问

ipsec vpn debug 信息 ike 有信息 IPSec没建立

IPSec VPN

2019-09-16提问

0关注
1收藏，3842浏览

zhiliao_9eMiW

zhiliao_9eMiW 二段

粉丝：0人关注：0人

问题描述：

Ping 10.10.10.10 (10.10.10.10) from 10.255.245.254: 56 data bytes, press CTRL_C to break

*Sep 16 14:32:42:889 2019 UNSTABLE_7164 IPSEC/7/EVENT: Found block-flow node.

*Sep 16 14:32:42:889 2019 UNSTABLE_7164 IPSEC/7/PACKET:

Failed to find SA by SP, SP Index = 0, SP Convert-Seq = 65536.

*Sep 16 14:32:42:889 2019 UNSTABLE_7164 IPSEC/7/ERROR:

The reason of dropping packet is no available IPsec tunnel.

*Sep 16 14:32:45:090 2019 UNSTABLE_7164 IPSEC/7/EVENT:

Found block-flow node.

*Sep 16 14:32:45:090 2019 UNSTABLE_7164 IPSEC/7/PACKET:

Failed to find SA by SP, SP Index = 0, SP Convert-Seq = 65536.

*Sep 16 14:32:45:090 2019 UNSTABLE_7164 IPSEC/7/ERROR: The reason of dropping packet is no available IPsec tunnel.

*Sep 16 14:32:45:910 2019 UNSTABLE_7164 IKE/7/PACKET: vrf = 0, local = 111.26.220.26, remote = 119.51.91.90/4500 Retransmit phase 1 packet.

*Sep 16 14:32:45:910 2019 UNSTABLE_7164 IKE/7/PACKET: vrf = 0, local = 111.26.220.26, remote = 119.51.91.90/500

Sending packet to 119.51.91.90 remote port 500, local port 500.

*Sep 16 14:32:45:910 2019 UNSTABLE_7164 IKE/7/PACKET: vrf = 0, local = 111.26.220.26, remote = 119.51.91.90/500

I-COOKIE: ee348a891cbb92ab

R-COOKIE: 7b38fffb056475f0

next payload: ID

version: ISAKMP Version 1.0

exchange mode: Main

flags: ENCRYPT

message ID: 0 l

ength: 92

*Sep 16 14:32:45:910 2019 UNSTABLE_7164 IKE/7/PACKET: vrf = 0, local = 111.26.220.26, remote = 119.51.91.90/500 Sending an IPv4 packet. *Sep 16 14:32:45:911 2019 UNSTABLE_7164 IKE/7/EVENT: vrf = 0, local = 111.26.220.26, remote = 119.51.91.90/500 Sent data to socket successfully.

*Sep 16 14:32:45:939 2019 UNSTABLE_7164 IKE/7/EVENT: Received packet successfully.

*Sep 16 14:32:45:939 2019 UNSTABLE_7164 IKE/7/PACKET: vrf = 0, local = 111.26.220.26, remote = 119.51.91.90/500

Received packet from 119.51.91.90 source port 500 destination port 500.

*Sep 16 14:32:45:939 2019 UNSTABLE_7164 IKE/7/PACKET: vrf = 0, local = 111.26.220.26, remote = 119.51.91.90/500

I-COOKIE: ee348a891cbb92ab

R-COOKIE: 7b38fffb056475f0

next payload: NOTIFY

version: ISAKMP Version 1.0

exchange mode: Info

flags:

message ID: 0

length: 44

*Sep 16 14:32:45:939 2019 UNSTABLE_7164 IKE/7/EVENT: IKE thread 1099247506096 processes a job.

*Sep 16 14:32:45:939 2019 UNSTABLE_7164 IKE/7/EVENT: Info packet process started.

*Sep 16 14:32:45:939 2019 UNSTABLE_7164 IKE/7/EVENT: Received informational exchange packet, but IKE SA is inexistent or incomplete.

*Sep 16 14:32:47:291 2019 UNSTABLE_7164 IPSEC/7/EVENT: Found block-flow node.

*Sep 16 14:32:47:291 2019 UNSTABLE_7164 IPSEC/7/PACKET: Failed to find SA by SP, SP Index = 0, SP Convert-Seq = 65536.

*Sep 16 14:32:47:291 2019 UNSTABLE_7164 IPSEC/7/ERROR: The reason of dropping packet is no available IPsec tunnel.

*Sep 16 14:32:48:429 2019 UNSTABLE_7164 IKE/7/EVENT: Received Nat travel packet.

*Sep 16 14:32:48:429 2019 UNSTABLE_7164 IKE/7/EVENT: Received packet successfully.

*Sep 16 14:32:48:430 2019 UNSTABLE_7164 IKE/7/PACKET: vrf = 0, local = 111.26.220.26, remote = 119.51.91.90/4500 Received packet from 119.51.91.90 source port 4500 destination port 4500.

*Sep 16 14:32:48:430 2019 UNSTABLE_7164 IKE/7/PACKET: vrf = 0, local = 111.26.220.26, remote = 119.51.91.90/4500

I-COOKIE: a0d7b1cba26bc066

R-COOKIE: 121525478a0d85e1

next payload: HASH

version: ISAKMP Version 1.0

exchange mode: Info

flags: ENCRYPT

message ID: fde3692

length: 84

*Sep 16 14:32:48:430 2019 UNSTABLE_7164 IKE/7/EVENT: IKE thread 1099247506096 processes a job.

*Sep 16 14:32:48:430 2019 UNSTABLE_7164 IKE/7/EVENT: Info packet process started.

*Sep 16 14:32:48:430 2019 UNSTABLE_7164 IKE/7/PACKET: vrf = 0, local = 111.26.220.26, remote = 119.51.91.90/4500 Decrypt the packet.

*Sep 16 14:32:48:430 2019 UNSTABLE_7164 IKE/7/PACKET: vrf = 0, local = 111.26.220.26, remote = 119.51.91.90/4500 Received ISAKMP Hash Payload.

*Sep 16 14:32:48:430 2019 UNSTABLE_7164 IKE/7/PACKET: vrf = 0, local = 111.26.220.26, remote = 119.51.91.90/4500 Received ISAKMP Notification Payload.

*Sep 16 14:32:48:430 2019 UNSTABLE_7164 IKE/7/PACKET: vrf = 0, local = 111.26.220.26, remote = 119.51.91.90/4500 Parse informational exchange packet successfully.

*Sep 16 14:32:48:430 2019 UNSTABLE_7164 IKE/7/EVENT: vrf = 0, local = 111.26.220.26, remote = 119.51.91.90/4500 Notification R_U_THERE is received.

*Sep 16 14:32:48:431 2019 UNSTABLE_7164 IKE/7/DPD: vrf = 0, local = 111.26.220.26, remote = 119.51.91.90/4500 DPD packet with sequence number 21006 is received, COOKIEs(i/r) a0d7b1cba26bc066/121525478a0d85e1.

*Sep 16 14:32:48:431 2019 UNSTABLE_7164 IKE/7/EVENT: Sending DPD packet of type R_U_THERE_ACK with sequence number 21006.

*Sep 16 14:32:48:431 2019 UNSTABLE_7164 IKE/7/PACKET: vrf = 0, local = 111.26.220.26, remote = 119.51.91.90/4500 Encrypt the packet.

*Sep 16 14:32:48:431 2019 UNSTABLE_7164 IKE/7/PACKET: vrf = 0, local = 111.26.220.26, remote = 119.51.91.90/4500 Construct notification packet: R_U_THERE_ACK.

*Sep 16 14:32:48:431 2019 UNSTABLE_7164 IKE/7/PACKET: vrf = 0, local = 111.26.220.26, remote = 119.51.91.90/4500 Sending packet to 119.51.91.90 remote port 4500, local port 4500.

*Sep 16 14:32:48:431 2019 UNSTABLE_7164 IKE/7/PACKET: vrf = 0, local = 111.26.220.26, remote = 119.51.91.90/4500

I-COOKIE: a0d7b1cba26bc066

R-COOKIE: 121525478a0d85e1

next payload: HASH

version: ISAKMP Version 1.0

exchange mode: Info

flags: ENCRYPT

message ID: 5843da64

length: 84

*Sep 16 14:32:48:431 2019 UNSTABLE_7164 IKE/7/PACKET: vrf = 0, local = 111.26.220.26, remote = 119.51.91.90/4500 Sending an IPv4 packet.

*Sep 16 14:32:48:431 2019 UNSTABLE_7164 IKE/7/EVENT: vrf = 0, local = 111.26.220.26, remote = 119.51.91.90/4500 Sent data to socket successfully. Request time out

*Sep 16 14:32:49:492 2019 UNSTABLE_7164 IPSEC/7/EVENT: Found block-flow node.

*Sep 16 14:32:49:492 2019 UNSTABLE_7164 IPSEC/7/PACKET: Failed to find SA by SP, SP Index = 0, SP Convert-Seq = 65536.

*Sep 16 14:32:49:492 2019 UNSTABLE_7164 IPSEC/7/ERROR: The reason of dropping packet is no available IPsec tunnel. Request time out

*Sep 16 14:32:51:579 2019 UNSTABLE_7164 IKE/7/EVENT: Received packet successfully.

*Sep 16 14:32:51:579 2019 UNSTABLE_7164 IKE/7/EVENT: Ignore NAT keepalive packet.

*Sep 16 14:32:51:580 2019 UNSTABLE_7164 IKE/7/EVENT: Received packet successfully.

*Sep 16 14:32:51:580 2019 UNSTABLE_7164 IKE/7/EVENT: Ignore NAT keepalive packet.

*Sep 16 14:32:51:693 2019 UNSTABLE_7164 IPSEC/7/EVENT: Found block-flow node.

*Sep 16 14:32:51:693 2019 UNSTABLE_7164 IPSEC/7/PACKET: Failed to find SA by SP, SP Index = 0, SP Convert-Seq = 65536.

*Sep 16 14:32:51:693 2019 UNSTABLE_7164 IPSEC/7/ERROR: The reason of dropping packet is no available IPsec tunnel.

Sep 16 14:32:53:895 2019 UNSTABLE_7164 PING/6/PING_STATISTICS: Ping statistics for 10.10.10.10: 5 packet(s) transmitted, 0 packet(s) received, 100.0% packet loss.

*Sep 16 14:32:55:400 2019 UNSTABLE_7164 IKE/7/EVENT: Received packet successfully.

*Sep 16 14:32:55:400 2019 UNSTABLE_7164 IKE/7/PACKET: vrf = 0, local = 111.26.220.26, remote = 119.51.91.90/500 Received packet from 119.51.91.90 source port 500 destination port 500.

*Sep 16 14:32:55:400 2019 UNSTABLE_7164 IKE/7/PACKET: vrf = 0, local = 111.26.220.26, remote = 119.51.91.90/500

I-COOKIE: ee348a891cbb92ab

R-COOKIE: 7b38fffb056475f0

next payload: KE

version: ISAKMP

Version 1.0 exchange

mode: Main

flags: message

ID: 0

length: 220 *

Sep 16 14:32:55:400 2019 UNSTABLE_7164 IKE/7/EVENT: IKE thread 1099247506096 processes a job.

*Sep 16 14:32:55:400 2019 UNSTABLE_7164 IKE/7/EVENT: Phase1 process started. *Sep 16 14:32:55:400 2019 UNSTABLE_7164 IKE/7/PACKET: vrf = 0, local = 111.26.220.26, remote = 119.51.91.90/500

现在的问题是ike 能协商成功，ipsec 协商不起来

[UNSTABLE_3700]display ike sa

Connection-ID Remote Flag DOI ------------------------------------------------------------------

334 119.51.91.90 RD|RL IPsec