MSR3620+建ipsec vpn时最大链接限制
- 0关注
- 0收藏，61浏览
问题描述：
中心端路由器MSR3620使用同一个互联ip与下联端多个小终端建立ipsec vpn，Ike阶段共用同一个profile和key，通过命令dis ike sa 能查看到已建立的链接有16条，现在尝试第17条ike链接，一直不成功，小终端通过命令dis ike sa查看flag为unknown，中心端直接不显示；尝试将小终端的ike模式改为野蛮模式，中心端可以看到ike的状态也是unknown;通过debug查找原因，信息如下。怀疑是否是共用了同一profile/key,导致有链接限制，限制数量为16个。如果还是同一互联地址，应该怎么解决这个问题。
组网及组网描述：
H3C MSR3620 Version 7.1.064, Release 0821P18 ipsec transform-set tran2 esp encryption-algorithm 3des-cbc esp authentication-algorithm md5 ipsec policy-template temp2 2 transform-set tran2 ike-profile profile2 reverse-route dynamic ike profile profile2 keychain key2 local-identity address 10.13.***.251 match remote identity address 172.**.63.0 255.255.255.0 ike keychain key2 pre-shared-key address 172.**.63.0 255.255.255.0 key cipher ****** debug信息： *May 20 12:49:27:892 2026 WJ_EXT3_RT01_MSR3620 IKE/7/EVENT: Received packet successfully. *May 20 12:49:27:892 2026 WJ_EXT3_RT01_MSR3620 IKE/7/PACKET: vrf = 0, local = 10.13.199.251, remote = 172.23.63.20/500 Received packet from 172.23.63.20 source port 500 destination port 500. *May 20 12:49:27:892 2026 WJ_EXT3_RT01_MSR3620 IKE/7/PACKET: vrf = 0, local = 10.13.199.251, remote = 172.23.63.20/500 I-COOKIE: 1a67fa8e1fbc574c R-COOKIE: 0000000000000000 next payload: SA version: ISAKMP Version 1.0 exchange mode: Main flags: message ID: 0 length: 164 *May 20 12:49:27:892 2026 WJ_EXT3_RT01_MSR3620 IKE/7/EVENT: IKE thread 1099300197040 processes a job. *May 20 12:49:27:892 2026 WJ_EXT3_RT01_MSR3620 IKE/7/EVENT: Phase1 process started. *May 20 12:49:27:892 2026 WJ_EXT3_RT01_MSR3620 IKE/7/PACKET: vrf = 0, local = 10.13.199.251, remote = 172.23.63.20/500 Begin a new phase 1 negotiation as responder. *May 20 12:49:27:892 2026 WJ_EXT3_RT01_MSR3620 IKE/7/EVENT: vrf = 0, local = 10.13.199.251, remote = 172.23.63.20/500 Responder created an SA for peer 172.23.63.20, local port 500, remote port 500. *May 20 12:49:27:892 2026 WJ_EXT3_RT01_MSR3620 IKE/7/EVENT: vrf = 0, local = 10.13.199.251, remote = 172.23.63.20/500 Set IKE SA state to IKE_P1_STATE_INIT. *May 20 12:49:27:892 2026 WJ_EXT3_RT01_MSR3620 IKE/7/PACKET: vrf = 0, local = 10.13.199.251, remote = 172.23.63.20/500 Received ISAKMP Security Association Payload. *May 20 12:49:27:892 2026 WJ_EXT3_RT01_MSR3620 IKE/7/PACKET: vrf = 0, local = 10.13.199.251, remote = 172.23.63.20/500 Received ISAKMP Vendor ID Payload. *May 20 12:49:27:892 2026 WJ_EXT3_RT01_MSR3620 IKE/7/PACKET: vrf = 0, local = 10.13.199.251, remote = 172.23.63.20/500 Received ISAKMP Vendor ID Payload. *May 20 12:49:27:892 2026 WJ_EXT3_RT01_MSR3620 IKE/7/PACKET: vrf = 0, local = 10.13.199.251, remote = 172.23.63.20/500 Received ISAKMP Vendor ID Payload. *May 20 12:49:27:892 2026 WJ_EXT3_RT01_MSR3620 IKE/7/PACKET: vrf = 0, local = 10.13.199.251, remote = 172.23.63.20/500 Received ISAKMP Vendor ID Payload. *May 20 12:49:27:893 2026 WJ_EXT3_RT01_MSR3620 IKE/7/PACKET: vrf = 0, local = 10.13.199.251, remote = 172.23.63.20/500 Process vendor ID payload. *May 20 12:49:27:893 2026 WJ_EXT3_RT01_MSR3620 IKE/7/EVENT: Vendor ID NAT-T rfc3947 is matched. *May 20 12:49:27:893 2026 WJ_EXT3_RT01_MSR3620 IKE/7/PACKET: vrf = 0, local = 10.13.199.251, remote = 172.23.63.20/500 Process SA payload. *May 20 12:49:27:893 2026 WJ_EXT3_RT01_MSR3620 IKE/7/PACKET: vrf = 0, local = 10.13.199.251, remote = 172.23.63.20/500 Check ISAKMP transform 1. *May 20 12:49:27:893 2026 WJ_EXT3_RT01_MSR3620 IKE/7/PACKET: vrf = 0, local = 10.13.199.251, remote = 172.23.63.20/500 Encryption algorithm is 3DES-CBC. *May 20 12:49:27:893 2026 WJ_EXT3_RT01_MSR3620 IKE/7/PACKET: vrf = 0, local = 10.13.199.251, remote = 172.23.63.20/500 HASH algorithm is HMAC-MD5. *May 20 12:49:27:893 2026 WJ_EXT3_RT01_MSR3620 IKE/7/PACKET: vrf = 0, local = 10.13.199.251, remote = 172.23.63.20/500 DH group is 2. *May 20 12:49:27:893 2026 WJ_EXT3_RT01_MSR3620 IKE/7/PACKET: vrf = 0, local = 10.13.199.251, remote = 172.23.63.20/500 Authentication method is Pre-shared key. *May 20 12:49:27:893 2026 WJ_EXT3_RT01_MSR3620 IKE/7/PACKET: vrf = 0, local = 10.13.199.251, remote = 172.23.63.20/500 Lifetime type is 1. *May 20 12:49:27:893 2026 WJ_EXT3_RT01_MSR3620 IKE/7/PACKET: vrf = 0, local = 10.13.199.251, remote = 172.23.63.20/500 Life duration is 86400. *May 20 12:49:27:893 2026 WJ_EXT3_RT01_MSR3620 IKE/7/EVENT: vrf = 0, local = 10.13.199.251, remote = 172.23.63.20/500 Found pre-shared key that matches address 172.23.63.20 in keychain key2. *May 20 12:49:27:893 2026 WJ_EXT3_RT01_MSR3620 IKE/7/PACKET: vrf = 0, local = 10.13.199.251, remote = 172.23.63.20/500 Attributes is acceptable. *May 20 12:49:27:894 2026 WJ_EXT3_RT01_MSR3620 IKE/7/EVENT: Oakley transform 1 is acceptable. *May 20 12:49:27:894 2026 WJ_EXT3_RT01_MSR3620 IKE/7/PACKET: vrf = 0, local = 10.13.199.251, remote = 172.23.63.20/500 Constructed SA payload *May 20 12:49:27:894 2026 WJ_EXT3_RT01_MSR3620 IKE/7/PACKET: vrf = 0, local = 10.13.199.251, remote = 172.23.63.20/500 Construct NAT-T rfc3947 vendor ID payload. *May 20 12:49:27:894 2026 WJ_EXT3_RT01_MSR3620 IKE/7/PACKET: vrf = 0, local = 10.13.199.251, remote = 172.23.63.20/500 Construct XAUTH Cisco Unity 1.0 vendor ID payload. *May 20 12:49:27:894 2026 WJ_EXT3_RT01_MSR3620 IKE/7/PACKET: vrf = 0, local = 10.13.199.251, remote = 172.23.63.20/500 Construct XAUTH draft6 vendor ID payload. *May 20 12:49:27:894 2026 WJ_EXT3_RT01_MSR3620 IKE/7/EVENT: vrf = 0, local = 10.13.199.251, remote = 172.23.63.20/500 IKE SA state changed from IKE_P1_STATE_INIT to IKE_P1_STATE_SEND2. *May 20 12:49:27:894 2026 WJ_EXT3_RT01_MSR3620 IKE/7/PACKET: vrf = 0, local = 10.13.199.251, remote = 172.23.63.20/500 Sending packet to 172.23.63.20 remote port 500, local port 500. *May 20 12:49:27:894 2026 WJ_EXT3_RT01_MSR3620 IKE/7/PACKET: vrf = 0, local = 10.13.199.251, remote = 172.23.63.20/500 I-COOKIE: 1a67fa8e1fbc574c R-COOKIE: 95dd47d6007618ea next payload: SA version: ISAKMP Version 1.0 exchange mode: Main flags: message ID: 0 length: 136 *May 20 12:49:27:894 2026 WJ_EXT3_RT01_MSR3620 IKE/7/PACKET: vrf = 0, local = 10.13.199.251, remote = 172.23.63.20/500 Sending an IPv4 packet. *May 20 12:49:27:894 2026 WJ_EXT3_RT01_MSR3620 IKE/7/EVENT: vrf = 0, local = 10.13.199.251, remote = 172.23.63.20/500 Sent data to socket successfully. *May 20 12:49:28:038 2026 WJ_EXT3_RT01_MSR3620 IKE/7/EVENT: Received packet successfully. *May 20 12:49:28:038 2026 WJ_EXT3_RT01_MSR3620 IKE/7/PACKET: vrf = 0, local = 10.13.199.251, remote = 172.23.63.20/500 Received packet from 172.23.63.20 source port 500 destination port 500. *May 20 12:49:28:038 2026 WJ_EXT3_RT01_MSR3620 IKE/7/PACKET: vrf = 0, local = 10.13.199.251, remote = 172.23.63.20/500 I-COOKIE: 1a67fa8e1fbc574c R-COOKIE: 95dd47d6007618ea next payload: KE version: ISAKMP Version 1.0 exchange mode: Main flags: message ID: 0 length: 240 *May 20 12:49:28:038 2026 WJ_EXT3_RT01_MSR3620 IKE/7/EVENT: IKE thread 1099300197040 processes a job. *May 20 12:49:28:038 2026 WJ_EXT3_RT01_MSR3620 IKE/7/EVENT: Phase1 process started. *May 20 12:49:28:038 2026 WJ_EXT3_RT01_MSR3620 IKE/7/PACKET: vrf = 0, local = 10.13.199.251, remote = 172.23.63.20/500 Received ISAKMP Key Exchange Payload. *May 20 12:49:28:038 2026 WJ_EXT3_RT01_MSR3620 IKE/7/PACKET: vrf = 0, local = 10.13.199.251, remote = 172.23.63.20/500 Received ISAKMP Nonce Payload. *May 20 12:49:28:038 2026 WJ_EXT3_RT01_MSR3620 IKE/7/PACKET: vrf = 0, local = 10.13.199.251, remote = 172.23.63.20/500 Received ISAKMP NAT-D Payload. *May 20 12:49:28:038 2026 WJ_EXT3_RT01_MSR3620 IKE/7/PACKET: vrf = 0, local = 10.13.199.251, remote = 172.23.63.20/500 Received ISAKMP NAT-D Payload. *May 20 12:49:28:038 2026 WJ_EXT3_RT01_MSR3620 IKE/7/PACKET: vrf = 0, local = 10.13.199.251, remote = 172.23.63.20/500 Received ISAKMP Vendor ID Payload. *May 20 12:49:28:038 2026 WJ_EXT3_RT01_MSR3620 IKE/7/PACKET: vrf = 0, local = 10.13.199.251, remote = 172.23.63.20/500 Process KE payload. *May 20 12:49:28:038 2026 WJ_EXT3_RT01_MSR3620 IKE/7/PACKET: vrf = 0, local = 10.13.199.251, remote = 172.23.63.20/500 Process NONCE payload. *May 20 12:49:28:038 2026 WJ_EXT3_RT01_MSR3620 IKE/7/PACKET: vrf = 0, local = 10.13.199.251, remote = 172.23.63.20/500 Received 2 NAT-D payload. *May 20 12:49:28:039 2026 WJ_EXT3_RT01_MSR3620 IKE/7/PACKET: vrf = 0, local = 10.13.199.251, remote = 172.23.63.20/500 Process vendor ID payload. *May 20 12:49:28:039 2026 WJ_EXT3_RT01_MSR3620 IKE/7/EVENT: Vendor ID DPD is matched. *May 20 12:49:28:041 2026 WJ_EXT3_RT01_MSR3620 IKE/7/PACKET: vrf = 0, local = 10.13.199.251, remote = 172.23.63.20/500 Construct KE payload. *May 20 12:49:28:041 2026 WJ_EXT3_RT01_MSR3620 IKE/7/PACKET: vrf = 0, local = 10.13.199.251, remote = 172.23.63.20/500 Construct NONCE payload. *May 20 12:49:28:041 2026 WJ_EXT3_RT01_MSR3620 IKE/7/PACKET: vrf = 0, local = 10.13.199.251, remote = 172.23.63.20/500 Construct NAT-D payload. *May 20 12:49:28:041 2026 WJ_EXT3_RT01_MSR3620 IKE/7/PACKET: vrf = 0, local = 10.13.199.251, remote = 172.23.63.20/500 Construct DPD vendor ID payload. *May 20 12:49:28:044 2026 WJ_EXT3_RT01_MSR3620 IKE/7/EVENT: vrf = 0, local = 10.13.199.251, remote = 172.23.63.20/500 IKE SA state changed from IKE_P1_STATE_SEND2 to IKE_P1_STATE_SEND4. *May 20 12:49:28:045 2026 WJ_EXT3_RT01_MSR3620 IKE/7/PACKET: vrf = 0, local = 10.13.199.251, remote = 172.23.63.20/500 Sending packet to 172.23.63.20 remote port 500, local port 500. *May 20 12:49:28:045 2026 WJ_EXT3_RT01_MSR3620 IKE/7/PACKET: vrf = 0, local = 10.13.199.251, remote = 172.23.63.20/500 I-COOKIE: 1a67fa8e1fbc574c R-COOKIE: 95dd47d6007618ea next payload: KE version: ISAKMP Version 1.0 exchange mode: Main flags: message ID: 0 length: 240 *May 20 12:49:28:045 2026 WJ_EXT3_RT01_MSR3620 IKE/7/PACKET: vrf = 0, local = 10.13.199.251, remote = 172.23.63.20/500 Sending an IPv4 packet. *May 20 12:49:28:045 2026 WJ_EXT3_RT01_MSR3620 IKE/7/EVENT: vrf = 0, local = 10.13.199.251, remote = 172.23.63.20/500 Sent data to socket successfully. *May 20 12:49:28:140 2026 WJ_EXT3_RT01_MSR3620 IKE/7/EVENT: Received packet successfully. *May 20 12:49:28:140 2026 WJ_EXT3_RT01_MSR3620 IKE/7/PACKET: vrf = 0, local = 10.13.199.251, remote = 172.23.63.20/500 Received packet from 172.23.63.20 source port 500 destination port 500. *May 20 12:49:28:140 2026 WJ_EXT3_RT01_MSR3620 IKE/7/PACKET: vrf = 0, local = 10.13.199.251, remote = 172.23.63.20/500 I-COOKIE: 1a67fa8e1fbc574c R-COOKIE: 95dd47d6007618ea next payload: ID version: ISAKMP Version 1.0 exchange mode: Main flags: ENCRYPT message ID: 0 length: 92 *May 20 12:49:28:140 2026 WJ_EXT3_RT01_MSR3620 IKE/7/EVENT: IKE threa
核心结论
- 故障根因：MSR3620 V7 版本，同一段对端网段 + 同一个 IKE Profile + 预共享密钥场景下，默认单远端网段最大并发 IKE SA 限制 = 16 条，第 17 条直接协商卡死，阶段 1 走到加密报文后中断，终端显示 FLAG unknown。
- 你的 debug 日志：阶段 1 参数全部匹配、密钥匹配、NAT-T/DPD 正常，卡在最后加密身份校验无法完成，就是硬件 / 平台并发配额打满，不是配置不匹配。
- 组网痛点：所有分支都用同一公网出口 IP、同一远端网段段匹配、同一 IKE 策略，触发 16 条硬限制。
一、查看当前已占用数量
display ike sa count
二、四种解决办法（优先级从易到难）
方案 1：释放闲置 VPN 链路（最快应急）
# 清除闲置/异常IKE SA
reset ike sa all
# 定时老化空闲会话，缩短存活时间
ike profile profile2
sa duration 3600
方案 2：拆分对端网段，破除同网段 16 条限制（推荐正式方案）
match remote identity address 172.23.63.0 255.255.255.0
- 把下联分支内网拆成多个小子网段例：172.23.63.0/26、172.23.63.64/26……
- 中心端新建多个 IKE Profile、多个 KeyChain，分别匹配不同小子网
- 每个独立 Profile 单独占用 16 条名额，无限堆叠扩容
- 分支对应修改本端网段、协商密钥、中心策略模板
方案 3：改用野蛮模式 + ID 区分（不改网段最优）
原理
中心端关键配置修改
# 1. ike-profile 开启野蛮模式
ike profile profile2
exchange-mode aggressive
# 2. 不用IP匹配，改用名称匹配
undo match remote identity address 172.**.63.0 255.255.255.0
match remote identity name branch01
match remote identity name branch02
# 批量多分支依次新增名称
# 3. 预共享密钥绑定对端名称
ike keychain key2
pre-shared-key name branch01 cipher 密钥
pre-shared-key name branch02 cipher 密钥
分支设备同步修改
- IKE 协商模式改为野蛮模式
- 本端标识 ID 填写对应名称（branch01/branch02）
- 密钥保持一致
方案 4：设备版本升级扩容配额
三、你现场必排小问题
- 协商卡在加密阶段、终端 flag unknown：就是达到平台会话上限丢弃报文，无其他配置错误
- 不要反复新建 policy-template，同模板依旧共享 16 条配额
- 开启 DPD 保活，及时剔除离线分支，自动释放名额
ike profile profile2
dpd interval 15 retry 3
最简落地建议
暂无评论
编辑答案
亲~登录后才可以操作哦!
确定你的邮箱还未认证，请认证邮箱或绑定手机后进行当前操作
举报
×
侵犯我的权益
×
侵犯了我企业的权益
×
- 1. 您举报的内容是什么？（请在邮件中列出您举报的内容和链接地址）
- 2. 您是谁？（身份证明材料，可以是身份证或护照等证件）
- 3. 是哪家企业？（营业执照，单位登记证明等证件）
- 4. 您与该企业的关系是？（您是企业法人或被授权人，需提供企业委托授权书）
抄袭了我的内容
×
原文链接或出处
诽谤我
×
- 1. 您举报的内容以及侵犯了您什么权益？（请在邮件中列出您举报的内容、链接地址，并给出简短的说明）
- 2. 您是谁？（身份证明材料，可以是身份证或护照等证件）
对根叔社区有害的内容
×
不规范转载
×
举报说明
暂无评论