问

S5660的IPSEC VPN证书加密不通问题

IPSec VPN

1天前提问

0关注
0收藏，47浏览

金海

金海零段

粉丝：0人关注：0人

问题描述：

debug日志：

*Sep 23 17:46:30:042 2026 LHB10-KFEXTLNS-5660 PKI/7/PKI_DEBUG: PKI_Certificate_ACP: Matches the attribute 1 in attribute group 'group1'. Checking the next attribute.

*Sep 23 17:46:30:042 2026 LHB10-KFEXTLNS-5660 PKI/7/PKI_DEBUG: PKI_Certificate_ACP: Matched rule number: 1, which has the action permit, in access control policy 'policy1'. The certificate is trusted.

*Sep 23 17:46:30:043 2026 LHB10-KFEXTLNS-5660 PKI/7/PKI_DEBUG: Get verify result from cache successfully.

*Sep 23 17:46:30:044 2026 LHB10-KFEXTLNS-5660 PKI/7/PKI_DEBUG: Verify certificate by domain srcb successfully.

*Sep 23 17:46:30:045 2026 LHB10-KFEXTLNS-5660 PKI/7/PKI_DEBUG: Get Local keypair successfully.

*Sep 23 17:46:30:045 2026 LHB10-KFEXTLNS-5660 PKI/7/PKI_DEBUG: Failed to get local certificate and keypair from cache.

*Sep 23 17:46:30:509 2026 LHB10-KFEXTLNS-5660 PKI/7/PKI_DEBUG: PKI_Certificate_ACP: Matches the attribute 1 in attribute group 'group1'. Checking the next attribute.

*Sep 23 17:46:30:509 2026 LHB10-KFEXTLNS-5660 PKI/7/PKI_DEBUG: PKI_Certificate_ACP: Matched rule number: 1, which has the action permit, in access control policy 'policy1'. The certificate is trusted.

*Sep 23 17:46:30:510 2026 LH-5660 PKI/7/PKI_DEBUG: Get verify result from cache successfully.

*Sep 23 17:46:30:511 2026 LH-5660 PKI/7/PKI_DEBUG: Verify certificate by domain srcb successfully.

*Sep 23 17:46:30:512 2026 LH-5660 PKI/7/PKI_DEBUG: Get Local keypair successfully.

*Sep 23 17:46:30:512 2026 LH-5660 PKI/7/PKI_DEBUG: Failed to get local certificate and keypair from cache.

组网及组网描述：

这是VPN配置

acl advanced 3004

rule 0 permit ip source x.x.x.x 0.0.0.15 destination y.y.y.y 0.0.1.255

ipsec policy-template template2 20

transform-set bjrenhangcjwy

security acl 3004

remote-address c.c.c.c

ike-profile bjrenhangcjwy

ipsec transform-set bjrenhangcjwy

esp encryption-algorithm 3des-cbc

esp authentication-algorithm sha1

ike profile bjrenhangcjwy

certificate domain srcb

dpd interval 10 on-demand

match remote identity address c.c.c.c 255.255.255.255

match remote certificate policy1

proposal 3

pki certificate access-control-policy policy1

rule 1 permit group1

pki domain srcb

certificate request from ca

certificate request entity srcb

public-key rsa general name local

undo crl check enable

pki entity srcb

common-name srcb

country cn

locality srcb

organization-unit srcb

organization srcb

ike dpd interval 30 retry 60 periodic

ike identity fqdn srcb

interface GigabitEthernet2/0/0

ipsec apply policy 30

3 个回答

按时间按赞数

沉鱼落雁_解决问题看主页

沉鱼落雁_解决问题看主页九段

粉丝：96人关注：0人

啥型号的交换机，手册没看到带证书的ipsec

zhiliao_Gixe

zhiliao_Gixe 九段

粉丝：16人关注：9人

请补充完整debug日志（特别是最后一行结尾、IPsec/IKE SA建立失败节点，如IKE协商失败、PKI证书验证拒绝、UDP/500/4500丢包、感兴趣流ACL/QoS丢包等）。
临时排查步骤与关键命令：
1. IKE/IPsec SA状态

display ike sa
display ipsec sa

2. 证书状态与PKI域

display pki certificate domain
display pki certificate crl
display pki domain

3. 时钟与证书有效期
确认设备系统时间在证书有效期内。
4. 完整Debug收集

terminal debugging
terminal monitor
debugging ike all
debugging ipsec all
debugging pki all

5. ACL与路由
确认感兴趣流ACL镜像对称，公网路由可达。

*Sep 23 11:26:36:554 2026 LHB10-KFEXTLNS-5660 IKE/7/PACKET: vrf = 0, local = 112.95.233.24, remote = 183.195.117.253/500 Construct notification packet: CERTIFICATE_UNAVAILABLE.这是最后一行结尾

金海发表时间：1天前 更多>>

金海发表时间：1天前