ipsec主机能挂在主路由后面吗？
- 0关注
- 0收藏，517浏览
最佳答案
I-COOKIE: 19093c627101f260
R-COOKIE: bd987a6071b774cb
next payload: HASH
version: ISAKMP Version 1.0
exchange mode: Quick
flags: ENCRYPT
message ID: 64c3c542
length: 52
*Jan 1 14:57:14:150 2011 h3c IKE/7/EVENT: IKE thread 1115862304 processes a job.
*Jan 1 14:57:14:150 2011 h3c IKE/7/EVENT: Phase2 process started.
*Jan 1 14:57:14:150 2011 h3c IKE/7/PACKET: vrf = 0, local = 192.168.100.45, remote = 122.225.86.210/500
Decrypt the packet.
*Jan 1 14:57:14:151 2011 h3c IKE/7/PACKET: vrf = 0, local = 192.168.100.45, remote = 122.225.86.210/500
Received ISAKMP Hash Payload.
*Jan 1 14:57:14:151 2011 h3c IKE/7/PACKET: vrf = 0, local = 192.168.100.45, remote = 122.225.86.210/500
Process HASH payload.
*Jan 1 14:57:14:152 2011 h3c IKE/7/EVENT: vrf = 0, local = 192.168.100.45, remote = 122.225.86.210/500
Validated HASH(3) successfully.
*Jan 1 14:57:14:153 2011 h3c IPSEC/7/EVENT:
Updated outbound SA of IPsec tunnel(SA index = 0, SPI = 0xebc6eaad).
*Jan 1 14:57:14:152 2011 h3c IKE/7/EVENT: vrf = 0, local = 192.168.100.45, remote = 122.225.86.210/500
IPsec SA state changed from IKE_P2_STATE_SEND2 to IKE_P2_STATE_ESTABLISHED.
*Jan 1 14:57:14:152 2011 h3c IKE/7/EVENT: vrf = 0, local = 192.168.100.45, remote = 122.225.86.210/500
Got time-based lifetime settings for IKE P2 SA:
Role : Respondor.
Configured soft lifetime buffer : 0 seconds.
Hard lifetime after negotiation : 3600 seconds.
Default soft lifetime : 3580 seconds.
Actual soft lifetime : 3580 seconds.
*Jan 1 14:57:14:154 2011 h3c IPSEC/7/EVENT:
Sent switch SA message to Slot:0 Cpu:0, message type is 0x1a.
*Jan 1 14:57:14:156 2011 h3c IKE/7/EVENT: vrf = 0, local = 192.168.100.45, remote = 122.225.86.210/500
Add P2 SA to triple successfully.
*Jan 1 14:57:14:157 2011 h3c IPSEC/7/EVENT:
Sent update SP message to Slot:0 Cpu:0, message type is 0xe.
*Jan 1 14:57:14:158 2011 h3c IPSEC/7/EVENT:
Switched SA successfully.
*Jan 1 14:57:14:158 2011 h3c IKE/7/EVENT: Received message from ipsec, message type is 15.
卡住20几秒
*Jan 1 14:57:45:990 2011 h3c IKE/7/EVENT: Received packet successfully.
*Jan 1 14:57:45:990 2011 h3c IKE/7/PACKET: vrf = 0, local = 192.168.100.45, remote = 122.225.86.210/500
Received packet from 122.225.86.210 source port 500 destination port 500.
*Jan 1 14:57:45:990 2011 h3c IKE/7/PACKET: vrf = 0, local = 192.168.100.45, remote = 122.225.86.210/500
I-COOKIE: 19093c627101f260
R-COOKIE: bd987a6071b774cb
next payload: HASH
version: ISAKMP Version 1.0
exchange mode: Info
flags: ENCRYPT
message ID: 2df13082
length: 68
*Jan 1 14:57:45:991 2011 h3c IKE/7/EVENT: IKE thread 1115862304 processes a job.
*Jan 1 14:57:45:991 2011 h3c IKE/7/EVENT: Info packet process started.
*Jan 1 14:57:45:991 2011 h3c IKE/7/PACKET: vrf = 0, local = 192.168.100.45, remote = 122.225.86.210/500
Decrypt the packet.
*Jan 1 14:57:45:991 2011 h3c IKE/7/PACKET: vrf = 0, local = 192.168.100.45, remote = 122.225.86.210/500
Received ISAKMP Hash Payload.
*Jan 1 14:57:45:991 2011 h3c IKE/7/PACKET: vrf = 0, local = 192.168.100.45, remote = 122.225.86.210/500
Received ISAKMP Delete Payload.
*Jan 1 14:57:45:992 2011 h3c IKE/7/PACKET: vrf = 0, local = 192.168.100.45, remote = 122.225.86.210/500
Parse informational exchange packet successfully.
*Jan 1 14:57:45:992 2011 h3c IKE/7/EVENT: vrf = 0, local = 192.168.100.45, remote = 122.225.86.210/500
Process delete payload.
*Jan 1 14:57:45:992 2011 h3c IKE/7/EVENT: vrf = 0, local = 192.168.100.45, remote = 122.225.86.210/500
Received phase 2 SA delete packet.
*Jan 1 14:57:45:992 2011 h3c IKE/7/EVENT: Delete IPsec SA.
*Jan 1 14:57:45:994 2011 h3c IPSEC/7/EVENT:
SA successfully deleted in kernel.
*Jan 1 14:57:45:994 2011 h3c IPSEC/7/EVENT:
Deleted outbound SA from IPsec tunnel(SA index = 0, SPI = 0xebc6eaad).
*Jan 1 14:57:45:994 2011 h3c IPSEC/7/EVENT:
SA successfully deleted in kernel.
*Jan 1 14:57:45:994 2011 h3c IPSEC/7/EVENT:
IPsec tunnel successfully deleted in kernel.
*Jan 1 14:57:45:992 2011 h3c IKE/7/EVENT: vrf = 0, local = 192.168.100.45, remote = 122.225.86.210/500
Send delete SA to IPsec, the reason is receive delete packet.
*Jan 1 14:57:45:993 2011 h3c IKE/7/EVENT: Received packet successfully.
*Jan 1 14:57:45:993 2011 h3c IKE/7/PACKET: vrf = 0, local = 192.168.100.45, remote = 122.225.86.210/500
Received packet from 122.225.86.210 source port 500 destination port 500.
*Jan 1 14:57:45:994 2011 h3c IPSEC/7/EVENT:
Sent delete SA message to Slot:0 Cpu:0, message type is 0x16.
*Jan 1 14:57:45:994 2011 h3c IPSEC/7/EVENT:
Sent delete tunnel message to Slot:0 Cpu:0, message type is 0x14.
*Jan 1 14:57:45:996 2011 h3c IKE/7/PACKET: vrf = 0, local = 192.168.100.45, remote = 122.225.86.210/500
I-COOKIE: 19093c627101f260
R-COOKIE: bd987a6071b774cb
next payload: HASH
version: ISAKMP Version 1.0
exchange mode: Info
flags: ENCRYPT
message ID: 353ca069
length: 84
*Jan 1 14:57:45:996 2011 h3c IKE/7/EVENT: IKE thread 1115862304 processes a job.
*Jan 1 14:57:45:996 2011 h3c IKE/7/EVENT: Info packet process started.
*Jan 1 14:57:45:996 2011 h3c IKE/7/PACKET: vrf = 0, local = 192.168.100.45, remote = 122.225.86.210/500
Decrypt the packet.
*Jan 1 14:57:45:997 2011 h3c IKE/7/PACKET: vrf = 0, local = 192.168.100.45, remote = 122.225.86.210/500
Received ISAKMP Hash Payload.
*Jan 1 14:57:45:997 2011 h3c IKE/7/PACKET: vrf = 0, local = 192.168.100.45, remote = 122.225.86.210/500
Received ISAKMP Delete Payload.
*Jan 1 14:57:45:998 2011 h3c IKE/7/PACKET: vrf = 0, local = 192.168.100.45, remote = 122.225.86.210/500
Parse informational exchange packet successfully.
*Jan 1 14:57:45:998 2011 h3c IKE/7/EVENT: vrf = 0, local = 192.168.100.45, remote = 122.225.86.210/500
Process delete payload.
*Jan 1 14:57:45:998 2011 h3c IKE/7/PACKET: vrf = 0, local = 192.168.100.45, remote = 122.225.86.210/500
The phase 1 delete packet is received.
*Jan 1 14:57:45:999 2011 h3c IKE/7/EVENT: vrf = 0, local = 192.168.100.45, remote = 122.225.86.210/500
Delete IKE SA with connection ID 202.
*Jan 1 14:57:46:000 2011 h3c IKE/7/EVENT: vrf = 0, local = 192.168.100.45, remote = 122.225.86.210/500
Delete tunnel, reference count is [0], tunnel [1] has been freed.
- 2025-03-12回答
- 评论(2)
- 举报
-
(0)
源目地址有问题,把IPSec策略的源地址换成出口公网地址
ipsec transform-set WAN0(GE0)@L2TP encapsulation-mode transport esp encryption-algorithm 3des-cbc esp authentication-algorithm sha1 # ipsec policy-template WAN0(GE0) 65535 transform-set WAN0(GE0)@L2TP security acl 3001 description WAN0(GE0)@L2TP ike-profile WAN0(GE0)@L2TP sa duration time-based 3600 sa duration traffic-based 1843200 # ipsec policy WAN0(GE0) 65535 isakmp template WAN0(GE0) # l2tp-group 1 mode lns allow l2tp virtual-template 1 undo tunnel authentication tunnel name LNS # l2tp enable # ike identity fqdn zb # ike profile WAN0(GE0)@L2TP keychain WAN0(GE0)@L2TP dpd interval 300 on-demand exchange-mode aggressive local-identity fqdn zb match remote identity fqdn fb proposal 65535 # ike proposal 65535 encryption-algorithm 3des-cbc dh group2 # ike keychain WAN0(GE0)@L2TP pre-shared-key hostname fb key cipher $c$3$dG3GLnBLSR4IYLLOPd2vGOUukMEMkg== #大神帮忙看看
可以旁挂
V7的版本
1、在两台路由器上开启NAT映射，映射IPSEC需要的端口，500和4000我记得，具体你再查下
2、v7自动开启NAT穿越，所以不用单独配置NAT穿越，正常配置IPSEC就行，peer地址是对端公网地址
- 2025-03-12回答
- 评论(1)
- 举报
-
(0)
debug信息在下面，帮忙看看，*Jan 1 14:57:14:158 2011左右卡20多秒就失败
debug信息在下面，帮忙看看，*Jan 1 14:57:14:158 2011左右卡20多秒就失败
可以的，v5要做nat穿越，v7会自动识别
- 2025-03-12回答
- 评论(1)
- 举报
-
(0)
inode拨号的，主机msr810
inode拨号的，主机msr810
可以旁挂,出口把端口号映射一下
- 2025-03-12回答
- 评论(3)
- 举报
-
(0)
看debug,你的源目地址有问题吧
映射了1701 500 4500 50 51
那检查一下策略
看debug,你的源目地址有问题吧
您好，可以的，配置nat穿越，然后将4500和500udp端口映射出去
- 2025-03-12回答
- 评论(1)
- 举报
-
(0)
都映射了，全地址都映射过，还是不行，下面是debug信息
都映射了，全地址都映射过，还是不行，下面是debug信息
编辑答案
亲~登录后才可以操作哦!
确定你的邮箱还未认证，请认证邮箱或绑定手机后进行当前操作
举报
×
侵犯我的权益
×
侵犯了我企业的权益
×
- 1. 您举报的内容是什么？（请在邮件中列出您举报的内容和链接地址）
- 2. 您是谁？（身份证明材料，可以是身份证或护照等证件）
- 3. 是哪家企业？（营业执照，单位登记证明等证件）
- 4. 您与该企业的关系是？（您是企业法人或被授权人，需提供企业委托授权书）
抄袭了我的内容
×
原文链接或出处
诽谤我
×
- 1. 您举报的内容以及侵犯了您什么权益？（请在邮件中列出您举报的内容、链接地址，并给出简短的说明）
- 2. 您是谁？（身份证明材料，可以是身份证或护照等证件）
对根叔社区有害的内容
×
不规范转载
×
举报说明
ipsec transform-set WAN0(GE0)@L2TP encapsulation-mode transport esp encryption-algorithm 3des-cbc esp authentication-algorithm sha1 # ipsec policy-template WAN0(GE0) 65535 transform-set WAN0(GE0)@L2TP security acl 3001 description WAN0(GE0)@L2TP ike-profile WAN0(GE0)@L2TP sa duration time-based 3600 sa duration traffic-based 1843200 # ipsec policy WAN0(GE0) 65535 isakmp template WAN0(GE0) # l2tp-group 1 mode lns allow l2tp virtual-template 1 undo tunnel authentication tunnel name LNS # l2tp enable # ike identity fqdn zb # ike profile WAN0(GE0)@L2TP keychain WAN0(GE0)@L2TP dpd interval 300 on-demand exchange-mode aggressive local-identity fqdn zb match remote identity fqdn fb proposal 65535 # ike proposal 65535 encryption-algorithm 3des-cbc dh group2 # ike keychain WAN0(GE0)@L2TP pre-shared-key hostname fb key cipher $c$3$dG3GLnBLSR4IYLLOPd2vGOUukMEMkg== #大神帮忙看看