我正在尝试在客户端站点的 Ubuntu StrongSwan（在 Azure 中）和 Cisco ASA 之间创建 S2S VPN。
当前正在使用 ikev1（思科几个月内不会支持 v2）并且它似乎无法生成交易，而思科从未回复过。
思科配置
crypto map outside_map 56 match address xodia_56_cryptomap
crypto map outside_map 56 set pfs
crypto map outside_map 56 set peer 23.99.58.75
crypto map outside_map 56 set transform-set ESP-AES-256-SHA
crypto map outside_map 56 set nat-t-disable
tunnel-group 23.99.58.75 type ipsec-l2l
tunnel-group 23.99.58.75 ipsec-attributes
pre-shared-key *****
network-object host 10.110.120.10
network-object host 10.110.121.10
access-list xodia_56_cryptomap extended permit ip object-group DM_INLINE_NETWORK_86 object-group GROUP1
crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
强天鹅
closeaction=clear
keyexchange=ikev1
dpdaction=clear
leftsourceip=%config
esp=aes256-modp1024
ike=aes-sha-modp1024
reauth=no
mobike=no
ikelifetime=86400s
keylife=86400s
keyingtries=%forever
authby=secret
left=%any #23.99.58.75
leftid=@local
leftfirewall=no
leftsubnet=10.110.120.10/32
right=xx.xx.xx.xx
rightid=xx.xx.xx.xx
rightsubnet=192.168.0.0/24
auto=start
ipsec.secrets 未显示 - 它通过了身份验证部分
StrongSwan 调试（charondebug=“ike 4，knl 2，cfg 2”）
[IKE] IKE_SA azure[1] state change: CONNECTING => ESTABLISHED
[IKE] scheduling rekeying in 85436s
[IKE] maximum IKE_SA lifetime 85976s
[IKE] queueing MODE_CONFIG task
[IKE] activating new tasks
[IKE] activating MODE_CONFIG task
[IKE] Hash => 20 bytes @ 0x5603d8dc2000
[ENC] generating TRANSACTION request 1632003282 [ HASH CPRQ(ADDR DNS U_SPLITINC U_LOCALLAN) ]
[IKE] next IV for MID 1632003282 => 16 bytes @ 0x5603d8dc1440
[IKE] 0: 11 59 2E E1 00 9A 13 5D 39 54 FF F8 05 8B BF 19 .Y.....]9T......
[IKE] next IV for MID 1632003282 => 16 bytes @ 0x5603d8dc1a60
[IKE] 0: 32 F5 3A 90 1C 85 58 B6 00 5F 63 20 AC 0B 38 7F 2.:...X.._c ..8.
[NET] sending packet: from 10.110.120.10[500] to xx.xx.xx.xx[500] (92 bytes)
[IKE] sending retransmit 1 of request message ID 1632003282, seq 4
[NET] sending packet: from 10.110.120.10[500] to xx.xx.xx.xx[500] (92 bytes)
[IKE] sending retransmit 2 of request message ID 1632003282, seq 4
[NET] sending packet: from 10.110.120.10[500] to xx.xx.xx.xx[500] (92 bytes)
最后是网络跟踪
20:15:34.541555 IP 10.110.120.10.500 > xx.xx.xx.xx.500: isakmp: phase 1 I ident
20:15:34.619380 IP xx.xx.xx.xx.500 > 10.110.120.10.500: isakmp: phase 1 R ident
20:15:34.620326 IP 10.110.120.10.500 > xx.xx.xx.xx.500: isakmp: phase 1 I ident
20:15:34.698551 IP xx.xx.xx.xx.500 > 10.110.120.10.500: isakmp: phase 1 R ident
20:15:34.699464 IP 10.110.120.10.500 > xx.xx.xx.xx.500: isakmp: phase 1 I ident[E]
20:15:34.777798 IP xx.xx.xx.xx.500 > 10.110.120.10.500: isakmp: phase 2/others ? inf[E]
20:15:34.777806 IP xx.xx.xx.xx.500 > 10.110.120.10.500: isakmp: phase 1 R ident[E]
20:15:34.778195 IP 10.110.120.10.500 > xx.xx.xx.xx.500: isakmp: phase 2/others I #6[E]
20:15:38.778508 IP 10.110.120.10.500 > xx.xx.xx.xx.500: isakmp: phase 2/others I #6[E]
20:15:45.978860 IP 10.110.120.10.500 > xx.xx.xx.xx.500: isakmp: phase 2/others I #6[E]
答案1
Cisco 盒子可能不期望模式配置交换（这是由 strongSwan 发起的 TRANSACTION 交换）。因此，请尝试删除leftsourceip=%config。