R1与R5配置gre over ipsec,S5模拟互联网
R1无法建立ike sa
debugging ike error提示Can't find ike sa
组网见图,配置见附件
R1-fail是无法建立ike sa的配置
R1是正常建立链路的配置。
S5、R5是正常配置
已使用对比软件比较了R1和R1-fail的配置,gre over ipsec配置没有错误,但是R1就是无法建立ike sa
做过重启模拟设备的操作,也做过reset sa的操作,R1-fail的配置就是无法实现链路,难道是软件bug???
R1-fail:
#
interface LoopBack0
ip address 10.1.255.1 255.255.255.255
#
interface GigabitEthernet0/0
port link-mode route
description to sw1
combo enable copper
ip address 10.1.0.1 255.255.255.252
ospf network-type p2p
#
interface GigabitEthernet0/1
port link-mode route
description to sw5
combo enable copper
ip address 202.0.0.2 255.255.255.252
ipsec apply policy H3C
#
#
interface Tunnel1 mode gre
ip address 10.1.1.1 255.255.255.252
source 10.1.255.1
destination 10.1.255.5
keepalive 10 3
#
#
ipsec transform-set 1
esp encryption-algorithm des-cbc
esp authentication-algorithm md5
#
ipsec policy-template bsc 1
transform-set 1
local-address 202.0.0.2
remote-address 61.0.0.2
ike-profile r5
#
ipsec policy H3C 1 isakmp template bsc
#
ike profile r5
keychain r5
match remote identity address 61.0.0.2 255.255.255.255
match local address 202.0.0.2
#
ike keychain r5
pre-shared-key address 61.0.0.2 255.255.255.255 key cipher $c$3$q+E4T11g/aPTJdups9J3gDSfApkj8gt07J0=
#
R1:
#
interface LoopBack0
ip address 10.1.255.1 255.255.255.255
#
interface GigabitEthernet0/0
port link-mode route
description to sw1
combo enable copper
ip address 10.1.0.1 255.255.255.252
ospf network-type p2p
#
interface GigabitEthernet0/1
port link-mode route
description to sw5
combo enable copper
ip address 202.0.0.2 255.255.255.252
ipsec apply policy H3C
#
interface Tunnel1 mode gre
ip address 10.1.1.1 255.255.255.252
source 10.1.255.1
destination 10.1.255.5
keepalive 10 3
#
ipsec transform-set 1
esp encryption-algorithm des-cbc
esp authentication-algorithm md5
#
ipsec policy-template bsc 1
transform-set 1
local-address 202.0.0.2
remote-address 61.0.0.2
ike-profile r5
#
ipsec policy H3C 1 isakmp template bsc
#
ike profile r5
keychain r5
match remote identity address 61.0.0.2 255.255.255.255
match local address 202.0.0.2
#
ike keychain r5
pre-shared-key address 61.0.0.2 255.255.255.255 key cipher $c$3$zh+fC10I6Cj283H0NZziBvNW4u9AtA==
#
R5
#
interface LoopBack0
ip address 10.1.255.5 255.255.255.255
#
interface Tunnel1 mode gre
ip address 10.1.1.2 255.255.255.252
source 10.1.255.5
destination 10.1.255.1
keepalive 10 3
#
#
ip route-static 0.0.0.0 0 61.0.0.1
#
acl advanced 3015
rule 0 permit ip source 10.1.255.5 0 destination 10.1.255.1 0
#
ipsec transform-set 1
esp encryption-algorithm des-cbc
esp authentication-algorithm md5
#
ipsec policy H3C 1 isakmp
transform-set 1
security acl 3015
local-address 61.0.0.2
remote-address 202.0.0.2
ike-profile r1
#
ike profile r1
keychain r1
match remote identity address 202.0.0.2 255.255.255.255
match local address 61.0.0.2
#
ike keychain r1
pre-shared-key address 202.0.0.2 255.255.255.255 key cipher $c$3$tqleAbSQF7fPBXb57B7vxGLj0GaWcg==
#
S5
#
vlan 1
#
vlan 10
#
vlan 50
#
interface NULL0
#
interface Vlan-interface10
ip address 202.0.0.1 255.255.255.252
#
interface Vlan-interface50
ip address 61.0.0.1 255.255.255.252
#
interface GigabitEthernet1/0/1
port link-mode bridge
port access vlan 10
combo enable fiber
#
interface GigabitEthernet1/0/2
port link-mode bridge
port access vlan 50
combo enable fiber
#
(0)
最佳答案
亲~登录后才可以操作哦!
确定你的邮箱还未认证,请认证邮箱或绑定手机后进行当前操作
举报
×
侵犯我的权益
×
侵犯了我企业的权益
×
抄袭了我的内容
×
原文链接或出处
诽谤我
×
对根叔社区有害的内容
×
不规范转载
×
举报说明
暂无评论