问

W墙旁挂做IPSEC，ipsec sa协商不起来

IPSec VPN

2024-07-15提问

0关注
0收藏，463浏览

zhiliao_Q5d0ho

zhiliao_Q5d0ho 二段

粉丝：0人关注：1人

问题描述：

拓扑如上，现在是FW3旁挂SW4上和FW2做IPSEC，麻烦各位大佬帮忙看下为啥协商不起来，设备的配置我放在附件了。

附件下载：配置信息.zip

最佳答案

zhiliao_Q5d0ho

zhiliao_Q5d0ho 二段

粉丝：0人关注：1人

补充一点FW3的debug信息如下：<FW3>*Jul 15 10:20:04:061 2024 FW3 IPSEC/7/EVENT: -COntext=1;

Can't find block-flow node.
*Jul 15 10:20:04:062 2024 FW3 IPSEC/7/PACKET: -COntext=1;
Failed to find SA by SP, SP Index = 0, SP Convert-Seq = 65536.
*Jul 15 10:20:04:062 2024 FW3 IPSEC/7/ERROR: -COntext=1;
The reason of dropping packet is no available IPsec tunnel.
*Jul 15 10:20:04:062 2024 FW3 IPSEC/7/EVENT: -COntext=1;
Sent SA-Acquire message : SP ID = 0
*Jul 15 10:20:04:062 2024 FW3 IPSEC/7/EVENT: -COntext=1;
Received negotiate SA message from IPsec kernel.
*Jul 15 10:20:04:062 2024 FW3 IPSEC/7/EVENT: -COntext=1;
Got SA time-based soft lifetime settings when filling Sp data.
Configured soft lifetime buffer : 0 seconds.
Configured global soft lifetime buffer : 0 seconds.
*Jul 15 10:20:04:072 2024 FW3 IPSEC/7/EVENT: -COntext=1;
Sent delete SA message to Slot:1 Cpu:0, message type is 0x16.
*Jul 15 10:20:04:072 2024 FW3 IPSEC/7/EVENT: -COntext=1;
The SA doesn't exist in kernel.
*Jul 15 10:20:04:072 2024 FW3 IPSEC/7/EVENT: -COntext=1;
Switch remote address no change, SP index is 0.
*Jul 15 10:20:06:264 2024 FW3 IPSEC/7/EVENT: -COntext=1;
Can't find block-flow node.
*Jul 15 10:20:06:264 2024 FW3 IPSEC/7/PACKET: -COntext=1;
Failed to find SA by SP, SP Index = 0, SP Convert-Seq = 65536.
*Jul 15 10:20:06:264 2024 FW3 IPSEC/7/ERROR: -COntext=1;
The reason of dropping packet is no available IPsec tunnel.
*Jul 15 10:20:06:264 2024 FW3 IPSEC/7/EVENT: -COntext=1;
Sent SA-Acquire message : SP ID = 0
*Jul 15 10:20:06:264 2024 FW3 IPSEC/7/EVENT: -COntext=1;
Received negotiate SA message from IPsec kernel.
*Jul 15 10:20:06:264 2024 FW3 IPSEC/7/EVENT: -COntext=1;
Got SA time-based soft lifetime settings when filling Sp data.
Configured soft lifetime buffer : 0 seconds.
Configured global soft lifetime buffer : 0 seconds.
*Jul 15 10:20:06:265 2024 FW3 IPSEC/7/EVENT: -COntext=1;
Sent delete SA message to Slot:1 Cpu:0, message type is 0x16.
*Jul 15 10:20:06:265 2024 FW3 IPSEC/7/EVENT: -COntext=1;
The SA doesn't exist in kernel.
*Jul 15 10:20:06:265 2024 FW3 IPSEC/7/EVENT: -COntext=1;
Switch remote address no change, SP index is 0.
*Jul 15 10:20:08:466 2024 FW3 IPSEC/7/EVENT: -COntext=1;
Can't find block-flow node.
*Jul 15 10:20:08:466 2024 FW3 IPSEC/7/PACKET: -COntext=1;
Failed to find SA by SP, SP Index = 0, SP Convert-Seq = 65536.
*Jul 15 10:20:08:466 2024 FW3 IPSEC/7/ERROR: -COntext=1;
The reason of dropping packet is no available IPsec tunnel.
*Jul 15 10:20:08:466 2024 FW3 IPSEC/7/EVENT: -COntext=1;
Sent SA-Acquire message : SP ID = 0
*Jul 15 10:20:08:466 2024 FW3 IPSEC/7/EVENT: -COntext=1;
Received negotiate SA message from IPsec kernel.
*Jul 15 10:20:08:466 2024 FW3 IPSEC/7/EVENT: -COntext=1;
Got SA time-based soft lifetime settings when filling Sp data.
Configured soft lifetime buffer : 0 seconds.
Configured global soft lifetime buffer : 0 seconds.
*Jul 15 10:20:08:467 2024 FW3 IPSEC/7/EVENT: -COntext=1;
Sent delete SA message to Slot:1 Cpu:0, message type is 0x16.
*Jul 15 10:20:08:467 2024 FW3 IPSEC/7/EVENT: -COntext=1;
The SA doesn't exist in kernel.
*Jul 15 10:20:08:467 2024 FW3 IPSEC/7/EVENT: -COntext=1;
Switch remote address no change, SP index is 0.
*Jul 15 10:20:10:668 2024 FW3 IPSEC/7/EVENT: -COntext=1;
Can't find block-flow node.
*Jul 15 10:20:10:668 2024 FW3 IPSEC/7/PACKET: -COntext=1;
Failed to find SA by SP, SP Index = 0, SP Convert-Seq = 65536.
*Jul 15 10:20:10:668 2024 FW3 IPSEC/7/ERROR: -COntext=1;
The reason of dropping packet is no available IPsec tunnel.
*Jul 15 10:20:10:668 2024 FW3 IPSEC/7/EVENT: -COntext=1;
Sent SA-Acquire message : SP ID = 0
*Jul 15 10:20:10:668 2024 FW3 IPSEC/7/EVENT: -COntext=1;
Received negotiate SA message from IPsec kernel.
*Jul 15 10:20:10:668 2024 FW3 IPSEC/7/EVENT: -COntext=1;
Got SA time-based soft lifetime settings when filling Sp data.
Configured soft lifetime buffer : 0 seconds.
Configured global soft lifetime buffer : 0 seconds.
*Jul 15 10:20:10:669 2024 FW3 IPSEC/7/EVENT: -COntext=1;
Sent delete SA message to Slot:1 Cpu:0, message type is 0x16.
*Jul 15 10:20:10:670 2024 FW3 IPSEC/7/EVENT: -COntext=1;
The SA doesn't exist in kernel.
*Jul 15 10:20:10:670 2024 FW3 IPSEC/7/EVENT: -COntext=1;
Switch remote address no change, SP index is 0.
undo t d
The current terminal is disabled to display debugging logs.