ipsec vpn

日志内容

Failed to establish phase 1 SA in [STRING] mode [STRING] state.

Reason: [STRING].

SA information:

·     Role: [STRING]

·     Local IP: [STRING]

·     Local ID type: [STRING]

·     Local ID: [STRING]

·     Local port: [UINT32]

·     Retransmissions: [UINT32]

·     Remote IP: [STRING]

·     Remote ID type: [STRING]

·     Remote ID: [STRING]

·     Remote port: [UINT32]

·     Recived retransmissions: [UINT32]

·     Inside VPN instance: [STRING]

·     Outside VPN instance: [STRING]

·     Initiator COOKIE: [STRING]

·     Responder COOKIE: [STRING]

·     Connection ID: [UINT32]

·     Tunnel ID: [UINT32]

·     IKE profile name: [STRING]

日志含义

IKE建立第一阶段SA协商失败

参数解释

$1：协商模式，主模式或者野蛮模式

$2：协商状态机状态

$3：失败原因：

·     认证对端签名失败，显示为：Failed to verify the peer signature

·     缺少HASH载荷，显示为：HASH payload is missing

·     认证对端HASH失败，显示为：Failed to verify the peer HASH. Local HASH is %s. Peer HASH is %s

·     缺少签名载荷，显示为：Signature payload is missing

·     从证书中获取摘要名称失败，显示为：Failed to get subject name from certificate

·     获取证书失败，显示为：Failed to get certificate

·     获取本地证书失败，显示为：Failed to get local certificate

·     获取私钥失败，显示为：Failed to get private key

·     认证对端证书失败，显示为：Failed to verify the peer certificate (%s)

·     从ID载荷中获取ID数据失败，显示为：Failed to get ID data for constructing ID payload

·     无效的ID载荷长度，显示为：Invalid ID payload length: %d

·     无效的ID载荷协议和端口号，显示为：Invalid ID payload with protocol %u and port %u

·     无效的ID类型，显示为：Invalid ID type (%u)

·     不支持的属性，显示为：Unsupported attribute %u

·     属性重复，显示为：Attribute %s is repeated

·     不支持的DOI，显示为：Unsupported DOI %s

·     不支持的DOI场景，显示为：Unsupported IPsec DOI situation (%u)

·     KE（KEY EXCHANGE）载荷不存在，显示为：KE payload is missing

·     无效的KE载荷长度，显示为：Invalid KE payload length (%lu)

·     无效的Nonce载荷长度，显示为：Invalid nonce payload length (%lu)

·     无可用的提议，显示为：No available proposal

·     解析证书请求载荷失败，显示为：Failed to parse the Cert Request payload

·     提议载荷必须为SA载荷中的最后一个载荷，但提议载荷后有载荷，显示为：The proposal payload must be the last payload in the SA payload, but it is found followed by the %s payload

·     提议载荷中出现非预期的协议ID，显示为：Unexpected protocol ID (%u) found in proposal payload

·     提议载荷中缺少变换载荷，显示为：No transform payload in proposal payload

·     变换载荷编号非递增，显示为：Transform number is not monotonically increasing

·     无效的变换载荷ID，显示为：Invalid transform ID (%s)

·     没有找到匹配的变换载荷，显示为：No acceptable transform

·     提议载荷中出现非预期的载荷，显示为：Unexpected %s payload in proposal

·     提议载荷中存在无效的SPI长度，显示为：Invalid SPI length (%d) in proposal payload

·     一个提议载荷中只能存在一个变换载荷，当前存在多个变换载荷，显示为：Only one transform is permitted in one proposal, but %u transforms are found

·     在profile下未找到匹配的提议，显示为：Failed to find matching proposal in profile %s

·     在profile下没有找到提议，显示为：Failed to find proposal %u in profile %s

·     在profile下没有找到keychain，显示为：Failed to find keychain %s in profile %s

·     重传超时，显示为：Retransmission timeout

·     配置错误，显示为：Incorrect configuration

·     构造证书请求载荷失败，显示为：Failed to construct certificate request payload

·     收到错误通知，显示为：An error notification is received

·     添加Tunnel失败，显示为：Failed to add tunnel

$4：建立IPsec SA的角色，发起者或者响应者

$5-$9：本端信息

$10-$14: 远端信息

$15: 内部VPN实例

$16: 外部VPN实例

$17-$18: 发起者COOKIE和响应者COOKIE

$19: 连接号

$20: IKE Tunnel编号，默认值为4294967295

$21: IKE profile名称

日志等级

6 (Informational)

举例

IKE/6/IKE_P1_SA_ESTABLISH_FAIL: Failed to establish phase 1 SA in main mode IKE_P1_STATE_SEND1 state.

Reason: Failed to get certificate.

SA information:

·     Role: Initiator

·     Local IP: 4.4.4.4

·     Local ID type: IPV4_ADDR

·     Local ID: 4.4.4.4

·     Local port: 500

·     Retransmissions: 0

·     Remote IP: 4.4.4.5

·     Remote ID type: IPV4_ADDR

·     Remote ID: 4.4.4.5

·     Remote port: 500

·     Recived retransmissions: 0

·     Inside VPN instance: aaa

·     Outside VPN instance : bbb

·     Initiator COOKIE: 4a42af47dbf0b2b1

·     Responder COOKIE: 8f8c1ff6645efbaf

·     Connection ID: 1

·     Tunnel ID: 1

·     IKE profile name: abc

对系统的影响

无法建立IKE SA

日志产生原因

·     两端的IKE安全提议参数、IKE认证算法不一致

·     两端的预共享密钥不一致

·     证书不可用或证书无效

·     物理链路状态不佳或对等体网络不可达

处理建议

·     检查两端的IKE安全提议参数、IKE认证算法是否一致，若不一致请修改为一致

·     检查两端的预共享密钥是否一致，若不一致请修改为一致

·     检查是否已获取证书，若已获取证书则检查证书是否在有效期内，若未获取证书或证书已失效请重新获取证书

·     检查物理链路状态和对等体网络是否可达，若物理链路状态不佳或对等体网络不可达请排查网络故障

执行以上检查后，若问题仍未解决，则请收集配置文件、日志信息和告警信息，并联系技术支持