问

SECPATH F100-C-G2 ipsec VPN的配置步骤以及如何故障检测(web方式）？

IPSec VPN

2019-01-29提问

0关注
1收藏，986浏览

zhiliao_uCOt0

zhiliao_uCOt0 零段

粉丝：0人关注：0人

问题描述：

VPN ipsec 策略再web页面配置生成后，还需配置其他的么? acl自动生成了。

如果和对端不通，要如何测试问题原因？

对端cisco设备

最佳答案

已采纳

你猜猜看

你猜猜看九段

粉丝：26人关注：2人

display ike sa

display ipsec sa

看看这两个的状态是否正常，确认是协商到第一还是第二阶段没有起来；

可以看下案例分析http://kms2.h3c.com/Search.aspx?keyword=ipsec

Process SA payload. *Jan 29 21:59:19:954 2019 H3C IKE/7/PACKET: vrf = 0, src = 180.155.122.133, dst = 101.95.170.98/500 Check ISAKMP transform 1. *Jan 29 21:59:19:954 2019 H3C IKE/7/PACKET: vrf = 0, src = 180.155.122.133, dst = 101.95.170.98/500 Lifetime type is 1. *Jan 29 21:59:19:954 2019 H3C IKE/7/PACKET: vrf = 0, src = 180.155.122.133, dst = 101.95.170.98/500 Life duration is 28800. *Jan 29 21:59:19:954 2019 H3C IKE/7/PACKET: vrf = 0, src = 180.155.122.133, dst = 101.95.170.98/500 Encryption algorithm is 3DES-CBC. *Jan 29 21:59:19:954 2019 H3C IKE/7/PACKET: vrf = 0, src = 180.155.122.133, dst = 101.95.170.98/500 Authentication method is Pre-shared key. *Jan 29 21:59:19:954 2019 H3C IKE/7/PACKET: vrf = 0, src = 180.155.122.133, dst = 101.95.170.98/500 HASH algorithm is HMAC-SHA1. *Jan 29 21:59:19:954 2019 H3C IKE/7/PACKET: vrf = 0, src = 180.155.122.133, dst = 101.95.170.98/500 DH group is 2. *Jan 29 21:59:19:954 2019 H3C IKE/7/EVENT: vrf = 0, src = 180.155.122.133, dst = 101.95.170.98/500 Pre-shared key matching address 101.95.170.98 not found. *Jan 29 21:59:19:954 2019 H3C IKE/7/ERROR: vrf = 0, src = 180.155.122.133, dst = 101.95.170.98/500 No acceptable transform. *Jan 29 21:59:19:954 2019 H3C IKE/7/ERROR: vrf = 0, src = 180.155.122.133, dst = 101.95.170.98/500 Failed to parse the IKE SA payload. *Jan 29 21:59:19:954 2019 H3C IKE/7/PACKET: vrf = 0, src = 180.155.122.133, dst = 101.95.170.98/500 Construct notification packet: NO_PROPOSAL_CHOSEN. *Jan 29 21:59:19:954 2019 H3C IKE/7/PACKET: vrf = 0, src = 180.155.122.133, dst = 101.95.170.98/500 Sending packet to 101.95.170.98 remote port 500, local port 500. *Jan 29 21:59:19:954 2019 H3C IKE/7/PACKET: vrf = 0, src = 180.155.122.133, dst = 101.95.170.98/500 I-COOKIE: 6f2c8c487cb284b4 R-COOKIE: 0000000000000000 next payload: NOTIFY version: ISAKMP Version 1.0 exchange mode: Info flags: message ID: 0 length: 56 *Jan 29 21:59:19:954 2019 H3C IKE/7/PACKET: vrf = 0, src = 180.155.122.133, dst = 101.95.170.98/500 Sending an IPv4 packet. *Jan 29 21:59:19:955 2019 H3C IKE/7/EVENT: vrf = 0, src = 180.155.122.133, dst = 101.95.170.98/500 Sent data to socket successfully. *Jan 29 21:59:19:955 2019 H3C IKE/7/ERROR: vrf = 0, src = 180.155.122.133, dst = 101.95.170.98/500 Failed to negotiate IKE SA. 能看下这报错怎么回事么？

zhiliao_uCOt0 发表时间：2019-01-29

1. 首先检查两端设备是否可以相互ping通，保证两端设备通信正常。 2. 检查两端设备配置是否一致，主要从感兴趣流、预共享密钥确认一致、ike算法确认一致。 3. 确认下两端设备出接口上是否有NAT业务，如果有NAT业务的话，流量会先匹配NAT模块走掉而不匹配IPSec，所以需要在NAT的acl中先配置rule deny掉感兴趣流。对于V5平台的设备就方便得多，可以在外网口配置ipsec no-nat-process enable这个命令来实现。

你猜猜看发表时间：2019-01-30