问

secpath F5010 ipsec vpn与Azure连接问题

IPSec VPN

2020-08-19提问

0关注
1收藏，2169浏览

zhiliao_witO0

zhiliao_witO0 零段

粉丝：0人关注：0人

问题描述：

通过interface Tunnel2 mode ipsec的隧道方式与Azure进行互联，IPSEC/IKE所有的配置参数均与Azure一致，但总是提示policy mismatch的错误。Azure端抓包信息如下：8/19/2020 7:56:00 AM|SESSION_ID :{26BAD525-C365-49DD-8602-84023D9FEA93} Remote 112.80.39.112:500: Local 40.72.97.210:500: [RECEIVED][NOTIFY] Received Notify Message - Policy Mismatch 8/19/2020 7:56:00 AM|SESSION_ID :{26BAD525-C365-49DD-8602-84023D9FEA93} Remote 112.80.39.112:500: Local 40.72.97.210:500: tunnelId 0xC5, iCOOKIE 0xFE32ACD3F06406F2 and rCOOKIE 0xCA8ACFB633F15903 No Phase2 qms left on active connection 8/19/2020 7:56:00 AM|SESSION_ID :{26BAD525-C365-49DD-8602-84023D9FEA93} Remote 112.80.39.112:500: Local 40.72.97.210:500: [LOCAL_MSG] IKE Tunnel closed for tunnelId 0xC5 with status Policy match errorF5010端Debug信息如下：Aug 17 14:30:18:995 2020 context B IKEV2/7/TIMER: -COntext=3; vrf = 0, src = 112.80.39.112, dst = 40.72.97.210/500 (Tunnel ID 73117): IKE SA hard lifetime is expired, and it will be deleted. *Aug 17 14:30:18:995 2020 context B IKEV2/7/FSM: -COntext=3; vrf = 0, src = 112.80.39.112, dst = 40.72.97.210/500 Next request message ID is outside of window. *Aug 17 14:30:22:908 2020 context B IPSEC/7/EVENT: -COntext=3; Tunnel0: SVTI acquire sa. *Aug 17 14:30:22:908 2020 context B IPSEC/7/EVENT: -COntext=3; Sent SA-Acquire message : SP ID = 0 *Aug 17 14:30:22:908 2020 context B IPSEC/7/EVENT: -COntext=3; Received negotiatiate SA message from IPsec kernel. *Aug 17 14:30:22:909 2020 context B IPSEC/7/EVENT: -COntext=3; Sent delete SA message to all nodes, message type is 0x16. *Aug 17 14:30:22:909 2020 context B IPSEC/7/EVENT: -COntext=3; The SA doesn't exist in kernel. *Aug 17 14:30:22:909 2020 context B IPSEC/7/EVENT: -COntext=3; Sent delete block-flow table message to Slot:0 Cpu:0, message type is 0x1b. *Aug 17 14:30:27:908 2020 context B IPSEC/7/EVENT: -COntext=3; Tunnel0: SVTI acquire sa. (adsbygoogle = window.adsbygoogle || []).push({ google_ad_client: "ca-pub-6208739752673518", enable_page_level_ads: true });

组网及组网描述：

设置列表有序列表无序列表如下为H3C F5010的配置信息：

最佳答案

zhiliao_witO0

zhiliao_witO0 知了小白

粉丝：0人关注：0人

通过interface Tunnel2 mode ipsec的隧道方式与Azure进行互联，IPSEC/IKE所有的配置参数均与Azure一致，但总是提示policy mismatch的错误。

Azure端抓包信息如下：

8/19/2020 7:56:00 AM|SESSION_ID :{26BAD525-C365-49DD-8602-84023D9FEA93} Remote 112.80.39.112:500: Local 40.72.97.210:500: [RECEIVED][NOTIFY] Received Notify Message - Policy Mismatch

8/19/2020 7:56:00 AM|SESSION_ID :{26BAD525-C365-49DD-8602-84023D9FEA93} Remote 112.80.39.112:500: Local 40.72.97.210:500: tunnelId 0xC5, iCOOKIE 0xFE32ACD3F06406F2 and rCOOKIE 0xCA8ACFB633F15903 No Phase2 qms left on active connection

8/19/2020 7:56:00 AM|SESSION_ID :{26BAD525-C365-49DD-8602-84023D9FEA93} Remote 112.80.39.112:500: Local 40.72.97.210:500: [LOCAL_MSG] IKE Tunnel closed for tunnelId 0xC5 with status Policy match error.

F5010端Debug信息如下：

Aug 17 14:30:18:995 2020 context B IKEV2/7/TIMER: -COntext=3; vrf = 0, src = 112.80.39.112, dst = 40.72.97.210/500 (Tunnel ID 73117): IKE SA hard lifetime is expired, and it will be deleted.

*Aug 17 14:30:18:995 2020 context B IKEV2/7/FSM: -COntext=3; vrf = 0, src = 112.80.39.112, dst = 40.72.97.210/500 Next request message ID is outside of window.

Aug 17 14:30:22:908 2020 context B IPSEC/7/EVENT: -COntext=3; Tunnel0: SVTI acquire sa.

Aug 17 14:30:22:908 2020 context B IPSEC/7/EVENT: -COntext=3; Sent SA-Acquire message : SP ID = 0 *Aug 17 14:30:22:908 2020 context B IPSEC/7/EVENT: -COntext=3; Received negotiatiate SA message from IPsec kernel.

*Aug 17 14:30:22:909 2020 context B IPSEC/7/EVENT: -COntext=3; Sent delete SA message to all nodes, message type is 0x16.

*Aug 17 14:30:22:909 2020 context B IPSEC/7/EVENT: -COntext=3; The SA doesn't exist in kernel.

*Aug 17 14:30:22:909 2020 context B IPSEC/7/EVENT: -COntext=3; Sent delete block-flow table message to Slot:0 Cpu:0, message type is 0x1b.

*Aug 17 14:30:27:908 2020 context B IPSEC/7/EVENT: -COntext=3; Tunnel0: SVTI acquire sa. (adsbygoogle = window.adsbygoogle || []).push({ google_ad_client: "ca-pub-6208739752673518", enable_page_level_ads: true });