windows-7 – 从Windows 7到ASA 5520的L2TP / IPSec(2)

这是我的配置：

ny-asa01# sh run crypto
crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec ikev1 transform-set TRANS_ESP_3DES_MD5 esp-3des esp-md5-hmac
crypto ipsec ikev1 transform-set TRANS_ESP_3DES_MD5 mode transport
crypto ipsec ikev1 transform-set TRANS_ESP_3DES_SHA esp-3des esp-sha-hmac
crypto ipsec ikev1 transform-set TRANS_ESP_3DES_SHA mode transport
crypto ipsec security-association lifetime seconds 86400
crypto dynamic-map OUTSIDE_DYN_MAP 10 set ikev1 transform-set ESP-3DES-SHA
crypto dynamic-map OUTSIDE_DYN_MAP 10 set security-association lifetime seconds 86400
crypto dynamic-map OUTSIDE_DYN_MAP 10 set reverse-route
crypto dynamic-map OUTSIDE_DYN_MAP 20 set ikev1 transform-set TRANS_ESP_3DES_MD5
crypto dynamic-map OUTSIDE_DYN_MAP 20 set nat-t-disable
crypto dynamic-map L2TP_MAP 10 set ikev1 transform-set TRANS_ESP_3DES_MD5
crypto map vpnmap 10 match address A_to_B_vpn
crypto map vpnmap 10 set pfs
crypto map vpnmap 10 set peer 9.8.7.6
crypto map vpnmap 10 set ikev1 transform-set ESP-3DES-SHA
crypto map vpnmap 20 match address B_TO_C_vpn
crypto map vpnmap 20 set pfs
crypto map vpnmap 20 set peer 5.4.3.2
crypto map vpnmap 20 set ikev1 transform-set ESP-3DES-SHA
crypto map vpnmap 65500 ipsec-isakmp dynamic OUTSIDE_DYN_MAP
crypto map vpnmap interface outside
crypto isakmp identity address
crypto isakmp nat-traversal 300
crypto ikev1 enable outside
crypto ikev1 ipsec-over-tcp port 10000
crypto ikev1 policy 1
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400

 tunnel-group DefaultRAGroup general-attributes
 address-pool stackvpn_pool
 authentication-server-group RADIUS_SERVER
 accounting-server-group RADIUS_SERVER
 default-group-policy stackvpn_l2tp
tunnel-group DefaultRAGroup ipsec-attributes
 ikev1 pre-shared-key *****
tunnel-group DefaultRAGroup ppp-attributes
 no authentication chap

group-policy stackvpn_l2tp internal
group-policy stackvpn_l2tp attributes
 dns-server value 5.6.7.8 9.10.11.12
 vpn-tunnel-protocol l2tp-ipsec
 ipsec-udp enable
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value VPN_SPLIT_TUNNEL
 address-pools value stackvpn_pool

显然,第2阶段的不匹配通常会通过更改提案来解决,但不幸的是,似乎Windows 7根本不会让您查看提案设置.在Win7配置中无法明确打开NAT-T.

所以,我的问题是：我的配置是否很棘手？有没有人在Windows上加载8.4的L2A上正常使用L2TP？

我很确定你对这个错误是正确的 – 如果它不能协商一个SA你就被冲洗了.

我会尝试摆脱“NAT Traversal”.当然,您可能会遇到尝试重新访问NAT,在这种情况下可能需要它.但这肯定是你问题的原因.

我想你的另一个选择是弄清楚如何让windows 7做nat-traversal SA类型.您可以尝试在Windows上使用netsh advfirewall consec.

这是我给它添加书签的参考资料. http://technet.microsoft.com/en-us/library/dd736198(v=ws.10).aspx.

一个注意事项 – Windows文档说明了定期重新键入连接的重要性.但是,如果过于频繁地重新键入,则ASA会进行转储并断开连接.确保不要每隔2分钟重新按键一次.使用MS建议的重新生成的字节数值使其低于2分钟.

当我们开设支持案例时,M $无法真正给出他们推荐的任何理由.他们给我们发了一大笔费用.

（编辑：ASP站长网）