IPSec ikev2 与思科防火墙建立 IPSec 不成功

Local address: 124.128.23.26 Remote address: 60.208.58.206 Sour addr: 192.168.10.0/255.255.255.0 Port: 0 Protocol: IP Dest addr: 176.16.0.0/255.255.252.0 Port: 0 Protocol: IP Inside VPN instance: Outside VPN instance: ACL number: 3000 *Aug 12 19:35:02:627 2022 FW IPSEC/7/EVENT: Got SA time-based soft lifetime settings when filling Sp data. Configured soft lifetime buffer : 0 seconds. Configured global soft lifetime buffer : 0 seconds. *Aug 12 19:35:02:628 2022 FW IKE/7/EVENT: Received message from ipsec, message type is 0. *Aug 12 19:35:02:628 2022 FW IKE/7/EVENT: Received SA acquire message from IPsec. *Aug 12 19:35:02:628 2022 FW IKE/7/EVENT: IKE thread 1099142320816 processes a job. *Aug 12 19:35:02:628 2022 FW IKEV2/7/EVENT: [IPsec->IKE] Get an IPsec SA acquire request. *Aug 12 19:35:02:628 2022 FW IKE/7/EVENT: IKE thread 1099142320816 processes a job. *Aug 12 19:35:02:628 2022 FW IKEV2/7/FSM: vrf = 0, src = 124.128.23.26, dst = 60.208.58.206/500 (Tunnel ID 9564): (I) Current State: IDLE. *Aug 12 19:35:02:628 2022 FW IKEV2/7/FSM: vrf = 0, src = 124.128.23.26, dst = 60.208.58.206/500 Choose profile 1. *Aug 12 19:35:02:628 2022 FW IKEV2/7/FSM: vrf = 0, src = 124.128.23.26, dst = 60.208.58.206/500 Getting pre-shared key from profile keychain 1. *Aug 12 19:35:02:628 2022 FW IKEV2/7/FSM: vrf = 0, src = 124.128.23.26, dst = 60.208.58.206/500 Getting pre-shared key by address 60.208.58.206. *Aug 12 19:35:02:628 2022 FW IKEV2/7/FSM: vrf = 0, src = 124.128.23.26, dst = 60.208.58.206/500 Peer 1 matched. *Aug 12 19:35:02:628 2022 FW IKEV2/7/FSM: vrf = 0, src = 124.128.23.26, dst = 60.208.58.206/500 Search policy with vrf 0, local address 124.128.23.26. *Aug 12 19:35:02:628 2022 FW IKEV2/7/FSM: vrf = 0, src = 124.128.23.26, dst = 60.208.58.206/500 Policy map matched. *Aug 12 19:35:02:628 2022 FW IKEV2/7/FSM: vrf = 0, src = 124.128.23.26, dst = 60.208.58.206/500 Construct SA payload. *Aug 12 19:35:02:628 2022 FW IKEV2/7/FSM: vrf = 0, src = 124.128.23.26, dst = 60.208.58.206/500 Proposal 1. *Aug 12 19:35:02:628 2022 FW IKEV2/7/FSM: vrf = 0, src = 124.128.23.26, dst = 60.208.58.206/500 Transform ENCR 3DES-CBC. *Aug 12 19:35:02:628 2022 FW IKEV2/7/FSM: vrf = 0, src = 124.128.23.26, dst = 60.208.58.206/500 Transform INTEG AUTH-HMAC-MD5-96. *Aug 12 19:35:02:628 2022 FW IKEV2/7/FSM: vrf = 0, src = 124.128.23.26, dst = 60.208.58.206/500 Transform PRF PRF-HMAC-MD5. *Aug 12 19:35:02:628 2022 FW IKEV2/7/FSM: vrf = 0, src = 124.128.23.26, dst = 60.208.58.206/500 Transform D-H 1024-bit MODP/Group 2. *Aug 12 19:35:02:632 2022 FW IKEV2/7/FSM: vrf = 0, src = 124.128.23.26, dst = 60.208.58.206/500 Compute DH public key, use 1024-bit MODP/Group 2. *Aug 12 19:35:02:632 2022 FW IKEV2/7/FSM: vrf = 0, src = 124.128.23.26, dst = 60.208.58.206/500 Construct KE payload. *Aug 12 19:35:02:632 2022 FW IKEV2/7/FSM: vrf = 0, src = 124.128.23.26, dst = 60.208.58.206/500 Construct NONCE payload. *Aug 12 19:35:02:632 2022 FW IKEV2/7/FSM: vrf = 0, src = 124.128.23.26, dst = 60.208.58.206/500 Construct NOTIFY payload: NAT_DETECTION_SOURCE_IP. *Aug 12 19:35:02:632 2022 FW IKEV2/7/FSM: vrf = 0, src = 124.128.23.26, dst = 60.208.58.206/500 Construct NOTIFY payload: NAT_DETECTION_DESTINATION_IP. *Aug 12 19:35:02:632 2022 FW IKEV2/7/FSM: vrf = 0, src = 124.128.23.26, dst = 60.208.58.206/500 (Tunnel ID 9564): (I) Current State: BUILD_INIT. *Aug 12 19:35:02:632 2022 FW IKEV2/7/PACKET: vrf = 0, src = 124.128.23.26, dst = 60.208.58.206/500 Payload contents: *Aug 12 19:35:02:632 2022 FW IKEV2/7/PACKET: vrf = 0, src = 124.128.23.26, dst = 60.208.58.206/500 SA Next payload: KE, Length: 44. *Aug 12 19:35:02:632 2022 FW IKEV2/7/PACKET: vrf = 0, src = 124.128.23.26, dst = 60.208.58.206/500 Last proposal: 0, Length: 40. *Aug 12 19:35:02:632 2022 FW IKEV2/7/PACKET: vrf = 0, src = 124.128.23.26, dst = 60.208.58.206/500 Proposal: 1, Protocol: IKE, SPI size: 0, Transform number: 4. *Aug 12 19:35:02:632 2022 FW IKEV2/7/PACKET: vrf = 0, src = 124.128.23.26, dst = 60.208.58.206/500 Last transform: 0x3, Length: 8. *Aug 12 19:35:02:632 2022 FW IKEV2/7/PACKET: vrf = 0, src = 124.128.23.26, dst = 60.208.58.206/500 Type: ENCR, Transform ID: 3DES-CBC. *Aug 12 19:35:02:632 2022 FW IKEV2/7/PACKET: vrf = 0, src = 124.128.23.26, dst = 60.208.58.206/500 Last transform: 0x3, Length: 8. *Aug 12 19:35:02:632 2022 FW IKEV2/7/PACKET: vrf = 0, src = 124.128.23.26, dst = 60.208.58.206/500 Type: INTEG, Transform ID: AUTH-HMAC-MD5-96. *Aug 12 19:35:02:632 2022 FW IKEV2/7/PACKET: vrf = 0, src = 124.128.23.26, dst = 60.208.58.206/500 Last transform: 0x3, Length: 8. *Aug 12 19:35:02:632 2022 FW IKEV2/7/PACKET: vrf = 0, src = 124.128.23.26, dst = 60.208.58.206/500 Type: PRF, Transform ID: PRF-HMAC-MD5. *Aug 12 19:35:02:633 2022 FW IKEV2/7/PACKET: vrf = 0, src = 124.128.23.26, dst = 60.208.58.206/500 Last transform: 0, Length: 8. *Aug 12 19:35:02:633 2022 FW IKEV2/7/PACKET: vrf = 0, src = 124.128.23.26, dst = 60.208.58.206/500 Type: D-H, Transform ID: 1024-bit MODP/Group 2. *Aug 12 19:35:02:633 2022 FW IKEV2/7/PACKET: vrf = 0, src = 124.128.23.26, dst = 60.208.58.206/500 KE Next payload: NONCE, Length: 136, DH: 1024-bit MODP/Group 2. *Aug 12 19:35:02:633 2022 FW IKEV2/7/PACKET: vrf = 0, src = 124.128.23.26, dst = 60.208.58.206/500 NONCE Next payload: NOTIFY, Length: 36. *Aug 12 19:35:02:633 2022 FW IKEV2/7/PACKET: vrf = 0, src = 124.128.23.26, dst = 60.208.58.206/500 NOTIFY Next payload: NOTIFY, Length: 28, Type: NAT_DETECTION_SOURCE_IP, Protocol: NO PROTOCOL, SPI size: 0. *Aug 12 19:35:02:633 2022 FW IKEV2/7/PACKET: vrf = 0, src = 124.128.23.26, dst = 60.208.58.206/500 NOTIFY Next payload: NO_PAYLOAD, Length: 28, Type: NAT_DETECTION_DESTINATION_IP, Protocol: NO PROTOCOL, SPI size: 0. *Aug 12 19:35:02:634 2022 FW IKEV2/7/PACKET: vrf = 0, src = 124.128.23.26, dst = 60.208.58.206/500 Sending packet to 60.208.58.206 remote port 500, local port 500. *Aug 12 19:35:02:634 2022 FW IKEV2/7/PACKET: vrf = 0, src = 124.128.23.26, dst = 60.208.58.206/500 I-SPI: a03386f65356552c R-SPI: 0000000000000000 Message ID: 0 Exchange type: SA_INIT Flags: REQUEST, INITIATOR Next payload: SA, Length: 300. *Aug 12 19:35:02:634 2022 FW IKEV2/7/PACKET: vrf = 0, src = 124.128.23.26, dst = 60.208.58.206/500 Sending an IPv4 packet. *Aug 12 19:35:02:634 2022 FW IKE/7/EVENT: vrf = 0, local = 124.128.23.26, remote = 60.208.58.206/500 Sent data to socket successfully. *Aug 12 19:35:02:639 2022 FW IKE/7/EVENT: Received packet successfully. *Aug 12 19:35:02:639 2022 FW IKEV2/7/PACKET: vrf = 0, src = 124.128.23.26, dst = 60.208.58.206/500 Received packet from 60.208.58.206 source port 500 destination port 500. *Aug 12 19:35:02:639 2022 FW IKEV2/7/PACKET: vrf = 0, src = 124.128.23.26, dst = 60.208.58.206/500 I-SPI: a03386f65356552c R-SPI: 29b24691fd8c5328 Message ID: 0 Exchange type: SA_INIT Flags: RESPONSE Next payload: NOTIFY, Length: 36. *Aug 12 19:35:02:639 2022 FW IKE/7/EVENT: IKE thread 1099142320816 processes a job. *Aug 12 19:35:02:639 2022 FW IKEV2/7/PACKET: vrf = 0, src = 124.128.23.26, dst = 60.208.58.206/500 Payload contents: *Aug 12 19:35:02:640 2022 FW IKEV2/7/PACKET: vrf = 0, src = 124.128.23.26, dst = 60.208.58.206/500 NOTIFY Next payload: NO_PAYLOAD, Length: 8, Type: NO_PROPOSAL_CHOSEN, Protocol: IKE, SPI size: 0. *Aug 12 19:35:02:640 2022 FW IKEV2/7/FSM: vrf = 0, src = 124.128.23.26, dst = 60.208.58.206/500 Process reponse notify for IKE SA. *Aug 12 19:35:02:640 2022 FW IKEV2/7/ERROR: vrf = 0, src = 124.128.23.26, dst = 60.208.58.206/500 Received notify NO_PROPOSAL_CHOSEN. *Aug 12 19:35:02:640 2022 FW IKEV2/7/PACKET: vrf = 0, src = 124.128.23.26, dst = 60.208.58.206/500 Processed response with message id 0, requests can be sent from (1 ~ 1). *Aug 12 19:35:02:640 2022 FW IPSEC/7/EVENT: Sent delete SA message to all nodes, message type is 0x16. *Aug 12 19:35:02:640 2022 FW IPSEC/7/EVENT: The SA doesn't exist in kernel. *Aug 12 19:35:02:641 2022 FW IKEV2/7/FSM: vrf = 0, src = 124.128.23.26, dst = 60.208.58.206/500 (Tunnel ID 9564): IKE SA deleted. Request time out