带有 racoon 的 ipsec vpn 在第一阶段重新协商时丢弃流量

带有 racoon 的 ipsec vpn 在第一阶段重新协商时丢弃流量

我们在 Linux 上运行 racoon 来连接 Checkpoint 防火墙。连接正常,但是我们发现每 24 小时就会出现一次流量中断,这与第 1 阶段的重新协商相对应。

我们的设置如下:

本地端

来自 ipsec-tools 0.8.0 的 racoon 从 Amazon Linux 上的 RPM 安装。

本地IP:10.130.0.253
本地子网:10.130.0.252/30

它运行在 AWS VPC 内,即在私有子网上。因此我们启用了 NAT 遍历。我们将 VPN 绑定到子接口,并使用 iptables 将 VPN 连接转换为主地址,并将发往远程 LAN 的 NAT 流量转换为子接口。这允许主机充当其他主机的 VPN 网关,效果很好。Iptables 规则:

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         
SNAT       all  --  10.130.0.253         2.2.2.2       to:10.100.200.112
SNAT       all  --  0.0.0.0/0            10.128.80.0/24       to:10.130.0.253

远端:

VPN 网关 IP:2.2.2.2(匿名)
远程子网:10.128.80.0/24

我们的本地配置如下:

/etc/racoon/racoon.conf:

# Racoon IKE daemon configuration file.
# See 'man racoon.conf' for a description of the format and entries.

log debug2;

path include "/etc/racoon";
path pre_shared_key "/etc/racoon/psk.txt";
path certificate "/etc/racoon/certs";
path script "/etc/racoon/scripts";


# Listen on sub-interface - initial connection to establish tunnel is translated to primary IP by iptables
listen {
  isakmp 10.130.0.253 [500];
  isakmp_natt 10.130.0.253 [4500];
}

timer {
 natt_keepalive 1 minute ;
}


# CP VPN-1
remote 2.2.2.2
{
  exchange_mode main;
  lifetime time 24 hour;

  nat_traversal on;

  dpd_delay 20;


  proposal {
    encryption_algorithm 3des;
    hash_algorithm sha1;
    authentication_method pre_shared_key;
    dh_group 2;
  }
}

# net-to-net
sainfo address 10.130.0.252/30 any address 10.128.80.0/24 any
{
  pfs_group 2;
        lifetime time 1 hour;
        encryption_algorithm 3des;
        authentication_algorithm hmac_sha1 ;
        compression_algorithm deflate ;
}

# gateway to gateway
sainfo address 10.130.0.253/32 any address 2.2.2.2/32 any
{
        lifetime time 1 hour;
        encryption_algorithm 3des;
        authentication_algorithm hmac_sha1 ;
        compression_algorithm deflate ;
}

设置密钥的命令

#!/sbin/setkey -f

# First of all flush the SPD database
flush;
spdflush;

# Gateway to Gateway
spdadd 10.130.0.253 2.2.2.2 any -P out ipsec esp/tunnel/10.130.0.253-2.2.2.2/unique;
spdadd 2.2.2.2 10.130.0.253 any -P in  ipsec esp/tunnel/2.2.2.2-10.130.0.253/unique;


# Linux-racoon -> CP VPN-1
spdadd 10.130.0.252/30 10.128.80.0/24 any -P out ipsec esp/tunnel/10.130.0.253-2.2.2.2/unique;

# CP VPN-1 > Linux-racoon
spdadd 10.128.80.0/24 10.130.0.252/30 any -P in  ipsec esp/tunnel/2.2.2.2-10.130.0.253/unique;

最近,我们在监控 VPN 时收到一些警报,因此我设置了一个更详细的监控脚本,该脚本每分钟连接到远程服务器一次。似乎我们每 24 小时就会出现一次严重的停机时间。我的脚本显示连接何时断开以及何时恢复:

Fri Jan 18 20:24:33 UTC 2013 Connection went down
Fri Jan 18 20:48:36 UTC 2013 Connection came up

Sat Jan 19 20:48:36 UTC 2013 Connection went down
Sat Jan 19 21:00:40 UTC 2013 Connection came up

Sun Jan 20 21:00:38 UTC 2013 Connection went down
Sun Jan 20 21:12:43 UTC 2013 Connection came up

如您所见,该连接在上次建立后 24 小时恰好断开。

这些中断似乎与 VPN 日志中的第 1 阶段重新协商相对应,这是有道理的,因为第 1 阶段的生命周期为 24 小时:

星期五:

Jan 18 20:24:32 ip-10-100-200-112 racoon: INFO: ISAKMP-SA expired 10.130.0.253[500]-2.2.2.2[500] spi:13b2510d0bc467f9:ff649237b81a65b7
Jan 18 20:24:32 ip-10-100-200-112 racoon: INFO: ISAKMP-SA deleted 10.130.0.253[500]-2.2.2.2[500] spi:13b2510d0bc467f9:ff649237b81a65b7
Jan 18 20:36:34 ip-10-100-200-112 racoon: INFO: IPsec-SA expired: ESP/Tunnel 2.2.2.2[500]->10.130.0.253[500] spi=213727991(0xcbd3af7)
Jan 18 20:36:34 ip-10-100-200-112 racoon: INFO: IPsec-SA expired: ESP/Tunnel 10.130.0.253[500]->2.2.2.2[500] spi=3400029604(0xcaa855a4)
Jan 18 20:48:34 ip-10-100-200-112 racoon: INFO: IPsec-SA expired: ESP/Tunnel 2.2.2.2[500]->10.130.0.253[500] spi=213727991(0xcbd3af7)
Jan 18 20:48:34 ip-10-100-200-112 racoon: INFO: IPsec-SA expired: ESP/Tunnel 10.130.0.253[500]->2.2.2.2[500] spi=3400029604(0xcaa855a4)
Jan 18 20:48:34 ip-10-100-200-112 racoon: INFO: IPsec-SA request for 2.2.2.2 queued due to no phase1 found.
Jan 18 20:48:34 ip-10-100-200-112 racoon: INFO: initiate new phase 1 negotiation: 10.130.0.253[500]<=>2.2.2.2[500]
Jan 18 20:48:34 ip-10-100-200-112 racoon: INFO: begin Identity Protection mode.
Jan 18 20:48:34 ip-10-100-200-112 racoon: INFO: ISAKMP-SA established 10.130.0.253[500]-2.2.2.2[500] spi:c4978718cd291fde:01245a461d26cc34
Jan 18 20:48:35 ip-10-100-200-112 racoon: INFO: initiate new phase 2 negotiation: 10.130.0.253[500]<=>2.2.2.2[500]
Jan 18 20:48:35 ip-10-100-200-112 racoon: INFO: IPsec-SA established: ESP/Tunnel 10.130.0.253[500]->2.2.2.2[500] spi=264213233(0xfbf92f1)
Jan 18 20:48:35 ip-10-100-200-112 racoon: INFO: IPsec-SA established: ESP/Tunnel 10.130.0.253[500]->2.2.2.2[500] spi=919162535(0x36c94ea7)

周六:

Jan 19 20:48:34 ip-10-100-200-112 racoon: INFO: ISAKMP-SA expired 10.130.0.253[500]-2.2.2.2[500] spi:c4978718cd291fde:01245a461d26cc34
Jan 19 20:48:34 ip-10-100-200-112 racoon: INFO: ISAKMP-SA deleted 10.130.0.253[500]-2.2.2.2[500] spi:c4978718cd291fde:01245a461d26cc34
Jan 19 20:48:36 ip-10-100-200-112 racoon: INFO: IPsec-SA expired: ESP/Tunnel 2.2.2.2[500]->10.130.0.253[500] spi=229822093(0xdb2ce8d)
Jan 19 20:48:36 ip-10-100-200-112 racoon: INFO: IPsec-SA expired: ESP/Tunnel 10.130.0.253[500]->2.2.2.2[500] spi=2536548534(0x9730a8b6)
Jan 19 21:00:36 ip-10-100-200-112 racoon: INFO: IPsec-SA expired: ESP/Tunnel 2.2.2.2[500]->10.130.0.253[500] spi=229822093(0xdb2ce8d)
Jan 19 21:00:36 ip-10-100-200-112 racoon: INFO: IPsec-SA expired: ESP/Tunnel 10.130.0.253[500]->2.2.2.2[500] spi=2536548534(0x9730a8b6)
Jan 19 21:00:37 ip-10-100-200-112 racoon: INFO: IPsec-SA request for 2.2.2.2 queued due to no phase1 found.
Jan 19 21:00:37 ip-10-100-200-112 racoon: INFO: initiate new phase 1 negotiation: 10.130.0.253[500]<=>2.2.2.2[500]
Jan 19 21:00:37 ip-10-100-200-112 racoon: INFO: begin Identity Protection mode.
Jan 19 21:00:38 ip-10-100-200-112 racoon: INFO: ISAKMP-SA established 10.130.0.253[500]-2.2.2.2[500] spi:8b7e98a2cc9d55cb:0b4e8a4cbca2ada9
Jan 19 21:00:38 ip-10-100-200-112 racoon: INFO: initiate new phase 2 negotiation: 10.130.0.253[500]<=>2.2.2.2[500]
Jan 19 21:00:39 ip-10-100-200-112 racoon: INFO: IPsec-SA established: ESP/Tunnel 10.130.0.253[500]->2.2.2.2[500] spi=111999639(0x6acfa97)
Jan 19 21:00:39 ip-10-100-200-112 racoon: INFO: IPsec-SA established: ESP/Tunnel 10.130.0.253[500]->2.2.2.2[500] spi=577442054(0x226b1106)

星期日:

Jan 20 21:00:38 ip-10-100-200-112 racoon: INFO: ISAKMP-SA expired 10.130.0.253[500]-2.2.2.2[500] spi:8b7e98a2cc9d55cb:0b4e8a4cbca2ada9
Jan 20 21:00:38 ip-10-100-200-112 racoon: INFO: ISAKMP-SA deleted 10.130.0.253[500]-2.2.2.2[500] spi:8b7e98a2cc9d55cb:0b4e8a4cbca2ada9
Jan 20 21:00:39 ip-10-100-200-112 racoon: INFO: IPsec-SA expired: ESP/Tunnel 2.2.2.2[500]->10.130.0.253[500] spi=131435403(0x7d58b8b)
Jan 20 21:00:39 ip-10-100-200-112 racoon: INFO: IPsec-SA expired: ESP/Tunnel 10.130.0.253[500]->2.2.2.2[500] spi=272995718(0x10459586)
Jan 20 21:12:39 ip-10-100-200-112 racoon: INFO: IPsec-SA expired: ESP/Tunnel 2.2.2.2[500]->10.130.0.253[500] spi=131435403(0x7d58b8b)
Jan 20 21:12:39 ip-10-100-200-112 racoon: INFO: IPsec-SA expired: ESP/Tunnel 10.130.0.253[500]->2.2.2.2[500] spi=272995718(0x10459586)
Jan 20 21:12:40 ip-10-100-200-112 racoon: INFO: IPsec-SA request for 2.2.2.2 queued due to no phase1 found.
Jan 20 21:12:40 ip-10-100-200-112 racoon: INFO: initiate new phase 1 negotiation: 10.130.0.253[500]<=>2.2.2.2[500]
Jan 20 21:12:40 ip-10-100-200-112 racoon: INFO: begin Identity Protection mode.
Jan 20 21:12:40 ip-10-100-200-112 racoon: INFO: ISAKMP-SA established 10.130.0.253[500]-2.2.2.2[500] spi:e6d2b9ccb25f4992:31807020144b9a1e
Jan 20 21:12:41 ip-10-100-200-112 racoon: INFO: initiate new phase 2 negotiation: 10.130.0.253[500]<=>2.2.2.2[500]
Jan 20 21:12:41 ip-10-100-200-112 racoon: INFO: IPsec-SA established: ESP/Tunnel 10.130.0.253[500]->2.2.2.2[500] spi=179370287(0xab0f92f)
Jan 20 21:12:41 ip-10-100-200-112 racoon: INFO: IPsec-SA established: ESP/Tunnel 10.130.0.253[500]->2.2.2.2[500] spi=1696204357(0x651a0645)

因此,第一阶段重新协商似乎至少需要 12 分钟。有人知道这可能是为什么吗?我们可以做些什么来解决这个问题,以便我们能够通过 VPN 实现不间断的流量?

答案1

如果您启用死对等检测,Racoon 应该会检测第 1 阶段的到期情况,并自动重新协商,假设我已经正确诊断了问题。

默认情况下,dpd 是关闭的;

dpd_delay 0;是默认值。

在 dpd 检查之间设置一个合理的数字(以秒为单位)将启用它;

dpd_延迟 30;

现在愤怒地在做同样事情的 ipsec vpn 上尝试这个。

答案2

抱歉,我得自己回答这个问题——我从 ipsec-tools 转到 Openswan,现在 VPN 已经完全稳定了。看来 ipsec-tools 是一个死项目,而 Openswan 仍在维护,现在是 RHEL 中的默认 VPN 解决方案。

相关内容