问题描述：
R1与R5配置gre over ipsec，S5模拟互联网
R1无法建立ike sa
debugging ike error提示Can't find ike sa
组网见图，配置见附件
R1-fail是无法建立ike sa的配置
R1是正常建立链路的配置。
S5、R5是正常配置
已使用对比软件比较了R1和R1-fail的配置，gre over ipsec配置没有错误，但是R1就是无法建立ike sa
做过重启模拟设备的操作，也做过reset sa的操作，R1-fail的配置就是无法实现链路，难道是软件bug？？？
R1-fail：
#
interface LoopBack0
ip address 10.1.255.1 255.255.255.255
#
interface GigabitEthernet0/0
port link-mode route
description to sw1
combo enable copper
ip address 10.1.0.1 255.255.255.252
ospf network-type p2p
#
interface GigabitEthernet0/1
port link-mode route
description to sw5
combo enable copper
ip address 202.0.0.2 255.255.255.252
ipsec apply policy H3C
#
#
interface Tunnel1 mode gre
ip address 10.1.1.1 255.255.255.252
source 10.1.255.1
destination 10.1.255.5
keepalive 10 3
#
#
ipsec transform-set 1
esp encryption-algorithm des-cbc
esp authentication-algorithm md5
#
ipsec policy-template bsc 1
transform-set 1
local-address 202.0.0.2
remote-address 61.0.0.2
ike-profile r5
#
ipsec policy H3C 1 isakmp template bsc
#
ike profile r5
keychain r5
match remote identity address 61.0.0.2 255.255.255.255
match local address 202.0.0.2
#
ike keychain r5
pre-shared-key address 61.0.0.2 255.255.255.255 key cipher $c$3$q+E4T11g/aPTJdups9J3gDSfApkj8gt07J0=
#
R1：
#
interface LoopBack0
ip address 10.1.255.1 255.255.255.255
#
interface GigabitEthernet0/0
port link-mode route
description to sw1
combo enable copper
ip address 10.1.0.1 255.255.255.252
ospf network-type p2p
#
interface GigabitEthernet0/1
port link-mode route
description to sw5
combo enable copper
ip address 202.0.0.2 255.255.255.252
ipsec apply policy H3C
#
interface Tunnel1 mode gre
ip address 10.1.1.1 255.255.255.252
source 10.1.255.1
destination 10.1.255.5
keepalive 10 3
#
ipsec transform-set 1
esp encryption-algorithm des-cbc
esp authentication-algorithm md5
#
ipsec policy-template bsc 1
transform-set 1
local-address 202.0.0.2
remote-address 61.0.0.2
ike-profile r5
#
ipsec policy H3C 1 isakmp template bsc
#
ike profile r5
keychain r5
match remote identity address 61.0.0.2 255.255.255.255
match local address 202.0.0.2
#
ike keychain r5
pre-shared-key address 61.0.0.2 255.255.255.255 key cipher $c$3$zh+fC10I6Cj283H0NZziBvNW4u9AtA==
#
R5
#
interface LoopBack0
ip address 10.1.255.5 255.255.255.255
#
interface Tunnel1 mode gre
ip address 10.1.1.2 255.255.255.252
source 10.1.255.5
destination 10.1.255.1
keepalive 10 3
#
#
ip route-static 0.0.0.0 0 61.0.0.1
#
acl advanced 3015
rule 0 permit ip source 10.1.255.5 0 destination 10.1.255.1 0
#
ipsec transform-set 1
esp encryption-algorithm des-cbc
esp authentication-algorithm md5
#
ipsec policy H3C 1 isakmp
transform-set 1
security acl 3015
local-address 61.0.0.2
remote-address 202.0.0.2
ike-profile r1
#
ike profile r1
keychain r1
match remote identity address 202.0.0.2 255.255.255.255
match local address 61.0.0.2
#
ike keychain r1
pre-shared-key address 202.0.0.2 255.255.255.255 key cipher $c$3$tqleAbSQF7fPBXb57B7vxGLj0GaWcg==
#
S5
#
vlan 1
#
vlan 10
#
vlan 50
#
interface NULL0
#
interface Vlan-interface10
ip address 202.0.0.1 255.255.255.252
#
interface Vlan-interface50
ip address 61.0.0.1 255.255.255.252
#
interface GigabitEthernet1/0/1
port link-mode bridge
port access vlan 10
combo enable fiber
#
interface GigabitEthernet1/0/2
port link-mode bridge
port access vlan 50
combo enable fiber
#
组网及组网描述：
- 2019-03-09提问
- 举报
-
(0)
最佳答案
亲~登录后才可以操作哦!
确定你的邮箱还未认证，请认证邮箱或绑定手机后进行当前操作
举报
×
侵犯我的权益
×
侵犯了我企业的权益
×
- 1. 您举报的内容是什么？（请在邮件中列出您举报的内容和链接地址）
- 2. 您是谁？（身份证明材料，可以是身份证或护照等证件）
- 3. 是哪家企业？（营业执照，单位登记证明等证件）
- 4. 您与该企业的关系是？（您是企业法人或被授权人，需提供企业委托授权书）
抄袭了我的内容
×
原文链接或出处
诽谤我
×
- 1. 您举报的内容以及侵犯了您什么权益？（请在邮件中列出您举报的内容、链接地址，并给出简短的说明）
- 2. 您是谁？（身份证明材料，可以是身份证或护照等证件）
对根叔社区有害的内容
×
不规范转载
×
举报说明
暂无评论