : !
        50 : crypto isakmp policy 1
        51 :  encr 3des
        52 :  hash md5
        53 :  authentication pre-share
        54 : crypto isakmp key cisco address 64.100.1.1
        55 : crypto isakmp keepalive 30 periodic
        56 : !
        57 : !
        58 : crypto ipsec transform-set IPSEC esp-3des esp-md5-hmac
        59 : !
        60 : crypto map IPSECL2L 1 ipsec-isakmp
        61 :  set peer 64.100.1.1
        62 :  set transform-set IPSEC
        63 :  match address 100
        64 : !
        65 : !
        66 : !
        67 : ip tcp synwait-time 5
        68 : !
        69 : !
        70 : !
        71 : !
        72 : interface Loopback0
        73 :  ip address 64.100.2.1 255.255.255.0
        74 : !
        75 : interface FastEthernet0/0
        76 :  no ip address
        77 :  ip access-group 101 in
        78 :  ip access-group 101 out
        79 :  duplex auto
        80 :  speed auto
        81 :  pppoe enable group global
        82 :  pppoe-client dial-pool-number 1
        83 : !
        84 : interface Serial0/0
        85 :  no ip address
        86 :  shutdown
        87 :  clock rate 2000000
        88 : !
        89 : interface FastEthernet0/1
        90 :  no ip address
        91 :  shutdown
        92 :  duplex auto
        93 :  speed auto
        94 : !
        95 : interface Serial0/1
        96 :  no ip address
        97 :  shutdown
        98 :  clock rate 2000000
        99 : !
       100 : interface FastEthernet1/0
       101 :  no ip address
       102 :  shutdown
       103 :  duplex auto
       104 :  speed auto
       105 : !
       106 : interface FastEthernet2/0
       107 :  ip address 192.168.2.254 255.255.255.0
       108 :  ip access-group 101 in
       109 :  ip access-group 101 out
       110 :  ip tcp adjust-mss 1356
       111 :  duplex auto
       112 :  speed auto
       113 : !
       114 : interface Dialer1
       115 :  ip unnumbered Loopback0
       116 :  ip mtu 1454
       117 :  encapsulation ppp
       118 :  dialer pool 1
       119 :  dialer-group 1
       120 :  ppp authentication chap callin
       121 :  ppp chap hostname 2811@cisco.com
       122 :  ppp chap password 0 cisco
       123 :  crypto map IPSECL2L
       124 : !
       125 : ip forward-protocol nd
       126 : ip route 0.0.0.0 0.0.0.0 Dialer1
       127 : !
       128 : !
       129 : no ip http server
       130 : no ip http secure-server
       131 : !
       132 : access-list 100 permit ip any any
       133 : access-list 101 permit ip any any
       134 : access-list 101 permit icmp any any
       135 : access-list 101 permit udp any any eq isakmp
       136 : access-list 101 permit esp any any
       137 : dialer-list 1 protocol ip permit
       138 : no cdp log mismatch duplex
       139 : !
       140 : !
       141 : !
       142 : !
       143 : !
       144 : !
       145 : control-plane
       146 : !
       147 : !
       148 : !
       149 : !
       150 : !
       151 : !
       152 : !
       153 : !
       154 : !
       155 : !
       156 : gatekeeper
       157 :  shutdown
       158 : !
       159 : !
       160 : line con 0
       161 :  exec-timeout 0 0
       162 :  privilege level 15
       163 :  logging synchronous
       164 : line aux 0
       165 :  exec-timeout 0 0
       166 :  privilege level 15
       167 :  logging synchronous
       168 : line vty 0 4
       169 :  login
       170 : !
       171 : !
       172 : end
    WAN2#
    
[/code]

・PC-1

[code]

    PC-1> show ip
    
    NAME        : PC-1[1]
    IP/MASK     : 192.168.1.1/24
    GATEWAY     : 192.168.1.254
    DNS         :
    MAC         : 00:50:79:66:68:01
    LPORT       : 10068
    RHOST:PORT  : 127.0.0.1:10069
    MTU:        : 1500
    
    PC-1>
    
[/code]

・PC-2

[code]

    PC-2> show ip
    
    NAME        : PC-2[1]
    IP/MASK     : 192.168.2.1/24
    GATEWAY     : 192.168.2.254
    DNS         :
    MAC         : 00:50:79:66:68:00
    LPORT       : 10070
    RHOST:PORT  : 127.0.0.1:10071
    MTU:        : 1500
    
    PC-2>
    
[/code]

PC-1からPC-2へpingを飛ばしたときのWANルーターの挙動です。  
・WAN1

[code]

    WAN1#show crypto session
    Crypto session current status
    
    Interface: Dialer1
    Session status: DOWN-NEGOTIATING
    Peer: 64.100.2.1 port 500
      IKE SA: local 64.100.1.1/500 remote 64.100.2.1/500 Inactive
      IPSEC FLOW: permit ip 0.0.0.0/0.0.0.0 0.0.0.0/0.0.0.0
            Active SAs: 0, origin: crypto map
    
    WAN1#show crypto isakmp sa
    IPv4 Crypto ISAKMP SA
    dst             src             state          conn-id slot status
    64.100.2.1      64.100.1.1      MM_NO_STATE          0    0 ACTIVE
    
    IPv6 Crypto ISAKMP SA
    
    WAN1#show crypto isakmp policy
    
    Global IKE policy
    Protection suite of priority 1
            encryption algorithm:   Three key triple DES
            hash algorithm:         Message Digest 5
            authentication method:  Pre-Shared Key
            Diffie-Hellman group:   #1 (768 bit)
            lifetime:               86400 seconds, no volume limit
    Default protection suite
            encryption algorithm:   DES - Data Encryption Standard (56 bit keys).
            hash algorithm:         Secure Hash Standard
            authentication method:  Rivest-Shamir-Adleman Signature
            Diffie-Hellman group:   #1 (768 bit)
            lifetime:               86400 seconds, no volume limit
    WAN1#
    
    WAN1#debug crypto isakmp
    Crypto ISAKMP debugging is on
    WAN1#
    *Mar  1 00:21:26.935: ISAKMP:(0): SA request profile is (NULL)
    *Mar  1 00:21:26.935: ISAKMP: Created a peer struct for 64.100.2.1, peer port 500
    *Mar  1 00:21:26.935: ISAKMP: New peer created peer = 0x66F690B8 peer_handle = 0x80000004
    *Mar  1 00:21:26.935: ISAKMP: Locking peer struct 0x66F690B8, refcount 1 for isakmp_initiator
    *Mar  1 00:21:26.935: ISAKMP: local port 500, remote port 500
    *Mar  1 00:21:26.935: ISAKMP: set new node 0 to QM_IDLE
    *Mar  1 00:21:26.935: insert sa successfully sa = 66C7A93C
    *Mar  1 00:21:26.935: ISAKMP:(0):Can not start Aggressive mode, trying Main mode.
    *Mar  1 00:21:26.935: ISAKMP:(0):found peer pre-shared key matching 64.100.2.1
    WAN1#
    *Mar  1 00:21:26.935: ISAKMP:(0): constructed NAT-T vendor-rfc3947 ID
    *Mar  1 00:21:26.935: ISAKMP:(0): constructed NAT-T vendor-07 ID
    *Mar  1 00:21:26.935: ISAKMP:(0): constructed NAT-T vendor-03 ID
    *Mar  1 00:21:26.935: ISAKMP:(0): constructed NAT-T vendor-02 ID
    *Mar  1 00:21:26.935: ISAKMP:(0):Input = IKE_MESG_FROM_IPSEC, IKE_SA_REQ_MM
    *Mar  1 00:21:26.935: ISAKMP:(0):Old State = IKE_READY  New State = IKE_I_MM1
    
    *Mar  1 00:21:26.935: ISAKMP:(0): beginning Main Mode exchange
    *Mar  1 00:21:26.935: ISAKMP:(0): sending packet to 64.100.2.1 my_port 500 peer_port 500 (I) MM_NO_STATE
    *Mar  1 00:21:26.935: ISAKMP:(0):Sending an IKE IPv4 Packet.
    WAN1#
    *Mar  1 00:21:36.935: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE...
    *Mar  1 00:21:36.935: ISAKMP (0:0): incrementing error counter on sa, attempt 1 of 5: retransmit phase 1
    *Mar  1 00:21:36.935: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE
    *Mar  1 00:21:36.939: ISAKMP:(0): sending packet to 64.100.2.1 my_port 500 peer_port 500 (I) MM_NO_STATE
    *Mar  1 00:21:36.939: ISAKMP:(0):Sending an IKE IPv4 Packet.
    WAN1#
    *Mar  1 00:21:46.939: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE...
    *Mar  1 00:21:46.939: ISAKMP (0:0): incrementing error counter on sa, attempt 2 of 5: retransmit phase 1
    *Mar  1 00:21:46.939: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE
    *Mar  1 00:21:46.943: ISAKMP:(0): sending packet to 64.100.2.1 my_port 500 peer_port 500 (I) MM_NO_STATE
    *Mar  1 00:21:46.943: ISAKMP:(0):Sending an IKE IPv4 Packet.
    WAN1#
    *Mar  1 00:21:56.931: ISAKMP: set new node 0 to QM_IDLE
    *Mar  1 00:21:56.935: ISAKMP:(0):SA is still budding. Attached new ipsec request to it. (local 64.100.1.1, remote 64.100.2.1)
    *Mar  1 00:21:56.935: ISAKMP: Error while processing SA request: Failed to initialize SA
    *Mar  1 00:21:56.935: ISAKMP: Error while processing KMI message 0, error 2.
    *Mar  1 00:21:56.943: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE...
    *Mar  1 00:21:56.943: ISAKMP (0:0): incrementing error counter on sa, attempt 3 of 5: retransmit phase 1
    *Mar  1 00:21:56.943: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE
    WAN1#
    *Mar  1 00:21:56.947: ISAKMP:(0): sending packet to 64.100.2.1 my_port 500 peer_port 500 (I) MM_NO_STATE
    *Mar  1 00:21:56.947: ISAKMP:(0):Sending an IKE IPv4 Packet.
    WAN1#
    *Mar  1 00:22:06.947: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE...
    *Mar  1 00:22:06.947: ISAKMP (0:0): incrementing error counter on sa, attempt 4 of 5: retransmit phase 1
    *Mar  1 00:22:06.947: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE
    *Mar  1 00:22:06.951: ISAKMP:(0): sending packet to 64.100.2.1 my_port 500 peer_port 500 (I) MM_NO_STATE
    *Mar  1 00:22:06.951: ISAKMP:(0):Sending an IKE IPv4 Packet.
    WAN1#
    
[/code]

・WAN2

[code]

    WAN2#show crypto session
    Crypto session current status
    
    Interface: Dialer1
    Session status: DOWN
    Peer: 64.100.1.1 port 500
      IPSEC FLOW: permit ip 0.0.0.0/0.0.0.0 0.0.0.0/0.0.0.0
            Active SAs: 0, origin: crypto map
    
    WAN2#show crypto isakmp sa
    IPv4 Crypto ISAKMP SA
    dst             src             state          conn-id slot status
    
    IPv6 Crypto ISAKMP SA
    
    WAN2#show crypto isakmp policy
    
    Global IKE policy
    Protection suite of priority 1
            encryption algorithm:   Three key triple DES
            hash algorithm:         Message Digest 5
            authentication method:  Pre-Shared Key
            Diffie-Hellman group:   #1 (768 bit)
            lifetime:               86400 seconds, no volume limit
    Default protection suite
            encryption algorithm:   DES - Data Encryption Standard (56 bit keys).
            hash algorithm:         Secure Hash Standard
            authentication method:  Rivest-Shamir-Adleman Signature
            Diffie-Hellman group:   #1 (768 bit)
            lifetime:               86400 seconds, no volume limit
    WAN2#
    
[/code]


CC BY-SA 4.0
2019-03-06T01:38:48.430
53223
2019-03-25T23:13:54.957
2019-03-25T23:13:54.957
19110
27871
question
network
IPSec VPNでPingが通らない


質問される際は何を試したがダメだった、pingはどこまで飛ぶなど、調べたことを記載されたほうが良いかと思います。悪気はないのでしょうが、丸投げ方式の質問に見えます。  
また、構成図にはIPアドレスや接続インターフェスの番号なども載ってるといいかと思いました。

まず、ルータ間で相互にpingが通ることを確認しましたか？  
IPSecなどのオーバーレイネットワークの設定をする時は、基礎となるアンダーレイネットワークの疎通に問題ないことを確認してからにしましょう。

回答申し上げるとPPPoEの設定が問題だと思います。  
両対向ともPPPoEのクライアント側の設定になっており、サーバ側がいないです。


CC BY-SA 4.0
2019-03-25T17:17:26.020
53726
2019-03-25T17:17:26.020
32671
53223
answer