ipsecvpn二阶段失败
- 0关注
- 1收藏，305浏览
问题描述：
帮忙分析下二阶段没起来的原有，debug如下：
RBM_P<YNQJ-EIS-E22C100-HL-S-IFW-F5000-1>*Jul 5 03:03:49:908 2025 YNQJ-EIS-E22C100-HL-S-IFW-F5000-1 IPSEC/7/EVENT: -COntext=1;
Could not find tunnel, ike profile name is .
%Jul 5 03:03:49:909 2025 YNQJ-EIS-E22C100-HL-S-IFW-F5000-1 IPSEC/6/IPSEC_SA_ESTABLISH_FAIL: -COntext=1; Failed to establish IPsec SA.
Reason: Getting SP by L3 interface: Failed to match SP because IKE profile was while IPsec used profile IPSEC_EIS_H3C.
SA information:
Role: responder.
Local address: 172.16.200.200
Remote address: 36.133.24.75
Sour addr: 172.16.200.200/255.255.255.255 Port: 0 Protocol: IP
Dest addr: 36.133.24.75/255.255.255.255 Port: 0 Protocol: IP
Inside VPN instance:
Outside VPN instance:
Inbound AH SPI: 0
Outbound AH SPI: 0
Inbound ESP SPI: 0
Outbound ESP SPI: 0
ACL number:
*Jul 5 03:03:49:908 2025 YNQJ-EIS-E22C100-HL-S-IFW-F5000-1 IPSEC/7/EVENT: -COntext=1;
Failed to match profile: IKE profile was while IPsec used profile IPSEC_EIS_H3C.
%Jul 5 03:03:49:909 2025 YNQJ-EIS-E22C100-HL-S-IFW-F5000-1 IPSEC/6/IPSEC_SA_ESTABLISH_FAIL: -COntext=1; Failed to establish IPsec SA.
Reason: The policy contains incorrect ACL or IKE profile configuration.
SA information:
Role: responder.
Local address: 172.16.200.200
Remote address: 36.133.24.75
Sour addr: 172.16.200.200/255.255.255.255 Port: 0 Protocol: IP
Dest addr: 36.133.24.75/255.255.255.255 Port: 0 Protocol: IP
Inside VPN instance:
Outside VPN instance:
Inbound AH SPI: 0
Outbound AH SPI: 0
Inbound ESP SPI: 0
Outbound ESP SPI: 0
ACL number:
*Jul 5 03:03:49:908 2025 YNQJ-EIS-E22C100-HL-S-IFW-F5000-1 IPSEC/7/EVENT: -COntext=1;
Could not find tunnel, ike profile name is .
%Jul 5 03:03:49:909 2025 YNQJ-EIS-E22C100-HL-S-IFW-F5000-1 IKE/6/IKE_P2_SA_ESTABLISH_FAIL: -COntext=1; Failed to establish phase 2 SA in IKE_P2_STATE_GETSP state.
Reason: Failed to get IPsec policy as phase 2 responder.
SA information:
Role: responder
Local address: 172.16.200.200
Remote address: 36.133.24.75
Sour addr: / Port: 0 Protocol:
Dest addr: / Port: 0 Protocol:
Inside VPN instance:
Outside VPN instance:
Inbound AH SPI: 0
Outbound AH SPI: 0
Inbound ESP SPI: 0
Outbound ESP SPI: 0
Initiator COOKIE: ec4f2b8b050a982b
Responder COOKIE: 2ddc5dcabb38b853
Message ID: 0xf5effe5f
Connection ID: 76
Tunnel ID: 1
*Jul 5 03:03:49:908 2025 YNQJ-EIS-E22C100-HL-S-IFW-F5000-1 IPSEC/7/EVENT: -COntext=1;
Failed to match profile: IKE profile was while IPsec used profile IPSEC_EIS_H3C.
- 2025-07-04提问
- 举报
-
(0)
最佳答案
Failed to establish IPsec SA.
Reason: Getting SP by L3 interface: Failed to match SP because IKE profile was while IPsec used profile IPSEC_EIS_H3C.
Failed to establish IPsec SA.
Reason: The policy contains incorrect ACL or IKE profile configuration.
Failed to establish phase 2 SA in IKE_P2_STATE_GETSP state.
Reason: Failed to get IPsec policy as phase 2 responder.
1.
2.
IPsec 策略中引用的 ACL（如 ACL 3100）未正确定义感兴趣流量。
ACL 的源/目的地址范围与对端不一致（如响应方 ACL 范围小于发起方）。
IKE Profile 中关键参数（如 match remote identity）未正确定义对端身份。
3.
步骤1：检查 IKE Profile 名称一致性
ipsec policy policy1 10 isakmp
ike-profile IPSEC_EIS_H3C # 确保名称完全匹配
步骤2：核对 ACL 配置
步骤3：验证 IKE Profile 身份匹配
ike profile IPSEC_EIS_H3C
local-identity address 本端公网IP # 必须与实际出口IP一致
match remote identity address 对端公网IP # 必须精确匹配对端IP或域名
步骤4：检查 IPsec 策略完整性
display ipsec policy # 确认无缺失参数
完成配置修正后：
1.
reset ipsec sa
reset ike sa
2.
3.
display ike sa # 验证 Phase1 状态为"RD"
display ipsec sa # 验证 Phase2 有活跃 SA
注意
- 2025-07-04回答
- 评论(0)
- 举报
-
(0)
亲~登录后才可以操作哦!
确定你的邮箱还未认证，请认证邮箱或绑定手机后进行当前操作
举报
×
侵犯我的权益
×
侵犯了我企业的权益
×
- 1. 您举报的内容是什么？（请在邮件中列出您举报的内容和链接地址）
- 2. 您是谁？（身份证明材料，可以是身份证或护照等证件）
- 3. 是哪家企业？（营业执照，单位登记证明等证件）
- 4. 您与该企业的关系是？（您是企业法人或被授权人，需提供企业委托授权书）
抄袭了我的内容
×
原文链接或出处
诽谤我
×
- 1. 您举报的内容以及侵犯了您什么权益？（请在邮件中列出您举报的内容、链接地址，并给出简短的说明）
- 2. 您是谁？（身份证明材料，可以是身份证或护照等证件）
对根叔社区有害的内容
×
不规范转载
×
举报说明
暂无评论