我们在周末交换到了 ASA，并替换了之前基于 openvpn 的 VPN 基础设施，现在在我们的 ASA 5520 和其他具有 linux（CentOS）路由器的站点之间使用 IPSec。
VPN 连接正常，但一段时间后连接失败。在 ASA 上，它显示对等端没有 ipsec SA，但它显示 isakmp sa 仍处于活动状态。如果我清除连接两端的 SA，VPN 将再次恢复。
我假设问题是一个重新密钥问题，但看起来所有提案的密钥生命周期都相同（如下所示）。您认为问题可能出在哪里？
笔记-- 我混淆了这些捕获的 IP 地址；我怀疑我的提议有问题，所以 IP 应该不相关。假设所有 IP 都是占位符。
ASA 显示运行加密
crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec security-association lifetime seconds 86400
crypto dynamic-map OUTSIDE_DYN_MAP 10 set ikev1 transform-set ESP-3DES-SHA
crypto dynamic-map OUTSIDE_DYN_MAP 10 set security-association lifetime seconds 288000
crypto dynamic-map OUTSIDE_DYN_MAP 10 set reverse-route
crypto map vpnmap 10 match address colo1_to_hq_vpn
crypto map vpnmap 10 set pfs
crypto map vpnmap 10 set peer 1.1.1.1
crypto map vpnmap 10 set ikev1 transform-set ESP-3DES-SHA
crypto map vpnmap 20 match address colo1_to_colo2_vpn
crypto map vpnmap 20 set pfs
crypto map vpnmap 20 set peer 2.2.2.2
crypto map vpnmap 20 set ikev1 transform-set ESP-3DES-SHA
crypto map vpnmap 65500 ipsec-isakmp dynamic OUTSIDE_DYN_MAP
crypto map vpnmap interface OUTSIDE
crypto isakmp identity address
crypto isakmp nat-traversal 300
crypto ikev1 enable OUTSIDE
crypto ikev1 policy 1
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
ASA 显示 crypto isakmp sa 详细信息
IKEv1 SAs:
Active SA: 2
Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
Total IKE SA: 2
1 IKE Peer: x.x.x.x
Type : L2L Role : responder
Rekey : no State : AM_ACTIVE
Encrypt : 3des Hash : SHA
Auth : preshared Lifetime: 86400
Lifetime Remaining: 85905
2 IKE Peer: y.y.y.y
Type : L2L Role : initiator
Rekey : no State : MM_ACTIVE
Encrypt : 3des Hash : SHA
Auth : preshared Lifetime: 86400
Lifetime Remaining: 85976
ASA 显示加密 ipsec sa
peer address: x.x.x.x
Crypto map tag: vpnmap, seq num: 10, local addr: y.y.y.y
access-list peer1_to_hq_vpn extended permit ip z.z.z.z 255.255.0.0 t.t.t.t 255.255.0.0
local ident (addr/mask/prot/port): (9.9.0.0/255.255.0.0/0/0)
remote ident (addr/mask/prot/port): (8.8.0.0/255.255.0.0/0/0)
current_peer: 38.104.67.142
#pkts encaps: 4714, #pkts encrypt: 4714, #pkts digest: 4714
#pkts decaps: 4672, #pkts decrypt: 4672, #pkts verify: 4672
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 4714, #pkts comp failed: 0, #pkts decomp failed: 0
#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
#send errors: 0, #recv errors: 0
local crypto endpt.: 1.1.1.1/0, remote crypto endpt.: 2.2.2.2/0
path mtu 1500, ipsec overhead 58, media mtu 1500
current outbound spi: 06596006
current inbound spi : 55EC97A1
inbound esp sas:
spi: 0x55EC97A1 (1441568673)
transform: esp-3des esp-sha-hmac no compression
in use settings ={L2L, Tunnel, PFS Group 2, }
slot: 0, conn_id: 204800, crypto-map: vpnmap
sa timing: remaining key lifetime (sec): 85731
IV size: 8 bytes
replay detection support: Y
Anti replay bitmap:
0xFFFFFFFF 0xBFFFFFFF
outbound esp sas:
spi: 0x06596006 (106520582)
transform: esp-3des esp-sha-hmac no compression
in use settings ={L2L, Tunnel, PFS Group 2, }
slot: 0, conn_id: 204800, crypto-map: vpnmap
sa timing: remaining key lifetime (sec): 85731
IV size: 8 bytes
replay detection support: Y
Anti replay bitmap:
0x00000000 0x00000001
CentOS IPSec 配置：
TYPE=IPSEC
ONBOOT=YES
IKE_METHOD=PSK
SRCGW=1.1.1.1
DSTGW=2.2.2.2
SRCNET=1.1.1.1/16
DSTNET=2.2.2.2/16
DST=64.34.119.71
AH_PROTO=none
浣熊配置：
sainfo anonymous
{
pfs_group 2;
lifetime time 24 hour;
encryption_algorithm 3des, blowfish 448, rijndael;
authentication_algorithm hmac_sha1, hmac_md5;
compression_algorithm deflate;
}
remote 1.2.3.4
{
exchange_mode aggressive, main;
my_identifier address;
proposal {
encryption_algorithm 3des;
hash_algorithm sha1;
authentication_method pre_shared_key;
dh_group 2;
}
}
相关的 SAD/SPD 条目：
64.34.119.71 38.104.67.142
esp mode=tunnel spi=106520582(0x06596006) reqid=0(0x00000000)
E: 3des-cbc 8973cb22 ce1ab25c c4a4427c aac0c857 06917359 9b88e01e
A: hmac-sha1 3655fb9b e6882226 829f2214 0b22ec27 8155587b
seq=0x00000000 replay=4 flags=0x00000000 state=mature
created: Apr 16 11:30:43 2012 current: Apr 16 11:36:58 2012
diff: 375(s) hard: 86400(s) soft: 69120(s)
last: Apr 16 11:30:43 2012 hard: 0(s) soft: 0(s)
current: 898519(bytes) hard: 0(bytes) soft: 0(bytes)
allocated: 2749 hard: 0 soft: 0
sadb_seq=3 pid=12574 refcnt=0
38.104.67.142 64.34.119.71
esp mode=tunnel spi=1441568673(0x55ec97a1) reqid=0(0x00000000)
E: 3des-cbc 0f5bdfdc 23b140f8 4636326f f194fa0d 6a919f28 a6974b5f
A: hmac-sha1 586e3bf7 794960e1 e9da8707 5863e94d e88e0a11
seq=0x00000000 replay=4 flags=0x00000000 state=mature
created: Apr 16 11:30:43 2012 current: Apr 16 11:36:58 2012
diff: 375(s) hard: 86400(s) soft: 69120(s)
last: Apr 16 11:30:43 2012 hard: 0(s) soft: 0(s)
current: 645624(bytes) hard: 0(bytes) soft: 0(bytes)
allocated: 2764 hard: 0 soft: 0
sadb_seq=0 pid=12574 refcnt=0
1.1.0.0/16[any] 2.2.0.0/16[any] any
in prio def ipsec
esp/tunnel/1.1.1.1-2.2.2.2/require
created: Apr 16 11:30:12 2012 lastused:
lifetime: 0(s) validtime: 0(s)
spid=12784 seq=59 pid=12583
refcnt=1
2.2.0.0/16[any] 1.1.0.0/16[any] any
out prio def ipsec
esp/tunnel/1.1.1.1-2.2.2.2/require
created: Apr 16 11:30:12 2012 lastused: Apr 16 11:37:59 2012
lifetime: 0(s) validtime: 0(s)
spid=12777 seq=57 pid=12583
refcnt=402
1.1.0.0/16[any] 2.2.0.0/16[any] any
fwd prio def ipsec
esp/tunnel/1.1.1.1-2.2.2.2/require
created: Apr 16 11:30:12 2012 lastused: Apr 16 11:37:59 2012
lifetime: 0(s) validtime: 0(s)
spid=12794 seq=55 pid=12583
refcnt=54
答案1
问题的原因在于 CentOS 中的 racoon 版本 (ipsec-tools-0.6.5) 似乎在正确重新密钥方面存在错误。我从源代码编译了最新的 ipsec-tools，结果问题没有再次出现。
总结- 在反复撞墙之前，请先升级 ipsec-tools。