问题现象

某局点总部与多个分支MSR之间部署IPSec VPN野蛮模板方式,其中发现一个分支节点MSR与总部设备IPSec VPN建立失败。

原因分析

检查分支MSR设备IPSec VPN基本配置,未发现异常。其关键配置如下:

 
#
ipsec transform-set h3cnc
 esp encryption-algorithm 3des-cbc 
 esp authentication-algorithm md5 
#
ipsec policy h3cnc 65534 isakmp
 transform-set h3cnc 
 security acl 3000 
 remote-address 1.1.1.1
 ike-profile h3cnc
 sa duration time-based 28800
 sa duration traffic-based 1843200
#
 ike identity fqdn h3cnc
#
ike profile h3cnc
 keychain h3cnc
 exchange-mode aggressive
 local-identity fqdn h3cnc
 match remote identity fqdn sangfornc
 proposal 65534 
#
ike proposal 65534
 encryption-algorithm 3des-cbc
 dh group2
 authentication-algorithm md5
 sa duration 3600
#
ike keychain h3cnc
 pre-shared-key address 1.1.1.1 255.255.255.255 key cipher $c$3$ESr300c6AM1cd8EoQgB0BHvbkSdNL3A5XA==
#
interface GigabitEthernet0/0
 port link-mode route
 ip address 2.2.2.2 255.255.255.252
 nat outbound 3001
 ipsec apply policy h3cnc
#

检查分支基本配置无异常,在分支MSR设备上开启debug ike all,使用感兴趣流触发IPSec VPN建立,观察报文交互情况,其中:

 
*Jan  3 00:56:54:205 2011 Nanchuan IKE/7/EVENT: vrf = 0, local = 2.2.2.2, remote = 1.1.1.1/500
IKE SA state changed from IKE_P1_STATE_INIT to IKE_P1_STATE_SEND1.
*Jan  3 00:56:54:205 2011 Nanchuan IKE/7/PACKET: vrf = 0, local = 2.2.2.2, remote = 1.1.1.1/500
Sending packet to 1.1.1.1 remote port 500, local port 500.
*Jan  3 00:56:54:205 2011 Nanchuan IKE/7/PACKET: vrf = 0, local = 2.2.2.2, remote = 1.1.1.1/500
 
  I-Cookie: bc1fffc0402cd7dd
  R-Cookie: 0000000000000000
  next payload: SA
  version: ISAKMP Version 1.0
  exchange mode: Aggressive
  flags:  
  message ID: 0
  length: 380
*Jan  3 00:56:54:205 2011 Nanchuan IKE/7/PACKET: vrf = 0, local = 2.2.2.2, remote = 1.1.1.1/500
Sending an IPv4 packet.
*Jan  3 00:56:54:206 2011 Nanchuan IKE/7/EVENT: vrf = 0, local = 2.2.2.2, remote = 1.1.1.1/500
Sent data to socket successfully. //到这里ike协商报文已经成功发出去
Request time out
*Jan  3 00:56:56:361 2011 Nanchuan IPSEC/7/EVENT: 
Found block-flow node.
*Jan  3 00:56:56:361 2011 Nanchuan IPSEC/7/PACKET: 
Failed to find SA by SP, SP Index = 0, SP Convert-Seq = 4294836224.
*Jan  3 00:56:56:361 2011 Nanchuan IPSEC/7/ERROR: 
The reason of dropping packet is no available IPsec tunnel.
Request time out
*Jan  3 00:56:58:564 2011 Nanchuan IPSEC/7/EVENT: 
Found block-flow node.
*Jan  3 00:56:58:564 2011 Nanchuan IPSEC/7/PACKET: 
Failed to find SA by SP, SP Index = 0, SP Convert-Seq = 4294836224.
*Jan  3 00:56:58:564 2011 Nanchuan IPSEC/7/ERROR: 
The reason of dropping packet is no available IPsec tunnel.
*Jan  3 00:56:59:725 2011 Nanchuan IKE/7/PACKET: vrf = 0, local = 2.2.2.2, remote = 1.1.1.1/500
Retransmit phase 1 packet. //但是分支MSR没有收到总部的IKE回应报文
......

 

解决办法

由于分支MSR设备无法收到总部发来的IKE协商报文,因此联系ISP调整线路后,IPSec VPN建立成功,问题解决。

建议与总结

对于IPSec VPN建立失败的问题,可通过debug ike all方式检查报文协商过程。

案例信息

案例类型:经验案例
案例号:201803230018
创建时间:2018年3月23日
更新时间:2018年3月31日
发布时间:2018/3/31 17:56:33
文章密级:游客可见
有效期:长期有效
发布者:丁犁 [d08663]
点击次数:6020
评论平均得分:0
关键词:ike,超时,ipsec,vpn
产品线:中低端路由器
产品系列:MSR3600系列
产品版本:
故障类型:

常用操作
收藏