![数据包未进入 IPSEC 隧道 Juniper SRX](https://linux22.com/image/669545/%E6%95%B0%E6%8D%AE%E5%8C%85%E6%9C%AA%E8%BF%9B%E5%85%A5%20IPSEC%20%E9%9A%A7%E9%81%93%20Juniper%20SRX.png)
到亚马逊云的 IPSec 隧道不起作用。
我的本地子网是 192.168.42.0/24。我正在尝试访问 Amazon 云私有子网 172.0.3.0/24。
我的防火墙型号是 Juniper SRX550。隧道已启动(我可以看到 IPSEC 和 IKE 安全关联。我可以 ping 隧道 Amazon 端的隧道接口的远程 IP 地址。但来自我的内部子网的数据包无法正确进入隧道。当我从主机 192.168.42.131 地址 172.0.3.12 ping 时,我可以看到此会话:
Session ID: 278828, Policy name: trust-to-trust/17, State: Active, Timeout: 6, Valid
In: 192.168.42.131/2135 --> 172.0.3.12/1;icmp, If: reth1.480, Pkts: 63, Bytes: 3780
Out: 172.0.3.12/1 --> 192.168.42.131/2135;icmp, If: st0.9, Pkts: 0, Bytes: 0
即内部接口上的数据包大小不为零,但进入隧道时为零。
当我启用调试时,我看到的是:
Oct 27 01:03:40 01:03:40.108989:CID-1:RT:<192.168.42.131/1580->172.0.3.12/1;1> matched filter filter1:
Oct 27 01:03:40 01:03:40.108989:CID-1:RT:packet [60] ipid = 21642, @0x43cda0d2
Oct 27 01:03:40 01:03:40.108989:CID-1:RT:---- flow_process_pkt: (thd 5): flow_ctxt type 1, common flag 0x0, mbuf 0x43cd9e80, rtbl_idx = 0
Oct 27 01:03:40 01:03:40.108989:CID-1:RT: in_ifp <trust:st0.9>
Oct 27 01:03:40 01:03:40.108989:CID-1:RT:flow_process_pkt_exception: setting rtt in lpak to 0x5391d5b0
Oct 27 01:03:40 01:03:40.108989:CID-1:RT:pkt out of tunnel.Proceed normally
Oct 27 01:03:40 01:03:40.108989:CID-1:RT: st0.9:192.168.42.131->172.0.3.12, icmp, (8/0)
Oct 27 01:03:40 01:03:40.108989:CID-1:RT: find flow: table 0x51acfe50, hash 8971(0xffff), sa 192.168.42.131, da 172.0.3.12, sp 1580, dp 1, proto 1, tok 8
Oct 27 01:03:40 01:03:40.108989:CID-1:RT: flow got session.
Oct 27 01:03:40 01:03:40.108989:CID-1:RT: flow session id 247797
Oct 27 01:03:40 01:03:40.108989:CID-1:RT: vector bits 0x10224 vector 0x4ad53040
Oct 27 01:03:40 01:03:40.108989:CID-1:RT: vsd 1 is active
Oct 27 01:03:40 01:03:40.108989:CID-1:RT:ttl vector, out_tunnel = 0x59c7cc90
Oct 27 01:03:40 01:03:40.108989:CID-1:RT:pre-frag not needed: ipsize: 60, mtu: 1436, nsp2->pmtu: 1436
Oct 27 01:03:40 01:03:40.108989:CID-1:RT: encap vector
Oct 27 01:03:40 01:03:40.108989:CID-1:RT: going into tunnel 131082 (nsp_tunnel=0x59c7cc90).
Oct 27 01:03:40 01:03:40.108989:CID-1:RT: flow_encrypt: tun 0x59c7cc90, type 1
Oct 27 01:03:40 01:03:40.108989:CID-1:RT:mbuf 0x43cd9e80, exit nh 0x1d0010
Oct 27 01:03:40 01:03:40.108989:CID-1:RT:flow_process_pkt_exception: Freeing lpak 0x5128ee38 associated with mbuf 0x43cd9e80
Oct 27 01:03:40 01:03:40.108989:CID-1:RT: ----- flow_process_pkt rc 0x0 (fp rc 0)
我觉得这很正常。
有人知道如何解决吗?
谢谢。
答案1
问题出在亚马逊私有云端——一些路由问题。