☰

站点到站点 VPN

tag-icon • tag-icon pfsense sonicwall site-to-site-vpn
站点到站点 VPN

我面临的问题是在 pfSense（版本 2.0.1）和 SonicWall Pro2040 Enhanced（固件版本：SonicOS Enhanced 4.2.1.4-7e）之间建立站点到站点 VPN。所有配置均已正确完成，但在 sonicwall 中仍然出现以下错误 -

“有效载荷处理失败”

第 1 阶段和第 2 阶段顺利通过，但“有效负载处理”问题我发现可能是共享密钥不匹配，但我仔细检查了一下，两个防火墙中的共享密钥都没有不匹配。SonicWall 还显示隧道处于活动状态

pfSense 的日志如下 -

答案1

这是我的 sonicwall 和 pfSense 的设置：

Sonicwall 上的“常规”选项卡：

Authentication Method: IKE using Pre shared Secret

Name:  pfSense Site-to-Site PN

IPsec Primary Gateway Name or Address: 1.1.1.1 | IP for pfSense

IPsec Secondary Gateway Name or Address: 0.0.0.0

Shared Secret: Shared secret for this connection

Local IKE ID:  2.2.2.2 | Select ‘IP Address’ from the drop down menu and then type WAN IP of Sonicwall



Network tab on Sonicwall:

Local Networks

Choose local network from list: 192.168.21.0 | Create an address object for the network or you can use the built in one ‘LAN Subnets’

Destination Networks

Choose destination network from list: 192.168.65.0 | Create an address object for the remote LAN network



Proposals Tab:

IKE (Phase 1) Proposal

By default pfSense supports ‘Main Mode’ and ‘Aggressive’.

Exchange: Aggressive

DH Group: Group 2

Encryption: 3DES

Authentication: SHA1

Life Time (seconds): 28800

Ipsec (Phase 2) Proposal

Protocol: ESP

Encryption: 3DES

Authentication: SHA1

Enable Perfect Forward Secrecy: Checked

Life Time: 86400



Advanced Tab:

Check ‘Enable Keep Alive’

相应的 pfSense 设置：

Phase 1:

Authentication method: Mutual PSK

Negotiation Mode: Aggressive

My identifier: 1.1.1.1 (IP Address of pfSense WAN)

Peer identifier: 2.2.2.2 (IP Address of Sonicwall)

Pre Shared Key: Your pre share key

Policy Generation: Default

Proposal Checking: Obey

Encryption Algorithm: 3DES

Hash algorithm: SHA1

DH key group: 2

Lifetime: 28800



Advanced options

Nat Traversal: Enable

Dead Peer Detection: Check Enable DPD



Phase 2:

Mode: Tunnel

Local Network: 192.168.65.0/24

Remote Network: 192.168.21.0/24

Protocol: ESP

Encryption algorithms: 3DES

Hash algorithms: SHA1

PFS key group: 2

Lifetime: 84600

请参阅我的文章如何使用 pfSense 配置 sonicwall。

相关内容