H3C IPSec 配置报错

日志内容

Failed to establish phase 2 SA in [STRING] state.

Reason: [STRING].

SA information:

·     Role: [STRING].

·     Local address: [STRING].

·     Remote address: [STRING].

·     Sour addr: [STRING]  Port: [UINT32]  Protocol: [STRING]

·     Dest addr: Protocol:[STRING]  Port: [UINT32]  Protocol: [STRING]

·     Inside VPN instance: [STRING].

·     Outside VPN instance: [STRING].

·     Inbound AH SPI: [STRING]

·     Outbound AH SPI: [STRING]

·     Inbound ESP SPI: [STRING]

·     Outbound ESP SPI: [STRING]

·     Initiator COOKIE: [STRING]

·     Responder COOKIE: [STRING].

·     Message ID: [STRING].

·     Connection ID: [UINT32].

·     Tunnel ID: [UINT32].

日志含义

IKE建立第二阶段SA失败

参数解释

$1：协商状态机状态

$2：失败原因：

·     构造ID载荷失败，显示为：Failed to construct ID payload

·     计算HASH算法失败，显示为：Failed to calculate %s

·     验证HASH算法失败，显示为：Failed to validate %s

·     计算密钥材料失败，显示为：Failed to compute key material

·     配置错误，显示为：Incorrect configuration

·     转换 IPsec SA失败，显示为：Failed to switch IPsec SA

·     Nonce载荷不存在，显示为：The nonce payload doesn't exist

·     无效的Nonce载荷长度，显示为：Invalid nonce payload length (%lu)

·     SA载荷中没有有效的DH group描述，显示为：No valid DH group description in SA payload

·     KE载荷不存在，显示为：The KE payload doesn't exist

·     存在多个KE载荷，显示为：Too many KE payloads

·     KE载荷长度与DH group描述不匹配，显示为：The length of the KE payload doesn't match the DH group description

·     获取SP时与IPsec通信失败，显示为：Failed to send message to IPsec when getting SP

·     获取SPI时与IPsec通信失败，显示为Failed to send message to IPsec when getting SPI

·     添加IPsec SA失败，显示为：Failed to add phase 2 SA

·     二阶段报文重传超时，显示为：Retransmission of phase 2 packet timed out

·     二阶段双方同时发起协商冲突，显示为：Collision detected in phase 2 negotiation

·     未找到匹配的提议，显示为：No matching proposal found between the local and remote ends

·     变换载荷编号非递增，显示为：Transform number is not monotonically increasing

·     提议载荷存在的变换载荷比指定变换载荷多，显示为：Proposal payload has more transforms than specified in the proposal payload

·     提议载荷存在的变换载荷比指定变换载荷少，显示为：Proposal payload has less transforms than specified in the proposal payload

·     IPsec变换载荷中属性重复，显示为：Attribute %d is repeated in IPsec transform %d

·     报文中SA_LIFE_TYPE属性重复，显示为：SA_LIFE_TYPE attribute is repeated in packet

·     消息中的SA_LIFE_TYPE属性必须在SA_LIFE_DURATION属性前，显示为 The SA_LIFE_TYPE attribute must be in front of the SA_LIFE_DURATION attribute

·     不支持的IPsec属性，显示为：Unsupported IPsec attribute %s

·     IPsec 安全提议必须指定封装模式，显示为：The encapsulation mode must be specified in the IPsec transform set

·     IPsec 提议的SPI长度超出范围，显示为：Invalid SPI length (%u) in IPsec proposal

·     IPsec提议中的SPI无效，显示为：Invalid SPI (%u) in IPsec proposal

·     变换载荷中的变换ID与认证算法不匹配，显示为：The Transform ID (%d) in transform %d doesn't match authentication algorithm %s (%u)

·     从提议中获取SPI失败，显示为：Failed to get SPI from proposal

·     IPsec提议中没有变换载荷，显示为：No transform in IPsec proposal

·     同一个提议中存在多个AH提议，显示为：A proposal payload contains more than one AH proposal

·     提议中存在无效的下一个载荷，显示为：Invalid next payload (%u) in proposal

·     没有ESP或AH提议，显示为：No ESP or AH proposal

·     不支持的DOI，显示为：Unsupported DOI

·     不支持的DOI场景，显示为：Unsupported IPsec DOI situation (%u)

·     无效的IPsec提议，显示为：Invalid IPsec proposal %u

·     重协商IPsec SA时获取IPsec策略失败，显示为：Failed to get IPsec policy when renegotiating IPsec SA

·     P2阶段响应方获取IPsec策略失败，显示为：Failed to get IPsec policy as phase 2 responder

$3：建立IPsec SA的角色，发起者或者响应者

$4：本端IP地址

$5：远端IP地址

$6-$11: 数据流

$12: 内部VPN实例

$13: 外部VPN实例

$14: 入方向AH SPI

$15: 出方向AH SPI

$16: 入方向ESP SPI

$17: 出方向ESP SPI

$18-$19: 发起者COOKIE和响应者COOKIE

$20: 消息ID

$21: 连接号

$22: IKE Tunnel编号，默认值为4294967295

日志等级

6 (Informational)

举例

IKE/6/IKE_P2_SA_ESTABLISH_FAIL: Failed to establish phase 2 SA in IKE_P2_STATE_GETSPI state.

Reason: Failed to get SPI from proposal.

SA information:

·     Role: Responder

·     Local address: 2.2.2.2

·     Remote address: 1.1.1.1

·     Sour addr: 192.168.2.0/255.255.255.0  Port: 0  Protocol: IP

·     Dest addr: 192.168.1.0/255.255.255.0  Port: 0  Protocol: IP

·     Inside VPN instance: aaa

·     Outside VPN instance: bbb

·     Inbound AH SPI: 192365458

·     Outbound AH SPI: 13654581

·     Inbound ESP SPI: 292334583

·     Outbound ESP SPI: 5923654586

·     Initiator COOKIE: 4a42af47dbf0b2b1

·     Responder COOKIE: 8f8c1ff6645efbaf

·     Message ID: 0xa2b11c8e

·     Connection ID: 1

·     Tunnel ID: 1

对系统的影响

无法建立IPsec SA

日志产生原因

·     两端的IPsec安全提议参数、IPsec认证算法、IPsec加密算法、IPsec封装模式不一致

·     两端的IPsec policy配置不一致

·     两端引用的ACL配置不为镜像配置

·     物理链路状态不佳或对等体网络不可达

处理建议

·     检查两端的IPsec安全提议参数、IPsec认证算法、IPsec加密算法、IPsec封装模式是否一致，若不一致请修改为一致

·     检查两端的IPsec policy配置是否一致，若不一致请修改为一致

·     检查两端引用的ACL配置是否为镜像配置，若不为镜像配置请修改为镜像配置

·     检查物理链路状态和对等体网络是否可达，若物理链路状态不佳或对等体网络不可达请排查网络故障

执行以上检查后，若问题仍未解决，则请收集配置文件、日志信息和告警信息，并联系技术支持