某局点V7型号MSR3610-IE-EAD路由器播入SSL VPN异常的处理案例

#

interface GigabitEthernet0/3

 port link-mode route

 ip address *.34.130.222 255.255.255.252

#

sslvpn ip address-pool ga *.168.50.0 192.168.51.250

#

interface SSLVPN-AC1

 ip address *.168.51.254 255.255.254.0

#

local-user sslvpn class network

 password cipher $c$3$LNNvjy7sDq5d8bfzlLTf3nCWjah2bIVrHg==

 service-type sslvpn

 authorization-attribute user-role network-operator

 authorization-attribute sslvpn-policy-group default

#

sslvpn gateway ga

 ip address *.34.130.222 port 55555

 service enable

#

sslvpn context ga

 gateway ga domain system

 ip-tunnel interface SSLVPN-AC1

 ip-tunnel address-pool ga mask 255.255.254.0

 ip-route-list 1

  include *.168.1.0 255.255.255.0

 policy-group default

  filter ip-tunnel acl 3101

  ip-tunnel access-route ip-route-list 1

 default-policy-group default

 aaa domain system

 service enable

#

domain system

#

 domain default enable system

#

（2）采集设备的ssl vpn播入过程debug记录。debug中报错bad record mac.，和使用web打开gateway的地址+端口报错内容相同：

*Dec 28 20:45:24:884 2021 H3C SSLVPNK/7/SSLVPN_DEBUG_KSSL_HANDSHAKE: Send: TLS 1.0Alert [length 0002], level: fatal, reason: bad_record_mac.

*Dec 28 20:45:24:884 2021 H3C SSLVPNK/7/SSLVPN_KSSL_PACKET:

 02 14

*Dec 28 20:45:24:884 2021 H3C SSLVPNK/7/SSLVPN_DEBUG_KSSL_INFO: SSL3 alert write, level: fatal, reason: bad record mac.

发现有bad record mac.的记录。

和如下使用电脑直接web访问*.34.130.222:55555网关地址端口的报错SSL_ERROR_BAD_MAC_ALERT相似。

开始怀疑是设备缺省证书的问题，于是对设备进行了系统的升级重装，但是升级重装了系统后故障依旧。