问

IPSec debugging信息

IPSec VPN

2023-11-07提问

0关注
1收藏，917浏览

珍珠奶茶

珍珠奶茶四段

粉丝：0人关注：4人

问题描述：

想了解下IPSec的 debugging 信息的资料

想了解debugging ipsec的时候，回显信息代表什么意思，该怎样利用debugging信息进行ipsec的排障，想获取这方面的文档

希望自己研究一下，希望知道这些资料的前辈可以给出资料的文档路径

组网及组网描述：

最佳答案

TTTTTTTTT

TTTTTTTTT 四段

粉丝：1人关注：0人

求H3C V7版本IPSEC DEBUG信息详解 - 知了社区

暂无评论

1 个回答

按时间按赞数

zhiliao_sEUyB

zhiliao_sEUyB 九段

粉丝：237人关注：8人

参考

debugging ipsec命令用来打开IPsec调试信息开关。undo debugging ipsec命令用来关闭IPsec调试信息开关。

缺省情况下，IPsec的调试信息开关处于关闭状态。

表1-1 debugging ipsec error命令输出信息描述表

字段	描述
Failed to allocate memory.	分配内存失败
Failed to set an IPv6 header variable to 0.	将IPv6头可变部分置零时出错
Failed to add SP entry in kernel.	向内核添加SP（Security Policy，安全策略） entry失败
Failed to find SP entry in kernel.	在内核中查找SP entry失败
The SP doesn't exist in kernel.	内核中不存在SP
The IPsec tunnel doesn't exist in kernel.	内核中不存在IPsec隧道
The DPD doesn't exist in kernel.	内核中不存在DPD（Dead Peer Detection，对等体存活检测）
Failed to require CCFJOB structure.	申请CCF JOB结构失败
Failed to encrypt CCF.	CCF加密失败
The SA doesn't exist.	SA不存在
Failed to decrypt CCF.	CCF解密失败
Failed to create CCF session.	创建CCF session失败
The packet hash values don’t match.	解封装后的报文哈希值不匹配
No SA in IPsec tunnel.	IPsec隧道中没有SA
Can't find next SA in AH-ESP mode.	AH-ESP模式下，下一个SA找不到
IPsec tunnel has been deleted or updated when fast forwarding is performed.	快转时IPsec隧道已经被删除或更新
Packet should have been encrypted by IPsec.	报文本应该被IPsec保护
SA has been deleted or updated when fast forwarding is performed.	快转时SA已经被删除或更新
In transport mode, SA address doesn’t match packet address.	传输模式下，报文中的地址与SA中的不一致
The packet is too big: size = size.	报文过大，报文大小为size
Failed to add outer IP header.	添加外部IP头失败
The packet is not an IPsec packet.	非IPsec报文
Can't find SP.	找不到SP
Can't find SA by SP.	根据SP查找不到对应的SA
Failed to add node to invalid SPI hash table.	向无效SPI哈希表添加节点失败
Failed to add SA to IPsec tunnel.	向IPsec隧道添加SA失败
Failed to connect to the IPsec daemon.	连接IPsec用户态守护进程失败
The block-flow-table doesn't exist.	阻流表不存在
The ACL mode is wrong.	ACL模式错误
Received replayed packet.	收到了重放包
Can’t find SA when processing ICMP too big packet: SPI = spi.	在处理ICMP过大报文过程中找不到SA，SPI值为spi
No SA in IPsec tunnel.	IPsec隧道没有任何SA
Invalid IPsec profile index.	无效的IPsec profile索引
Failed to get IPsec profile name.	获取IPsec profile名称失败
After decryption, source address check failed.	解封装后源地址检查失败
Failed to create lipc socket.	创建lipc socket失败
The SP already exists.	SP已经存在
Failed to add SP in kernel.	向内核添加SP失败
Failed to add profile SP in kernel	向内核添加profile SP失败
Failed to add SA in kernel.	向内核添加SA失败
Failed to delete SA in kernel.	删除内核中的SA失败
Failed to add IPsec tunnel in kernel.	向内核添加IPsec隧道失败
Failed to delete tunnel in kernel.	删除内核中的IPsec隧道失败
Failed to add DPD in kernel.	向内核添加DPD失败
Failed to delete DPD in kernel.	删除内核中的DPD失败
The SP entry doesn't exist in kernel.	内核SP entry不存在
Number of SAs exceeded the limit.	SA数量超过最大值
Failed to create IPsec IF-CB.	创建IPsec接口控制块失败
Failed to set IPsec IF-CB to interface (ifIndex = ifindex)	向接口上设置IPsec接口控制块失败，其接口索引为ifindex
Failed to change the aging timer for block-flow-table.	修改阻流表的老化时间失败
Failed to create policy/template.	由命令行创建策略/模板失败
Failed to create policy/template group.	由命令行创建策略组/模板组失败
Failed to initialize policy hash table.	策略哈希表初始化失败
Failed to recover policy/template.	恢复策略/模板失败
Failed to recover policy/template group.	恢复策略组/模板组失败
Failed to recover transform reference.	恢复提议的引用关系失败
Failed to save policy/template/profile info to DBM.	向DBM中保存策略/模板/profile信息失败
Failed to delete policy/template/profile info from DBM.	从DBM中删除策略/模板/profile信息失败
Failed to save system configuration to DBM.	向DBM中保存系统配置失败
Failed to save transform configuration to DBM.	向DBM中保存提议配置失败
Failed to get system configuration from DBM.	从DBM中读取系统配置失败
Failed to save source interface configuration to DBM.	向DBM中保存源接口配置失败
Failed to save interface configuration to DBM.	向DBM中保存接口配置失败
Failed to get interface name by ifIndex.	通过接口索引获取接口名称失败
Failed to start IPsec daemon.	启动IPsec进程失败
Failed to alloc SP index.	分配SP索引失败
Failed to malloc SP.	分配SP资源失败
Failed to malloc SP entry.	分配SP entry资源失败
Failed to update kernel SP entry.	更新内核的SP entry失败
Failed to find SP entry.	查找SP entry 失败
Failed to add SP to array.	将SP加入数组失败
Failed to find template group.	查找模板组失败
Failed to add policy SP to kernel	向内核添加policy SP失败
Failed to find policy SP.	查找policy SP失败
Failed to add profile SP to kernel.	向内核添加profile SP失败
Failed to get SP when filling ISAKMP SA data.	填充ISAKMP SA数据时获取SP失败
Failed to get DPD when filling ISAKMP SA data.	填充ISAKMP SA数据时获取DPD失败
Failed to add IPsec tunnel when adding manual SA.	添加手工SA时添加IPsec隧道失败
Failed to add IPsec tunnel during ISSU update process.	进行ISSU升级时，添加IPsec隧道失败
Failed to add SA when adding manual SA.	添加手工SA时添加SA失败
Failed to fill SA when adding ISAKMP SA.	添加ISAKMP方式SA时填充SA失败
Failed to add IPsec tunnel when adding ISAKMP SA.	添加ISAKMP方式SA时添加IPsec隧道失败
Failed to add timer when adding ISAKMP SA.	添加ISAKMP方式SA时添加定时器失败
Failed to alloc SPI.	分配SPI失败
Failed to alloc new SPI for ISAKMP SA.	分配ISAKMP方式SA的新SPI失败
Failed to alloc larva SA index when adding larva SA.	添加临时SA时分配临时SA索引失败
Failed to add larval SA.	添加临时SA失败
Failed to alloc SA index.	分配SA索引失败
Failed to alloc ISAKMP SA index.	分配ISAKMP方式SA的索引失败
Failed to alloc manual SA index.	分配手工方式SA的索引失败
Failed to add SA.	添加SA失败
Failed to add SA to kernel.	向内核添加SA失败
Failed to add SA to kernel during ISSU update process.	当进行ISSU升级时向内核添加SA失败
Failed to alloc DPD Index.	分配DPD索引失败
Failed to add DPD timer.	添加DPD定时器失败
Failed to add DPD to kernel.	向内核添加DPD失败
Failed to add DPD timer during smooth processing with IKE.	和IKE进行平滑处理时添加DPD定时器失败
Failed to add DPD to kernel during smooth processing with IKE.	和IKE进行平滑处理时向内核添加DPD数据失败
The same outbound profile SA has existed. SPI: spi Protocol: protocol.	已存在相同的出方向profile SA（IPsec profile生成的SA）。SPI值为spi，协议类型为protocol
The same outbound policy SA has existed. SPI: spi, Remote address: remote-addr, Protocol: protocol.	已存在相同出方向的policy SA（IPsec policy生成的SA）。SPI值为SPI，对端地址为remote-addr，协议类型为protocol
Failed to generate static route.	新建IPsec隧道时，生成路由信息失败
Failed to add static route.	新建IPsec隧道时，路由模块添加静态路由失败
Failed to delete static route.	删除IPsec隧道时，路由模块删除静态路由失败
Failed to notify route module of starting to smooth IPv4 static routes.	和路由模块平滑路由过程中通知路由模块开始平滑IPv4路由，通知失败
Failed to notify route module of starting to smooth IPv6 static routes.	和路由模块平滑路由过程中通知路由模块开始平滑IPv6路由，通知失败
Failed to subscribe service events.	订阅服务事件失败

表1-2 debugging ipsec event命令输出信息描述表

字段	描述
The IPsec IF-CB(ifIndex = ifindex) will be deleted in kernel.	内核中的IPsec的接口控制快（接口序号为ifindex）将要被删除掉
Can't find block-flow-table.	找不到阻流表
Can't find an IPsec tunnel to match the flow.	找不到匹配流的IPsec隧道
IPsec daemon successfully connected.	成功连接到IPsec用户态守护进程
IPsec daemon disconnected.	与用户态守护进程失去连接
Sent SA-Acquire message: SP ID = ID.	发送SA协商请求，对应SP的ID为ID
Sent SA-Expire message: SP ID = SPID, tunnel ID = TNLID.	发送SA重协商请求，对应SP的ID为SPID，Tunnel ID为TNLID
Sent Invalid-SPI message: SPI = spi.	发送Invalid-SPI消息， SPI值为spi
Sent DPD-Request message: DPD ID = DPDID	发送DPD探测请求消息， DPD ID为DPDID
Updated outbound SA of IPsec tunnel: SA ID = saindex.	更新IPsec隧道出方向的SA，SA序号为saindex
Received an interface event message for interface interface-type interface-num, event: event.	收到响应接口事件消息，接口名称为interface-type interface-num，接口事件为event
Received interface network layer event message.	收到响应接口网络层事件消息
Received an event message for slot slot-id, event: event.	收到响应接口板事件消息，板号为slot-number，消息类型为event
Received an ACL message for ACL acl-number, event: event.	收到ACL消息，ACL编号为acl-number，消息类型为event
Received an address message for interface interface-type interface-num, event: event.	收到地址消息，接口名称为interface-type interface-num，消息类型为event
Sent notify message to kernel: slot slot-id, event: event.	发送notify消息给内核，板号为slot-number，消息类型为event
Sent msg to kernel.	向内核发送消息msg，msg是消息类型，包括以下几种： · add SP entry：添加SP entry · update SP entry：更新SP entry · delete SP entry：删除SP entry · add source-if SP entry：添加源接口SP entry · delete source-if SP entry：删除源接口SP entry · add SP：添加SP · update SP：更新SP · delete SP：删除SP · add profile SP：添加profile SP · delete profile SP：删除profile SP · update profile SP：更新profile SP
Added SA to kernel successfully .	向内核添加SA成功
SA successfully added in kernel.	内核添加SA成功
SA successfully deleted in kernel.	删除内核中的SA成功
Added outbound SA to IPsec tunnel(SA ID = sa-index)	向IPsec隧道添加出方向SA(SA索引为sa-index)
Added tunnel to kernel successfully.	向内核添加IPsec隧道成功
IPsec tunnel successfully added in kernel.	内核添加IPsec隧道成功
IPsec tunnel successfully deleted in kernel.	删除内核中的IPsec隧道成功
IPsec tunnel successfully added to list.	向链表添加IPsec隧道成功
IPsec tunnel added to aggregation-hash	向聚合哈希表中添加IPsec隧道成功
Added SP entry.	添加SP entry
Added SP by policy.	根据策略添加SP
SP entry successfully added in kernel.	内核成功添加SP entry
SP successfully added in kernel.	内核成功添加SP
Added policy SA by manual SP, SP index: index, SP sequence number: sp-seq.	成功根据手工SP添加策略SA，SP索引为sp-index，SP序号为sp-seq
Successfully added an IPsec tunnel during ISSU update process.	在ISSU升级时成功添加IPsec隧道
Added an IPsec tunnel when adding manual SA: tunnel index = tunnel-id, tunnel sequence number = tunnel_seq.	添加手工SA过程中成功添加IPsec隧道。IPsec隧道索引是tunnel-id，IPsec隧道序号是tunnel_seq
Added manual SAs. Number of SAs added is number.	成功添加手工SA。添加的SA的个数number
No. ordinal-number SA: index = sa-id, sequence number = sa-seq.	第ordinal-number个SA的索引是sa-id，SA的序列号是sa-seq
Added SA context to SP.	成功向SP中添加SA内容
Added an IPsec tunnel when adding ISAKMP SA: tunnel index = tunnel-id, tunnel sequence number = tunnel_seq.	添加ISAKMP方式SA过程中成功添加IPsec隧道。IPsec隧道索引是tunnel-id，IPsec隧道序号是tunnel_seq
Added ISAKMP SAs. Number of SAs added is number. No. ordinal-number SA: index = sa-id, sequence number = sa-seq.	成功添加ISAKMP方式SA。添加的SA的个数number，第ordinal-number个的SA索引是sa-id，SA序号是sa-seq
Added SA context to IKE.	向IKE发送SA内容
Timer successfully added when adding ISAKMP SA.	添加ISAKMP方式SA时添加定时器成功
Started to smoothly process SA with IKE.	开始和IKE进行平滑SA
Finished smooth processing SA with IKE.	结束和IKE平滑SA
Started to smoothly process IPsec tunnel with IKE.	开始和IKE进行平滑IPsec隧道
Finished smooth processing IPsec tunnel with IKE.	结束和IKE平滑IPsec隧道
Started to smoothly process DPD with IKE.	开始和IKE进行平滑DPD
Finished smooth processing DPD with IKE.	结束和IKE平滑DPD
Sent msg message to slot:slot-id, message type is type-id.	向slot-id号接口板发送msg消息，消息ID是type-id 消息类型和其对应的类型ID如下： · debug：调试，类型ID为3 · anti-replay check：抗重放检查，类型ID为4 · decryption check：解封装后检查，类型ID为5 · log switch：log开关，类型ID为6 · idle：空闲，类型ID为7 · global df-bit：全局df-bit设置，类型ID为8 · df-bit：接口df-bit设置，类型ID为9 · all global configuration：所有全局配置，类型ID为10 · add SP entry：添加SP entry，类型ID为11 · update SP entry：更新SP entry，类型ID为12 · delete SP entry：删除SP entry/类型ID为13 · add SP：添加SP/类型ID为14 · update SP：更新SP/类型ID为15 · delete SP：删除SP/类型ID为16 · add profile SP：添加profile SP，类型ID为17 · update profile SP：更新profile SP，类型ID为18 · delete profile SP：删除profile SP，类型ID为19 · add tunnel：添加tunnel，类型ID为20 · delete tunnel：删除tunnel，类型ID为21 · add SA：添加SA，类型ID为22 · delete SA：删除SA，类型ID为23 · update MTU：更新MTU，类型ID为24 · switch SA：切换SA，类型ID为25 · delete block-flow table：删除阻流表/类型ID为26 · add DPD：添加DPD/类型ID为27 · update DPD：更新DPD，类型ID为28 · delete DPD：删除DPD，类型ID为29 · update DPD index of SA：更新SA的DPD索引，类型ID为30 · reset statistics：重置统计计数，类型ID为31 · idle report：idle报告，类型ID为32 · smooth start：平滑开始，类型ID为32 · smooth end：平滑结束，类型ID为34
Adding route: Dest/Mask: ip-address/mask-length, Next hop: ip-address , Source vpn instance: vpn-name, Destination vpn instance: vpn-name, Tag: tag-value, Preference: preference-num	新建IPsec隧道时，即将添加一条静态路由信息 · Dest/Mask：目的IP地址/掩码长度 · Next hop：下一跳IP地址 · Source vpn instance：路由目的地址所属的VPN · Destination vpn instance：路由下一跳地址所属的VPN · Tag：路由标记 · Preference：路由优先级
Deleting route: Dest/Mask: ip-address/mask-length, Next hop: ip-address, Source vpn instance: vpn-name, Destination vpn instance: vpn-name, Tag: tag-value, Preference: preference-num	删除IPsec隧道时，即将删除一条静态路由信息
Successfully added a static route.	新建IPsec隧道时，路由模块添加静态路由成功
Only increased the reference count of the static route but didn't add it.	新建IPsec隧道时，发现已经向路由模块添加过相同的静态路由，则不再通知路由模块添加此路由仅增加该路由的引用计数
Successfully deleted a static route.	删除IPsec隧道时，路由模块删除静态路由成功
Only reduced the reference count of the static route but didn't delete it.	删除IPsec隧道时，发现两个以上IPsec隧道对应同一条静态路由，则不通知路由模块删除该静态路由仅减少该路由的引用计数
Started to smoothly process the IPv4 static routes.	开始对IPv4静态路由进行平滑处理
Started to smoothly process the IPv6 static routes.	开始对IPv6静态路由进行平滑处理
Finished smooth processing of the IPv4 static routes.	结束对IPv4静态路由的平滑处理
Finished smooth processing of the IPv6 static routes.	结束对IPv6静态路由的平滑处理
Successfully subscribed service events.	成功订阅所有的服务事件
Received a service event: the status of IPv4 route service is up.	接收到一个IPv4路由服务up事件
Received a service event: the status of IPv4route service is down.	接收到一个IPv4路由服务down事件
Received a service event: the status of IPv6 route service is up.	接收到一个IPv6路由服务up事件
Received a service event: the status of IPv6 route service is down.	接收到一个IPv6路由服务down事件

表1-3 debugging ipsec packet命令输出信息描述表

字段	描述
Packet will be sent to CCF for sync-encryption.	报文将被发送到CCF执行同步加密操作
Packet will be sent to CCF for sync-decryption	报文将被发送到CCF执行同步解密操作
Packet will be sent to CCF for asyn-encryption.	报文将被发送到CCF执行异步加密操作
Packet will be sent to CCF for asyn-decryption.	报文将被发送到CCF执行异步解密操作
Found SA with SPI spi.	已经找到SPI为spi的SA
Packet matches SP spid.	报文匹配SP，SP ID为spid.
Packet has been encrypted by SA whose SPI is spi.	报文已经被SPI为spi的SA加密
Packet has been decrypted by SA whose SPI is spi.	报文已经被SPI为spi的SA解密
ESP auth algorithm: auth, ESP encp algorithm: encp.	ESP采用的认证算法为auth，加密算法为encp
AH auth algorithm: auth	AH采用的认证算法为auth
Src : src Dst : dst SPI : spi	报文的源地址为，目的地址为，SPI值为spi
Received IPsec(AH) packet	入方向收到AH报文
Received IPsec(ESP) packet	入方向收到ESP报文
Received IPSec packet from fast forwarding	快转入方向收到IPsec报文
Sent routing protocol packet by IPsec	路由协议报文经由IPsec发送
Sent IPsec packet	报文经由IPsec发送
Sent packet by IPsec fast forwarding	报文经由IPsec快转发送
Added IP fast forwarding entry.	添加快转表项
Added IPv6 fast forwarding entry.	添加IPv6快转表项
Failed to find SA by SP.	根据SP找不到对应的SA
The packet is too big, mtu = mtu, packet len = len.	报文过大，MTU值为mtu，长度为len
The reason of dropping packet is reason.	报文被丢弃的原因为reason，包括以下几种： · Packet too long：报文太长 · Invalid SPI：无效SPI · No available SA：找不到SA · No available IPsec tunnel：找不到IPsec隧道 · Encryption failed：加密失败 · Decryption failed：解密失败 · Loop too many times：本机循环次数过多 · ACL check failed：ACL检查失败 · Address does not match with SA：报文地址与SA中的地址不匹配 · Anti-replay sequence number reached the max：抗重放序号达到最大值 · The encapsulation mode does not match：封装类型不匹配 · Receive a ESP dummy packet：收到ESP保活报文 · Memory alloc failed：内存分配失败 · Packet length wrong：长度长度错误 · Replayed packet：重放报文 · Authentication failed：认证失败 · Security protocol set of SA does not match：SA的安全协议组合与对端不匹配
Inbound IPsec AH processing: Authentication succeeded.	入方向IPsec AH处理：认证成功
Outbound IPsec AH processing: Authentication finished, anti-replay SN is sn .	出方向IPsec AH处理：认证完成，抗重放序号为sn
Inbound IPsec ESP processing: Decryption succeeded.	入方向IPsec ESP处理：解密成功
Outbound IPsec ESP processing: Encryption succeeded, anti-replay SN is sn.	出方向IPsec ESP处理：加密成功，抗重放序号为sn
Outbound IPsec processing: Sent packet back to IP forwarding.	出方向IPsec处理：将报文重新发送给IP转发
Inbound IPsec processing: Sent packet back to IP forwarding.	入方向IPsec处理：将报文重新发送给IP转发
Outbound IPsec processing: Sent packet back to IP forwarding for following process.	出方向IPsec处理：将报文返回转发继续处理后续业务
IPsec processing: Tunnel mode	采用隧道模式
IPsec processing: Transport mode	采用传输模式

【举例】

# 设备上已存在满配的SP，配置手工方式的IPsec安全策略mypolicy，并打开IPsec错误调试信息开关。当将策略mypolicy应用于接口GigabitEthernet1/0/1上的时候，输出如下IPsec错误调试信息。

<Sysname> debugging ipsec error

<Sysname> system-view

[Sysname] interface gigabitethernet 1/0/1

[Sysname-GigabitEthernet1/0/1] ipsec policy mypolicy

*Jul 14 16:45:16:157 2012 Sysname IPSEC/7/ERROR: -MDC=1;

Failed to alloc SP index.

// 分配SP索引失败

# 在设备上配置手工方式的IPsec安全策略mypolicy，并打开IPsec事件调试开关。当将策略mypolicy应用于接口GigabitEthernet1/0/1上时，会生成SP和SA，输出如下IPsec事件调试信息。

<Sysname> debugging ipsec event

*Jul 18 15:28:55:020 2012 Sysname IPSEC/7/event:

SP entry successfully added in kernel.

// 内核成功添加SP entry

*Jul 18 15:28:55:020 2012 Sysname IPSEC/7/ERROR:

Sent add SP entry message to kernel.

// 向内核发送添加SP entry的消息

*Jul 18 15:28:55:020 2012 Sysname IPSEC/7/ERROR:

Added SP entry.

// 添加SP entry

*Jul 18 15:28:55:022 2012 Sysname IPSEC/7/event:

SP successfully added in kernel.

// 内核成功添加SP

*Jul 18 15:28:55:022 2012 Sysname IPSEC/7/ERROR:

Sent add SP message to kernel.

// 向内核发送添加SP的消息

*Jul 18 15:28:55:023 2012 Sysname IPSEC/7/ERROR:

Added SP by policy.

// 根据策略添加SP

*Jul 18 15:28:55:024 2012 Sysname IPSEC/7/ERROR:

Added policy SA by manual SP, SP index is 0, SP sequence number is 2.

// 成功根据手工SP添加策略SA，SP索引为0，SP序号为2

*Jul 18 15:28:55:026 2012 Sysname IPSEC/7/event:

IPsec tunnel added to aggregation-hash.

// 向聚合哈希表中添加IPsec隧道成功

*Jul 18 15:28:55:026 2012 Sysname IPSEC/7/event:

IPsec tunnel successfully added in kernel.

// 内核添加IPsec隧道成功

*Jul 18 15:28:55:026 2012 Sysname IPSEC/7/ERROR:

Added tunnel to kernel successfully.

// 向内核添加IPsec隧道成功

*Jul 18 15:28:55:026 2012 HP IPSEC/7/ERROR:

Added an IPsec tunnel when adding manual SA: tunnel index = 0, tunnel sequence number = 2.

// 添加手工SA过程中添加IPsec隧道，隧道索引为0，隧道序号为2

*Jul 18 15:28:55:027 2012 Sysname IPSEC/7/event:

SA succussfully added in kernel.

// 内核成功添加SA

*Jul 18 15:28:55:027 2012 Sysname IPSEC/7/event:

SA succussfully added in kernel.

// 内核成功添加SA

*Jul 18 15:28:55:027 2012 Sysname IPSEC/7/event:

Added outbound SA to IPsec tunnel(SA ID = 1).

// 成功向IPsec隧道添加出方向SA（SA索引为1）

*Jul 18 15:28:55:027 2012 Sysname IPSEC/7/event:

SA succussfully added in kernel.

// 内核成功添加SA

*Jul 18 15:28:55:027 2012 Sysname IPSEC/7/event:

SA succussfully added in kernel.

// 内核成功添加SA

*Jul 18 15:28:55:027 2012 Sysname IPSEC/7/ERROR:

Added SA to kernel successfully.

// 成功向内核添加SA

*Jul 18 15:28:55:027 2012 Sysname IPSEC/7/ERROR:

Added manual SAs. Number of SAs added is 4.

// 成功添加手工SA，SA的个数为4

*Jul 18 15:28:55:027 2012 Sysname IPSEC/7/ERROR:

No.1 SA: index = 3, sequence number = 2.

*Jul 18 15:28:55:028 2012 Sysname IPSEC/7/ERROR:

No.2 SA: index = 2, sequence number = 2.

*Jul 18 15:28:55:028 2012 Sysname IPSEC/7/ERROR:

No.3 SA: index = 1, sequence number = 2.

*Jul 18 15:28:55:028 2012 Sysname IPSEC/7/ERROR:

No.4 SA: index = 0, sequence number = 2.

// 第一个SA的索引为3，SA的序号为2

// 第二个SA的索引为2，SA的序号为2

// 第三个SA的索引为1，SA的序号为2

// 第四个SA的索引为0，SA的序号为2

*Jul 18 15:28:55:029 2012 Sysname IPSEC/7/ERROR:

Added SA context to SP.

// 成功向SP添加SA上下文

# 在设备上配置手工方式的IPsec安全策略，应用于接口GigabitEthernet1/0/1上，并打开IPsec的报文调试信息开关。当从本机ping对端的时候，输出如下IPsec报文调试信息。

<Sysname> debugging ipsec packet

<Sysname> ping -c 1 10.10.10.2

PING 10.10.10.2 (10.10.10.2): 56 data bytes, press CTRL_C to break

*Jul 14 16:55:10:211 2012 Sysname IPSEC/7/packet: -MDC=1-Slot=1;

--- Sent IPsec packet ---

// 出方向发送IPsec处理的报文

*Jul 14 16:55:10:211 2012 Sysname IPSEC/7/packet: -MDC=1-Slot=1;

Added IP fast forwarding entry.

// 添加快转表项

*Jul 14 16:55:10:211 2012 Sysname IPSEC/7/packet: -MDC=1-Slot=1;

Outbound IPsec processing: Src : 10.10.10.1 Dst : 10.10.10.2 SPI : 1114

// 出方向IPsec处理：源地址：10.10.10.1，目的地址：10.10.10.2，SPI: 1114

*Jul 14 16:55:10:211 2012 Sysname IPSEC/7/packet: -MDC=1-Slot=1;

Outbound IPsec processing: ESP auth algorithm: SHA1, ESP encp algorithm: DES-CBC.

// 出方向IPsec处理：ESP认证算法为SHA1，ESP加密算法为DES-CBC

*Jul 14 16:55:10:211 2012 Sysname IPSEC/7/packet: -MDC=1-Slot=1;

Packet will be sent to CCF for sync-encryption.

// 报文将被发送到CCF执行同步加密操作

*Jul 14 16:55:10:211 2012 Sysname IPSEC/7/packet: -MDC=1-Slot=1;

Outbound IPsec ESP processing: Encryption succeeded, anti-replay SN is 0.

// 出方向IPsec ESP处理：加密完成，抗重放序号为0

*Jul 14 16:55:10:211 2012 Sysname IPSEC/7/packet: -MDC=1-Slot=1;

Outbound IPsec processing: AH auth algorithm: MD5.

// 出方向IPsec处理：AH认证算法为MD5

*Jul 14 16:55:10:211 2012 Sysname IPSEC/7/packet: -MDC=1-Slot=1;

Packet will be sent to CCF for sync-encryption.

// 报文将被发送到CCF执行同步加密操作

*Jul 14 16:55:10:211 2012 Sysname IPSEC/7/packet: -MDC=1-Slot=1;

Outbound IPsec AH processing: Authentication finished, anti-replay SN is 0.

// 出方向IPsec AH处理：认证完成，抗重放序号为0

*Jul 14 16:55:10:211 2012 Sysname IPSEC/7/packet: -MDC=1-Slot=1;

Outbound IPsec processing: Sent packet back to IP forwarding.

// 出方向IPsec处理：将报文重新发送给IP转发

暂无评论

编辑答案

分享扩散:

➤

网站相关: 关于我们; 服务条款; 帮助中心; 经验与权限; 积分规则

联系我们: 联系我们; 建议反馈

常用链接: 标杆的神器下载

关注我们: H3C官网; 新华三服务公众号; 安仔远程运维服务; 新华三商城

内容许可: 除特别说明外，用户内容均可采用知识共享署名-相同方式共享3.0中国大陆许可协议进行许可

本图标版权归新华三集团所有，仅限本社区使用，切勿用做商业目的，违者必究

浙ICP备09064986号-1 浙公网安备 33010802004416号

✖

亲~登录后才可以操作哦!

确定

✖

亲~检测到您登陆的账号未在http://hclhub.h3c.com进行注册

注册后可访问此模块

跳转hclhub

✖

你的邮箱还未认证，请认证邮箱或绑定手机后进行当前操作

✖

侵犯我的权益 >

对根叔社区有害的内容 >

辱骂、歧视、挑衅等（不友善）

侵犯我的权益

泄露了我的隐私 >

侵犯了我企业的权益 >

抄袭了我的内容 >

诽谤我 >

辱骂、歧视、挑衅等（不友善）

骚扰我

泄露了我的隐私

您好，当您发现根叔知了上有泄漏您隐私的内容时，您可以向根叔知了进行举报。请您把以下内容通过邮件发送到pub.zhiliao@h3c.com 邮箱，我们会尽快处理。

1. 您认为哪些内容泄露了您的隐私？（请在邮件中列出您举报的内容、链接地址，并给出简短的说明）
2. 您是谁？（身份证明材料，可以是身份证或护照等证件）

侵犯了我企业的权益

您好，当您发现根叔知了上有关于您企业的造谣与诽谤、商业侵权等内容时，您可以向根叔知了进行举报。请您把以下内容通过邮件发送到 pub.zhiliao@h3c.com 邮箱，我们会在审核后尽快给您答复。

1. 您举报的内容是什么？（请在邮件中列出您举报的内容和链接地址）
2. 您是谁？（身份证明材料，可以是身份证或护照等证件）
3. 是哪家企业？（营业执照，单位登记证明等证件）
4. 您与该企业的关系是？（您是企业法人或被授权人，需提供企业委托授权书）

我们认为知名企业应该坦然接受公众讨论，对于答案中不准确的部分，我们欢迎您以正式或非正式身份在根叔知了上进行澄清。

抄袭了我的内容

原文链接或出处

诽谤我

您好，当您发现根叔知了上有诽谤您的内容时，您可以向根叔知了进行举报。请您把以下内容通过邮件发送到pub.zhiliao@h3c.com 邮箱，我们会尽快处理。

1. 您举报的内容以及侵犯了您什么权益？（请在邮件中列出您举报的内容、链接地址，并给出简短的说明）
2. 您是谁？（身份证明材料，可以是身份证或护照等证件）

我们认为知名企业应该坦然接受公众讨论，对于答案中不准确的部分，我们欢迎您以正式或非正式身份在根叔知了上进行澄清。

对根叔社区有害的内容

垃圾广告信息

色情、暴力、血腥等违反法律法规的内容

政治敏感

不规范转载 >

辱骂、歧视、挑衅等（不友善）

骚扰我

诱导投票

不规范转载

举报说明

产品线		搜索取消
案例类型
发布者
是否解决
是否官方
时间
搜索引擎
匹配模式	默认策略匹配全词匹配整句

IPSec debugging信息

问题描述：

组网及组网描述：

编辑答案

提出建议