エクセルで図形のみを選択する

エクセルで図形のみを選択する方法。

左下の矢印をクリックする。

あ、これは図形ツールバーにあるので表示させとかないといけない。

でも、エクセルで図形を使うのは、本当は嫌い。

QTConverter

携帯でとったムービーをムービーメーカーで編集するには、QTConverterでaviに変換するべし。

いろいろソフトがあって試してみたが、速度が変わったり音が壊れたり音しか変換できなかったりダウンロードのリンクがわけがわからなかったり時間がかかったり・・・

QTCはすぐダウンロードできてインストールも変換もあっという間だった。

・・・が、Quicktimeからaviにエクスポートできるじゃん・・・

なんか画質が劣化するっぽいけど・・・

続続続・IPsecをやってみる (NEC & FITELnet)

では次に、FITELnetとNEC

PC1 ---- F100 ---- IX2004 --- PC2

シリアルケーブル買ってきました。IX2004のために。
要は、モデムとつなぐときはストレート、PC同士はクロス、ということです。

あっさりできた。

FITEL#sho cry isa sa
[ 1] 100.0.0.2
<--> 100.0.0.1
 Main Mode UP pre-shared key DES MD5
Lifetime : 600secs
Current : 19secs,1kbytes
mcfg config-mode: off
mcfg addr: off
mcfg apl-version:
IKE Keepalive: dpd
ICMP Keepalive: off
release on addr-change: off

FITEL#sho cry isa policy
Protection suite priority [1]
authentication method : preshared key
encryption algorithm : DES - Data Encryption Standard (56 bit keys)
Diffie-Hellman Group : #1 (768 bit)
hash algorithm : Message Digest 5
lifetime : 600 seconds, no volume limit
Disabled frequency : 0

Default protection suite
authentication method : preshared key
encryption algorithm : DES - Data Encryption Standard (56 bit keys)
hash algorithm : Message Digest 5
Diffie-Hellman Group : #1 (768 bit)
lifetime : 1000 seconds, no volume limit


FITEL#sho running.cfg
!
! FITELnet-F100
! Firmware version: V02.07(02) 032307
!
ip route 0.0.0.0 0.0.0.0 100.0.0.2
!
access-list 1 permit 192.168.1.0 0.0.0.255
!
vpn enable
vpnlog enable
!
ipsec access-list 1 ipsec ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
ipsec access-list 64 bypass ip any any
ipsec transform-set P2-des-md5 esp-des esp-md5-hmac
!
service dhcp-server
!
hostname FITEL
!
ip dhcp pool lan1
exit
!
interface ewan 1
crypto map kyoten
ip address 100.0.0.1 255.255.255.0
ip nat inside source list 1 interface
exit
interface ewan 2
exit
interface lan 1
ip address 192.168.1.254 255.255.255.0
exit
!
!
crypto isakmp policy 1
authentication prekey
encryption des
group 1
hash md5
idtype-pre userfqdn
key ascii secret
lifetime 600
negotiation-mode main
peer-identity address 100.0.0.2
exit
crypto map kyoten 1
match address 1
set peer address 100.0.0.2
set transform-set P2-des-md5
exit
crypto security-association
exit
!
end





Router(config)# sho running-config
!
ip route 192.168.1.0/24 Tunnel0.0
ip access-list list1 permit ip src 192.168.2.0 0.0.0.255 dest 192.168.1.0 0.0.0.255
!
ike proposal ike-prop encryption des hash md5 lifetime 600
!
ike policy ike-policy peer 100.0.0.1 key secret ike-prop
!
ipsec autokey-map ipsec-policy list1 peer 100.0.0.1 default
ipsec local-id ipsec-policy 192.168.2.0/24
ipsec remote-id ipsec-policy 192.168.1.0/24
!
telnet-server ip enable
!
device FastEthernet0
!
device FastEthernet1
!
interface FastEthernet0.0
ip address 100.0.0.2/24
no shutdown
!
interface FastEthernet1.0
ip address 192.168.2.254/24
no shutdown
!
interface Loopback0.0
no ip address
!
interface Null0.0
no ip address
!
interface AutoTunnel0.0
no ip address
shutdown
!
interface Tunnel0.0
tunnel mode ipsec
ip unnumbered FastEthernet1.0
ipsec policy tunnel ipsec-policy out
no shutdown
Router(config)#
Router(config)# sho ike sa
ISAKMP SA - 1 configured, 1 created
Local address is 100.0.0.2
Remote address is 100.0.0.1
IKE policy name is ike-policy
Direction is responder
Initiator's cookie is 0xfc6bbe87ce000000
Responder's cookie is 0xba77d813c2ce6e0d
Exchange type is main mode
State is established
Authentication method is pre-shared
Encryption algorithm is des
Hash algorithm is md5
DH group is modp768, lifetime is 414 seconds
#ph1 success: 1, #ph1 failure: 0
#ph1 hash err: 0, #ph1 timeout: 0, #ph1 resend: 0
#ph2 success: 1, #ph2 failure: 0
#ph2 hash err: 0, #ph2 timeout: 0, #ph2 resend: 0
Router(config)#
Router(config)# sho ike statistics
Phase1 Statistics:
1 success, 0 failure, 0 hash errors
0 config errors, 0 timeout errors, 0 resend packet

Phase2 Statistics:
1 success, 0 failure, 0 request errors, 0 hash errors
0 config errors, 0 timeout errors, 0 resend packet

IKE Informations:
Notify message type
Rcvd: 0 invalid payload type, 0 doi not supported
0 situation not supported, 0 invalid cookie
0 invalid major version, 0 invalid minor version
0 invalid exchange type, 0 invalid flags, 0 invalid message id
0 invalid protocol id, 0 invalid spi, 0 invalid transform id
0 attributes not supported, 0 no proposal chosen
0 bad proposal syntax, 0 payload malformed
0 invalid key information, 0 invalid id information
0 invalid cert encoding, 0 invalid certificate
0 cert type unsupported, 0 invalid cert authority
0 invalid hash information, 0 authentication failed
0 invalid signature, 0 address notification
0 notify sa lifetime, 0 certificate unavailable
0 unsupported exchange type, 0 unequal payload lengths
0 connected
0 responder lifetime, 0 replay status, 1 initial contact
0 keepalive, 0 keepalive ack
0 unknown type
Sent: 0 invalid payload type, 0 doi not supported
0 situation not supported, 0 invalid cookie
0 invalid major version, 0 invalid minor version
0 invalid exchange type, 0 invalid flags, 0 invalid message id
0 invalid protocol id, 0 invalid spi, 0 invalid transform id
0 attributes not supported, 0 no proposal chosen
0 bad proposal syntax, 0 payload malformed
0 invalid key information, 0 invalid id information
0 invalid cert encoding, 0 invalid certificate
0 cert type unsupported, 0 invalid cert authority
0 invalid hash information, 0 authentication failed
0 invalid signature, 0 address notification
0 notify sa lifetime, 0 certificate unavailable
0 unsupported exchange type, 0 unequal payload lengths
0 connected
0 responder lifetime, 0 replay status, 0 initial contact
0 keepalive, 0 keepalive ack
0 unknown type
Delete protocol type
Rcvd: 0 isakmp, 0 ah, 0 esp
0 unknown type
Sent: 0 isakmp, 0 ah, 0 esp
0 unknown type
Router(config)#
sho ipsec sa
IPsec SA - 1 configured, 2 created
Interface is Tunnel0.0
Key policy map name is ipsec-policy
Tunnel mode, 4-over-4, autokey-map
Local address is 100.0.0.2
Remote address is 100.0.0.1
Outgoing interface is FastEthernet0.0
Interface MTU is 1446, path MTU is 1500
Inbound:
ESP, SPI is 0x9566dd14(2506546452)
Transform is ESP-DES-HMAC-MD5-96
Remaining lifetime is 393 seconds
Replay detection support is on
Outbound:
ESP, SPI is 0x3ae07975(987789685)
Transform is ESP-DES-HMAC-MD5-96
Remaining lifetime is 393 seconds
Replay detection support is on
Perfect forward secrecy is off
Router(config)#

というわけで・・・

ix2004,
FITELnet F100 x 3,
シリアルケーブル（クロス） for FITELnet、
シリアルケーブル（ストレート） for IX,
某ソフト registration・・・
Dynamipsインストール、
Catalyst引っ張り出し・・・

シリアルのストレートケーブルというのは、昔モデムに接続するときに使ったものである。多分、コンシューマ向け（？）のちっちゃいルータ(IX2004とか)は、それと同じケーブルでつなげるようにと、ストレートでつなぐようになっているのだろう。

一方、FITELnet F100はシリアルのリバース（クロス）ケーブルでつなぐ。
このケーブルは、PC同士をつないでデータ転送をするような時に使う。

私も昔、かってつないだような記憶がある。 「ある程度の大きなルータになると、PC扱いになるのでクロスでつなぐ・・・」というのは私の覚え方。

結線は

1 --- 7＆8
2 --- 3
3 --- 2
4 --- 6
5 --- 5
6 --- 4
7＆8 --- 1
フレーム --- フレーム

だとさ

続続・IPsecをやってみる (Cisco & FITELnet)

ここまでは、サンプルをいれただけなのでできて当然。 

問題は、異なる機種間での相互接続である。

 それじゃ、まず、cisco --- FITELnet をやってみようか？

PC1 ---- F100 --- R1 --- R2

PC1: 192.168.1.10
F100: 192.168.1.254, 100.0.0.1
R1: 100.0.0.2, 192.168.2.254
R2: 192.168.2.1

 R1とR2はDynamipsでemulateしたCisco7200

R1#sho running-config

Building configuration...

Current configuration : 1811 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R1
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
!
!
ip cef
!
!
crypto isakmp policy 1
hash md5
authentication pre-share
lifetime 600
crypto isakmp key secret address 100.0.0.1 255.255.255.0
!
crypto ipsec security-association lifetime seconds 1000
!
crypto ipsec transform-set IPSEC esp-des esp-md5-hmac
!
crypto map MAP1 1 ipsec-isakmp
set peer 100.0.0.1
set transform-set IPSEC
match address 101
!
!
!
!
interface FastEthernet0/0
ip address 100.0.0.2 255.255.255.0
ip nat inside
ip virtual-reassembly
duplex auto
speed auto
crypto map MAP1
!
interface FastEthernet0/1
no ip address
shutdown
duplex auto
speed auto
!
interface Serial1/0
ip address 192.168.2.254 255.255.255.0
serial restart-delay 0
no fair-queue
!
!
ip route 0.0.0.0 0.0.0.0 100.0.0.1
!
no ip http server
no ip http secure-server
!
ip nat inside source list 1 interface FastEthernet0/0 overload
!
access-list 1 permit 192.168.2.0 0.0.0.255
access-list 101 permit ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255
!





FITEL#sho running.cfg

!
! FITELnet-F100
! Firmware version: V02.07(02) 032307
!
!
!
ip route 0.0.0.0 0.0.0.0 100.0.0.2
!
access-list 1 permit 192.168.1.0 0.0.0.255
!
vpn enable
vpnlog enable
!
ipsec access-list 1 ipsec ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
ipsec access-list 64 bypass ip any any
ipsec transform-set P2-des-md5 esp-des esp-md5-hmac
!
service dhcp-server
!
hostname FITEL
!
!
ip dhcp pool lan1
exit
!
interface ewan 1
crypto map kyoten
ip address 100.0.0.1 255.255.255.0
ip nat inside source list 1 interface
exit
interface ewan 2
exit
interface lan 1
ip address 192.168.1.254 255.255.255.0
exit
!
!
crypto isakmp policy 1
authentication prekey
encryption des
group 1
hash md5
idtype-pre userfqdn
key ascii secret
lifetime 600
negotiation-mode main
peer-identity address 100.0.0.2
exit
crypto map kyoten 1
match address 1
set peer address 100.0.0.2
set transform-set P2-des-md5
exit
crypto security-association
exit
!
end








FITEL#sho cry isa sa
[ 1] 100.0.0.2
<--> 100.0.0.1
 Main Mode UP pre-shared key DES MD5
Lifetime : 600secs
Current : 527secs,1kbytes
mcfg config-mode: off
mcfg addr: off
mcfg apl-version:
IKE Keepalive: dpd
ICMP Keepalive: off
release on addr-change: off

FITEL#sho cry ipsec sa
IPSEC SA
current insa : 1
current outsa : 1
[ 1] 192.168.2.0,255.255.255.0 ALL ALL
<--> 192.168.1.0,255.255.255.0 ALL ALL
peer: 100.0.0.2

 UP ESP DES HMAC-MD5 PFS:off
Lifetime: 600secs,4608000kbytes
Anti-Replay: Enable
O-SPI: 0x3b56eeb5 Current: 531secs,1kbytes
out packet : 4 error packet : 0
I-SPI: 0x105e8a87 Current: 531secs,1kbytes
in packet : 4 auth packet : 4
decrypt packet : 4 discard packet : 0
replay packet : 0 auth error packet : 0

FITEL#sho cry isakmp policy
Protection suite priority [1]
authentication method : preshared key
encryption algorithm : DES - Data Encryption Standard (56 bit keys)
Diffie-Hellman Group : #1 (768 bit)
hash algorithm : Message Digest 5
lifetime : 600 seconds, no volume limit
Disabled frequency : 0

Default protection suite
authentication method : preshared key
encryption algorithm : DES - Data Encryption Standard (56 bit keys)
hash algorithm : Message Digest 5
Diffie-Hellman Group : #1 (768 bit)
lifetime : 1000 seconds, no volume limit





R1#sho cry isa sa
dst src state conn-id slot status
100.0.0.1 100.0.0.2 QM_IDLE 1 0 ACTIVE

R1#sho cry isa sa ?
active Shows HA-enabled ISAKMP SAs in the active state
detail Show ISAKMP SA Detail
nat Show ISAKMP SA NAT Detail
standby Shows HA-enabled ISAKMP SAs in the standby state
vrf Show ISAKMP SA as per VRF
| Output modifiers


R1#sho cry isa sa det
R1#sho cry isa sa detail
Codes: C - IKE configuration mode, D - Dead Peer Detection
K - Keepalives, N - NAT-traversal
X - IKE Extended Authentication
psk - Preshared key, rsig - RSA signature
renc - RSA encryption

C-id Local Remote I-VRF Status Encr Hash Auth DH Lifetime Cap.
1 100.0.0.2 100.0.0.1 ACTIVE des md5 psk 1 00:00:42
Connection-id:Engine-id = 1:1(software)
R1#
R1#sho cry ipsec sa

interface: FastEthernet0/0
Crypto map tag: MAP1, local addr 100.0.0.2

protected vrf: (none)
local ident (addr/mask/prot/port): (192.168.2.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0)
current_peer 100.0.0.1 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 4, #pkts encrypt: 4, #pkts digest: 4
#pkts decaps: 4, #pkts decrypt: 4, #pkts verify: 4
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 1, #recv errors 0

local crypto endpt.: 100.0.0.2, remote crypto endpt.: 100.0.0.1
path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet0/0
current outbound spi: 0x105E8A87(274631303)

inbound esp sas:
spi: 0x3B56EEB5(995552949)
transform: esp-des esp-md5-hmac ,
in use settings ={Tunnel, }
conn id: 2001, flow_id: SW:1, crypto map: MAP1
sa timing: remaining key lifetime (k/sec): (4421774/438)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE

inbound ah sas:

inbound pcp sas:

outbound esp sas:
spi: 0x105E8A87(274631303)
transform: esp-des esp-md5-hmac ,
in use settings ={Tunnel, }
conn id: 2002, flow_id: SW:2, crypto map: MAP1
sa timing: remaining key lifetime (k/sec): (4421774/437)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE

outbound ah sas:

outbound pcp sas:

R1#R1#sho cry isakmp policy

Global IKE policy
Protection suite of priority 1
encryption algorithm: DES - Data Encryption Standard (56 bit keys).
hash algorithm: Message Digest 5
authentication method: Pre-Shared Key
Diffie-Hellman group: #1 (768 bit)
lifetime: 600 seconds, no volume limit
Default protection suite
encryption algorithm: DES - Data Encryption Standard (56 bit keys).
hash algorithm: Secure Hash Standard
authentication method: Rivest-Shamir-Adleman Signature
Diffie-Hellman group: #1 (768 bit)
lifetime: 86400 seconds, no volume limit
R1#

続・IPsecをやってみる (FITELnet)

今度はfitelnetでやってみました。

PC1 ---- R1 ---- R2 ---- PC2

PC1: 192.168.1.13
R1: 192.168.1.254, 100.0.0.1
R2: 192.168.2.254, 100.0.0.2
PC2: 192.168.2.1

natあり

R1#sho running.cfg
!
! FITELnet-F100
! Firmware version: V02.07(02) 032307
!
ip route 0.0.0.0 0.0.0.0 ewan 1
!
access-list 1 permit 192.168.1.0 0.0.0.255
!
vpn enable
vpnlog enable
!
ipsec access-list 1 ipsec ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
ipsec access-list 64 bypass ip any any
ipsec transform-set P2-des-md5 esp-des esp-md5-hmac
!
service dhcp-server
!
hostname R1
!
ip dhcp pool lan1
exit
!
interface ewan 1
crypto map kyoten
ip address 100.0.0.1 255.255.255.0
ip nat inside source list 1 interface
exit
interface ewan 2
exit
interface lan 1
ip address 192.168.1.254 255.255.255.0
exit
!
crypto isakmp policy 1
authentication prekey
encryption des
hash md5
idtype-pre userfqdn
key ascii secret
negotiation-mode main
peer-identity address 100.0.0.2
exit
crypto map kyoten 1
match address 1
set peer address 100.0.0.2
set transform-set P2-des-md5
exit
!
end


R2#sho running.cfg
!
! FITELnet-F100
! Firmware version: V02.07(02) 032307
!
ip route 0.0.0.0 0.0.0.0 ewan 1
ip route 192.168.1.0 255.255.255.0 100.0.0.1
!
access-list 1 permit 192.168.2.0 0.0.0.255
!
vpn enable
!
ipsec access-list 1 ipsec ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255
ipsec access-list 64 bypass ip any any
ipsec transform-set P2-des-md5 esp-des esp-md5-hmac
!
service dhcp-server
!
hostname R2
!
ip dhcp pool lan1
exit
!
interface ewan 1
crypto map center
ip address 100.0.0.2 255.255.255.0
ip nat inside source list 1 interface
exit
interface ewan 2
exit
interface lan 1
ip address 192.168.2.254 255.255.255.0
exit
!
crypto isakmp policy 1
authentication prekey
encryption des
hash md5
idtype-pre userfqdn
key ascii secret
my-identity kyoten
negotiation-mode main
peer-identity address 100.0.0.1
exit
crypto map center 1
match address 1
set peer address 100.0.0.1
set transform-set P2-des-md5
exit
!
end




R1#sho crypto isakmp sa
[ 1] 100.0.0.2
<--> 100.0.0.1
 Main Mode UP pre-shared key DES MD5
Lifetime : 1000secs
Current : 43secs,1kbytes
mcfg config-mode: off
mcfg addr: off
mcfg apl-version:
IKE Keepalive: dpd
ICMP Keepalive: off
release on addr-change: off

R1#sho cry isakmp policy
Protection suite priority [1]
authentication method : preshared key
encryption algorithm : DES - Data Encryption Standard (56 bit keys)
hash algorithm : Message Digest 5
Disabled frequency : 0

Default protection suite
authentication method : preshared key
encryption algorithm : DES - Data Encryption Standard (56 bit keys)
hash algorithm : Message Digest 5
Diffie-Hellman Group : #1 (768 bit)
lifetime : 1000 seconds, no volume limit


R1#sho crypto ipsec sa
IPSEC SA
current insa : 1
current outsa : 1
[ 1] 192.168.2.0,255.255.255.0 ALL ALL
<--> 192.168.1.0,255.255.255.0 ALL ALL
peer: 100.0.0.2

UP ESP DES HMAC-MD5 PFS:off
Lifetime: 600secs
Anti-Replay: Enable
O-SPI: 0x2c159090 Current: 60secs,1kbytes
out packet : 4 error packet : 0
I-SPI: 0x2b91a660 Current: 60secs,1kbytes
in packet : 4 auth packet : 4
decrypt packet : 4 discard packet : 0
replay packet : 0 auth error packet : 0

lhaで圧縮するのやめようぜ、もう・・・

さて・・・

MS Office 2000
Teraterm
Dynamips
IOSHunter
Lhaplus
Cygwin

などをインストールする。

lhaで圧縮するのやめようぜ、もう・・・。

SendToの場所

\Users\［ユーザー名］\AppData\Roaming\Microsoft\Windows\SendTo

IPsecをやってみる (Dynamips)

Dynamipsは Vista64でも動いた。
ただし、フォルダが読み取り専用になっていたのでそれを直すのと、 telnetはデフォルトで無効になっている（クライアントも）ので有効にする必要がある。 IPsecをやってみます。

  192.168.1.0/24    10.10.10.0/24    192.168.2.0/24
+----+        +----+             +----+        +----+
| R3 +--------+ R1 +-------------+ R2 +--------+ R4 |
+----+.2    .1+----+.1         .2+----+.1    .2+----+

R1

R1#sho running-config
Building configuration...

Current configuration : 1695 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R1
!
boot-start-marker
boot-end-marker
!
no aaa new-model
ip cef
!
crypto isakmp policy 1
encr 3des
hash md5
authentication pre-share
lifetime 28800
crypto isakmp key cisco address 10.10.10.2 255.255.255.0
crypto isakmp keepalive 100
!
crypto ipsec transform-set IPSEC esp-3des esp-md5-hmac
!
crypto map MAP1 1 ipsec-isakmp
set peer 10.10.10.2
set transform-set IPSEC
match address 101
interface FastEthernet0/0
ip address 192.168.1.1 255.255.255.0
duplex half
speed auto
!
interface FastEthernet0/1
no ip address
shutdown
duplex auto
speed auto
!
interface Serial1/0
ip address 10.10.10.1 255.255.255.0
serial restart-delay 0
crypto map MAP1
!
interface Serial1/1
no ip address
shutdown
serial restart-delay 0
!
interface Serial1/2
no ip address
shutdown
serial restart-delay 0
!
interface Serial1/3
no ip address
shutdown
serial restart-delay 0
!
interface Serial1/4
no ip address
shutdown
serial restart-delay 0
!
interface Serial1/5
no ip address
shutdown
serial restart-delay 0
!
interface Serial1/6
no ip address
shutdown
serial restart-delay 0
!
interface Serial1/7
no ip address
shutdown
serial restart-delay 0
!
ip route 192.168.1.0 255.255.255.0 10.10.10.2
ip route 192.168.2.0 255.255.255.0 10.10.10.2
!
no ip http server
no ip http secure-server
!
access-list 101 permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
!
control-plane
!
gatekeeper
shutdown
!
line con 0
stopbits 1
line aux 0
stopbits 1
line vty 0 4
login
!
end


R2

R2#sho running-config
Building configuration...

Current configuration : 1710 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R2
!
boot-start-marker
boot-end-marker
!
no aaa new-model
!
ip cef
!
crypto isakmp policy 1
encr 3des
hash md5
authentication pre-share
lifetime 28800
crypto isakmp key cisco address 10.10.10.1 255.255.255.0
crypto isakmp keepalive 100
!
crypto ipsec transform-set IPSEC esp-3des esp-md5-hmac
!
crypto map MAP1 1 ipsec-isakmp
set peer 10.10.10.1
set transform-set IPSEC
match address 101
!
interface FastEthernet0/0
ip address 192.168.2.1 255.255.255.0
duplex half
speed auto
!
interface FastEthernet0/1
no ip address
shutdown
duplex auto
speed auto
!
interface Serial1/0
ip address 10.10.10.2 255.255.255.0
serial restart-delay 0
no fair-queue
crypto map MAP1
!
interface Serial1/1
no ip address
shutdown
serial restart-delay 0
!
interface Serial1/2
no ip address
shutdown
serial restart-delay 0
!
interface Serial1/3
no ip address
shutdown
serial restart-delay 0
!
interface Serial1/4
no ip address
shutdown
serial restart-delay 0
!
interface Serial1/5
no ip address
shutdown
serial restart-delay 0
!
interface Serial1/6
no ip address
shutdown
serial restart-delay 0
!
interface Serial1/7
no ip address
shutdown
serial restart-delay 0
!
ip route 192.168.1.0 255.255.255.0 10.10.10.1
ip route 192.168.2.0 255.255.255.0 10.10.10.1
!
no ip http server
no ip http secure-server
!
access-list 101 permit ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255
!
control-plane
!
gatekeeper
shutdown
line con 0
stopbits 1
line aux 0
stopbits 1
line vty 0 4
login
end


R3

R3#sho running-config
Building configuration...

Current configuration : 621 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R3
!
boot-start-marker
boot-end-marker
!
no aaa new-model
!
ip cef
!
interface FastEthernet0/0
ip address 192.168.1.2 255.255.255.0
duplex auto
speed auto
!
interface FastEthernet0/1
no ip address
shutdown
duplex auto
speed auto
!
ip route 0.0.0.0 0.0.0.0 192.168.1.1
!
no ip http server
no ip http secure-server
!
control-plane
!
gatekeeper
shutdown
!
line con 0
stopbits 1
line aux 0
line vty 0 4
!
end


R4

R4#sho running-config
Building configuration...

Current configuration : 621 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R4
!
boot-start-marker
boot-end-marker
!
no aaa new-model
!
ip cef
!
interface FastEthernet0/0
ip address 192.168.2.2 255.255.255.0
duplex auto
speed auto
!
interface FastEthernet0/1
no ip address
shutdown
duplex auto
speed auto
!
ip route 0.0.0.0 0.0.0.0 192.168.2.1
!
no ip http server
no ip http secure-server
!
control-plane
!
gatekeeper
shutdown
!
line con 0
stopbits 1
line aux 0
line vty 0 4
!
end

設定しただけではIPsec SAは確立しません。
この設定だと、192.168.0/24 <---> 192.168.2.0/24　の通信が発生したときのみ、IPsec 通信が行われます。

R3#ping 192.168.2.2

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.2.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 220/260/356 ms
R3#


R1#show crypto isakmp sa
dst src state conn-id slot status
10.10.10.2 10.10.10.1 QM_IDLE 1 0 ACTIVE

R1#
R1#sho crypto isakmp peers
Peer: 10.10.10.2 Port: 500 Local: 10.10.10.1
Phase1 id: 10.10.10.2
R1#
R1#sho crypto isakmp policy

Global IKE policy
Protection suite of priority 1
encryption algorithm: Three key triple DES
hash algorithm: Message Digest 5
authentication method: Pre-Shared Key
Diffie-Hellman group: #1 (768 bit)
lifetime: 28800 seconds, no volume limit
Default protection suite
encryption algorithm: DES - Data Encryption Standard (56 bit keys).
hash algorithm: Secure Hash Standard
authentication method: Rivest-Shamir-Adleman Signature
Diffie-Hellman group: #1 (768 bit)
lifetime: 86400 seconds, no volume limit
R1#

08/12/22(Mon) 08:36
R1#sho cry ipsec sa

interface: Serial1/0
Crypto map tag: MAP1, local addr 10.10.10.1

protected vrf: (none)
local ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (192.168.2.0/255.255.255.0/0/0)
current_peer 10.10.10.2 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 18, #pkts encrypt: 18, #pkts digest: 18
#pkts decaps: 17, #pkts decrypt: 17, #pkts verify: 17
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 2, #recv errors 0

local crypto endpt.: 10.10.10.1, remote crypto endpt.: 10.10.10.2
path mtu 1500, ip mtu 1500, ip mtu idb Serial1/0
current outbound spi: 0x193624A0(422978720)

inbound esp sas:
spi: 0xC5E6FB2A(3320249130)
transform: esp-3des esp-md5-hmac ,
in use settings ={Tunnel, }
conn id: 2001, flow_id: SW:1, crypto map: MAP1
sa timing: remaining key lifetime (k/sec): (4482477/2342)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE

inbound ah sas:

inbound pcp sas:

outbound esp sas:
spi: 0x193624A0(422978720)
transform: esp-3des esp-md5-hmac ,
in use settings ={Tunnel, }
conn id: 2002, flow_id: SW:2, crypto map: MAP1
sa timing: remaining key lifetime (k/sec): (4482477/2341)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE

outbound ah sas:

outbound pcp sas:
R1#
R1#sho cry ipsec transform-set
Transform set IPSEC: { esp-3des esp-md5-hmac }
will negotiate = { Tunnel, },


R1#sho cry ipsec ?
policy Show IPSEC client policies
profile Show ipsec profile information
sa IPSEC SA table
security-association Show parameters for IPSec security associations
transform-set Crypto transform sets

R1#sho cry ipsec se
R1#sho cry ipsec security-association
Security association lifetime: 4608000 kilobytes/3600 seconds

R1の S1/0をキャプチャしてみると、ISAKMP Identity Protectionが３往復、ISAKMP Quick Modeが1往復半した後に、ESPパケットの通信が開始されている。

 これは vista ultimate 64bitバージョンで、Dynamipsを使って4台の7200をエミュレートしたものである。 

このとき、teratermのログを保存したのだが、そのファイルが見つからなくなった。 しかし、teratermでログを保存するメニューを出すと、ちゃんとファイルが表示される。 と、エクスプローラのメニューに「互換性ファイル」という文字が。 そこをクリックすると表示された。しかし今度は他のファイルが見えなくなる。 エクスプローラをいったん閉じて、再び開くと、またログファイル以外が見える。 この「互換性ファイル」問題は、bitcometを使ったときに出くわしたのだが、 いまだに意味がよくわからない。 まあ、スレ違いの話題なので、これについてはまたの機会に。