☰

站点到站点 Ipsec VPN - 隧道已启动，但无法从左到右路由包

tag-icon • tag-icon amazon-ec2 amazon-web-services ipsec cisco-asa tunnel
站点到站点 Ipsec VPN - 隧道已启动，但无法从左到右路由包

我有一个正常工作的隧道。数据包从右到左正确路由（思科端可以到达我的服务器）。

以上就是全部信息。如有任何帮助，欢迎提供。

网络图

                                                                                       +-----------------------+
                                                                                       |  machine #1           |
  +-----------------------------+                                                      |                       |
  |  Strongswan ipsec client    |   +--------------+           +--------------+    /---|  eth0 192.168.100.88  |
  |  Ubuntu 14.04 - aws ec2     |---|   aws gw     |-----------|  CISCO ASA   |----    +-----------------------+
  |                             |---|   A.A.A.A    |-----------|  B.B.B.B     |---     +-----------------------+
  |  eth0 172.31.9.78           |   +--------------+           +--------------+   \--- |  machine #2           |
  +-----------------------------+                                                      |                       |
                                                                                       |  eth0 192.168.100.91  |
                                                                                       +-----------------------+

我只需要从/到拨打隧道的同一主机进行访问。

Ipsec 配置

Ipsec 特定

root@ip-172-31-9-78:/home/ubuntu# cat /etc/ipsec.conf
# /etc/ipsec.conf - Openswan IPsec configuration file

version 2.0 # conforms to second version of ipsec.conf specification

config setup  
  dumpdir=/var/run/pluto/
  nat_traversal=yes
  virtual_private=%v4:192.168.0.0/16
  oe=off
  protostack=netkey
  plutostderrlog=/tmp/pluto.log

include /etc/ipsec.d/*.conf

隧道

root@ip-172-31-9-78:/home/ubuntu# cat /etc/ipsec.d/test.conf 
conn test
    type=tunnel
    keyexchange=ike
    auto=start
    # ours/theirs
    left=%defaultroute
    leftid=A.A.A.A
    leftsourceip=172.31.9.78
    leftnexthop=%defaultroute 
    leftsubnets={172.31.9.78/32,}
    right=B.B.B.B
    rightsubnets={192.168.100.88/32,192.168.100.91/32,}
    rightnexthop=%defaultroute
    #phase1
    aggrmode=no
    ike="3des-sha1;modp1024!"
    ikelifetime=86400s
    authby=secret
    #phase2
    keylife=3600s
    phase2=esp
    phase2alg="3des-md5;modp1024"
    pfs=no

IPsec 状态

root@ip-172-31-9-78:/home/ubuntu# ipsec auto --status
000 using kernel interface: netkey
000 interface lo/lo ::1
000 interface lo/lo 127.0.0.1
000 interface lo/lo 127.0.0.1
000 interface eth0/eth0 172.31.9.78
000 interface eth0/eth0 172.31.9.78
000 %myid = (none)
000 debug none
000  
000 virtual_private (%priv):
000 - allowed 1 subnet: 192.168.0.0/16
000 - disallowed 0 subnets: 
000 WARNING: Disallowed subnets in virtual_private= is empty. If you have 
000          private address space in internal use, it should be excluded!
000  
000 algorithm ESP encrypt: id=2, name=ESP_DES, ivlen=8, keysizemin=64, keysizemax=64
000 algorithm ESP encrypt: id=3, name=ESP_3DES, ivlen=8, keysizemin=192, keysizemax=192
000 algorithm ESP encrypt: id=6, name=ESP_CAST, ivlen=8, keysizemin=40, keysizemax=128
000 algorithm ESP encrypt: id=7, name=ESP_BLOWFISH, ivlen=8, keysizemin=40, keysizemax=448
000 algorithm ESP encrypt: id=11, name=ESP_NULL, ivlen=0, keysizemin=0, keysizemax=0
000 algorithm ESP encrypt: id=12, name=ESP_AES, ivlen=8, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: id=13, name=ESP_AES_CTR, ivlen=8, keysizemin=160, keysizemax=288
000 algorithm ESP encrypt: id=14, name=ESP_AES_CCM_A, ivlen=8, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: id=15, name=ESP_AES_CCM_B, ivlen=8, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: id=16, name=ESP_AES_CCM_C, ivlen=8, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: id=18, name=ESP_AES_GCM_A, ivlen=8, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: id=19, name=ESP_AES_GCM_B, ivlen=8, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: id=20, name=ESP_AES_GCM_C, ivlen=8, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: id=22, name=ESP_CAMELLIA, ivlen=8, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: id=252, name=ESP_SERPENT, ivlen=8, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: id=253, name=ESP_TWOFISH, ivlen=8, keysizemin=128, keysizemax=256
000 algorithm ESP auth attr: id=1, name=AUTH_ALGORITHM_HMAC_MD5, keysizemin=128, keysizemax=128
000 algorithm ESP auth attr: id=2, name=AUTH_ALGORITHM_HMAC_SHA1, keysizemin=160, keysizemax=160
000 algorithm ESP auth attr: id=5, name=AUTH_ALGORITHM_HMAC_SHA2_256, keysizemin=256, keysizemax=256
000 algorithm ESP auth attr: id=6, name=AUTH_ALGORITHM_HMAC_SHA2_384, keysizemin=384, keysizemax=384
000 algorithm ESP auth attr: id=7, name=AUTH_ALGORITHM_HMAC_SHA2_512, keysizemin=512, keysizemax=512
000 algorithm ESP auth attr: id=8, name=AUTH_ALGORITHM_HMAC_RIPEMD, keysizemin=160, keysizemax=160
000 algorithm ESP auth attr: id=9, name=AUTH_ALGORITHM_AES_CBC, keysizemin=128, keysizemax=128
000 algorithm ESP auth attr: id=251, name=AUTH_ALGORITHM_NULL_KAME, keysizemin=0, keysizemax=0
000  
000 algorithm IKE encrypt: id=0, name=(null), blocksize=16, keydeflen=131
000 algorithm IKE encrypt: id=5, name=OAKLEY_3DES_CBC, blocksize=8, keydeflen=192
000 algorithm IKE encrypt: id=7, name=OAKLEY_AES_CBC, blocksize=16, keydeflen=128
000 algorithm IKE hash: id=1, name=OAKLEY_MD5, hashsize=16
000 algorithm IKE hash: id=2, name=OAKLEY_SHA1, hashsize=20
000 algorithm IKE hash: id=4, name=OAKLEY_SHA2_256, hashsize=32
000 algorithm IKE hash: id=6, name=OAKLEY_SHA2_512, hashsize=64
000 algorithm IKE dh group: id=2, name=OAKLEY_GROUP_MODP1024, bits=1024
000 algorithm IKE dh group: id=5, name=OAKLEY_GROUP_MODP1536, bits=1536
000 algorithm IKE dh group: id=14, name=OAKLEY_GROUP_MODP2048, bits=2048
000 algorithm IKE dh group: id=15, name=OAKLEY_GROUP_MODP3072, bits=3072
000 algorithm IKE dh group: id=16, name=OAKLEY_GROUP_MODP4096, bits=4096
000 algorithm IKE dh group: id=17, name=OAKLEY_GROUP_MODP6144, bits=6144
000 algorithm IKE dh group: id=18, name=OAKLEY_GROUP_MODP8192, bits=8192
000 algorithm IKE dh group: id=22, name=OAKLEY_GROUP_DH22, bits=1024
000 algorithm IKE dh group: id=23, name=OAKLEY_GROUP_DH23, bits=2048
000 algorithm IKE dh group: id=24, name=OAKLEY_GROUP_DH24, bits=2048
000  
000 stats db_ops: {curr_cnt, total_cnt, maxsz} :context={0,4,64} trans={0,4,3072} attrs={0,4,2048} 
000  
000 "test/1x1": 172.31.9.78/32===172.31.9.78[A.A.A.A]---172.31.0.1...172.31.0.1---B.B.B.B<B.B.B.B>===192.168.100.88/32; erouted; eroute owner: #2
000 "test/1x1":     myip=172.31.9.78; hisip=unset;
000 "test/1x1":   ike_life: 86400s; ipsec_life: 3600s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0 
000 "test/1x1":   policy: PSK+ENCRYPT+TUNNEL+UP+IKEv2ALLOW+SAREFTRACK+lKOD+rKOD; prio: 32,32; interface: eth0; 
000 "test/1x1":   newest ISAKMP SA: #0; newest IPsec SA: #2; 
000 "test/1x1":   aliases: test 
000 "test/1x1":   IKE algorithms wanted: 3DES_CBC(5)_000-SHA1(2)_000-MODP1024(2); flags=strict
000 "test/1x1":   IKE algorithms found:  3DES_CBC(5)_192-SHA1(2)_160-MODP1024(2)
000 "test/1x1":   ESP algorithms wanted: 3DES(3)_000-MD5(1)_000; pfsgroup=MODP1024(2); flags=-strict
000 "test/1x1":   ESP algorithms loaded: 3DES(3)_192-MD5(1)_128
000 "test/1x1":   ESP algorithm newest: 3DES_000-HMAC_MD5; pfsgroup=<N/A>
000 "test/1x2": 172.31.9.78/32===172.31.9.78[A.A.A.A]---172.31.0.1...172.31.0.1---B.B.B.B<B.B.B.B>===192.168.100.91/32; erouted; eroute owner: #3
000 "test/1x2":     myip=172.31.9.78; hisip=unset;
000 "test/1x2":   ike_life: 86400s; ipsec_life: 3600s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0 
000 "test/1x2":   policy: PSK+ENCRYPT+TUNNEL+UP+IKEv2ALLOW+SAREFTRACK+lKOD+rKOD; prio: 32,32; interface: eth0; 
000 "test/1x2":   newest ISAKMP SA: #1; newest IPsec SA: #3; 
000 "test/1x2":   aliases: test 
000 "test/1x2":   IKE algorithms wanted: 3DES_CBC(5)_000-SHA1(2)_000-MODP1024(2); flags=strict
000 "test/1x2":   IKE algorithms found:  3DES_CBC(5)_192-SHA1(2)_160-MODP1024(2)
000 "test/1x2":   IKE algorithm newest: 3DES_CBC_192-SHA1-MODP1024
000 "test/1x2":   ESP algorithms wanted: 3DES(3)_000-MD5(1)_000; pfsgroup=MODP1024(2); flags=-strict
000 "test/1x2":   ESP algorithms loaded: 3DES(3)_192-MD5(1)_128
000 "test/1x2":   ESP algorithm newest: 3DES_000-HMAC_MD5; pfsgroup=<N/A>
000  
000 #2: "test/1x1":4500 STATE_QUICK_I2 (sent QI2, IPsec SA established); EVENT_SA_REPLACE in 2827s; newest IPSEC; eroute owner; isakmp#1; idle; import:admin initiate
000 #2: "test/1x1" [email protected] [email protected] [email protected] [email protected] ref=0 refhim=4294901761
000 #3: "test/1x2":4500 STATE_QUICK_I2 (sent QI2, IPsec SA established); EVENT_SA_REPLACE in 2814s; newest IPSEC; eroute owner; isakmp#1; idle; import:admin initiate
000 #3: "test/1x2" [email protected] [email protected] [email protected] [email protected] ref=0 refhim=4294901761
000 #1: "test/1x2":4500 STATE_MAIN_I4 (ISAKMP SA established); EVENT_SA_REPLACE in 85524s; newest ISAKMP; lastdpd=-1s(seq in:0 out:0); idle; import:admin initiate
000

ipsec 客户端创建的路由

root@ip-172-31-9-78:/home/ubuntu# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         172.31.0.1      0.0.0.0         UG    0      0        0 eth0
172.31.0.0      0.0.0.0         255.255.240.0   U     0      0        0 eth0
192.168.100.88  172.31.0.1      255.255.255.255 UGH   0      0        0 eth0
192.168.100.91  172.31.0.1      255.255.255.255 UGH   0      0        0 eth0

root@ip-172-31-9-78:/home/ubuntu# iptables-save 
# Generated by iptables-save v1.4.21 on Mon Jul 24 19:02:56 2017
*mangle
:PREROUTING ACCEPT [4894:367857]
:INPUT ACCEPT [4894:367857]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [4276:1113850]
:POSTROUTING ACCEPT [4276:1113850]
COMMIT
# Completed on Mon Jul 24 19:02:56 2017
# Generated by iptables-save v1.4.21 on Mon Jul 24 19:02:56 2017
*nat
:PREROUTING ACCEPT [14:732]
:INPUT ACCEPT [14:732]
:OUTPUT ACCEPT [55:5293]
:POSTROUTING ACCEPT [55:5293]
COMMIT
# Completed on Mon Jul 24 19:02:56 2017
# Generated by iptables-save v1.4.21 on Mon Jul 24 19:02:56 2017
*filter
:INPUT ACCEPT [4880:366977]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [4270:1113146]
COMMIT
# Completed on Mon Jul 24 19:02:56 2017

iptables 目录

root@ip-172-31-9-78:/home/ubuntu# iptables-save 
# Generated by iptables-save v1.4.21 on Mon Jul 24 19:02:56 2017
*mangle
:PREROUTING ACCEPT [4894:367857]
:INPUT ACCEPT [4894:367857]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [4276:1113850]
:POSTROUTING ACCEPT [4276:1113850]
COMMIT
# Completed on Mon Jul 24 19:02:56 2017
# Generated by iptables-save v1.4.21 on Mon Jul 24 19:02:56 2017
*nat
:PREROUTING ACCEPT [14:732]
:INPUT ACCEPT [14:732]
:OUTPUT ACCEPT [55:5293]
:POSTROUTING ACCEPT [55:5293]
COMMIT
# Completed on Mon Jul 24 19:02:56 2017
# Generated by iptables-save v1.4.21 on Mon Jul 24 19:02:56 2017
*filter
:INPUT ACCEPT [4880:366977]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [4270:1113146]
COMMIT
# Completed on Mon Jul 24 19:02:56 2017

更多网络信息

root@ip-172-31-9-78:/home/ubuntu# ip -4 r s t 0
default via 172.31.0.1 dev eth0 
172.31.0.0/20 dev eth0  proto kernel  scope link  src 172.31.9.78 
192.168.100.88 via 172.31.0.1 dev eth0  src 172.31.9.78 
192.168.100.91 via 172.31.0.1 dev eth0  src 172.31.9.78 
broadcast 127.0.0.0 dev lo  table local  proto kernel  scope link  src 127.0.0.1 
local 127.0.0.0/8 dev lo  table local  proto kernel  scope host  src 127.0.0.1 
local 127.0.0.1 dev lo  table local  proto kernel  scope host  src 127.0.0.1 
broadcast 127.255.255.255 dev lo  table local  proto kernel  scope link  src 127.0.0.1 
broadcast 172.31.0.0 dev eth0  table local  proto kernel  scope link  src 172.31.9.78 
local 172.31.9.78 dev eth0  table local  proto kernel  scope host  src 172.31.9.78 
broadcast 172.31.15.255 dev eth0  table local  proto kernel  scope link  src 172.31.9.78 

root@ip-172-31-9-78:/home/ubuntu# ip xfrm state
src B.B.B.B dst 172.31.9.78
  proto esp spi 0x6f8873a1 reqid 16389 mode tunnel
  replay-window 32 flag af-unspec
  auth-trunc hmac(md5) 0x05b373222ad4daac5521eb298a481dac 96
  enc cbc(des3_ede) 0xfcede6f6c8cffb7304d6c9ca9c4da1d63ac2dc29725a424b
  encap type espinudp sport 4500 dport 4500 addr 0.0.0.0
src 172.31.9.78 dst B.B.B.B
  proto esp spi 0x1a18194a reqid 16389 mode tunnel
  replay-window 32 flag af-unspec
  auth-trunc hmac(md5) 0xacb3443ae9ffe117668f21d55d2a1455 96
  enc cbc(des3_ede) 0xbdac161ab97da8c31b90ceaccff7a8aab89b96db050c9b21
  encap type espinudp sport 4500 dport 4500 addr 0.0.0.0
src B.B.B.B dst 172.31.9.78
  proto esp spi 0x3eb55fbb reqid 16385 mode tunnel
  replay-window 32 flag af-unspec
  auth-trunc hmac(md5) 0xec9d09a4b6c7d42053d80906651de513 96
  enc cbc(des3_ede) 0x715e1e4b3ce93148fb27bfcc9605765315abe2a57fff47c5
  encap type espinudp sport 4500 dport 4500 addr 0.0.0.0
src 172.31.9.78 dst B.B.B.B
  proto esp spi 0xe24dae0c reqid 16385 mode tunnel
  replay-window 32 flag af-unspec
  auth-trunc hmac(md5) 0xc4be41a91ce1ad369ce1f6ee4ee12d90 96
  enc cbc(des3_ede) 0xd1bc33105a6ae27d4557d0105d35bda82b46a25b2816d9d3
  encap type espinudp sport 4500 dport 4500 addr 0.0.0.0

Ping 输出

root@ip-172-31-9-78:/home/ubuntu# ping 192.168.100.88
PING 192.168.100.88 (192.168.100.88) 56(84) bytes of data.

当我 ping 或尝试访问右侧的 Web 服务时，我可以看到一些数据包通过隧道。它们都超时了。

root@ip-172-31-9-78:/home/ubuntu# tcpdump -v -n dst B.B.B.B
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
19:26:15.502376 IP (tos 0x0, ttl 64, id 4889, offset 0, flags [DF], proto UDP (17), length 144)
    172.31.9.78.4500 > B.B.B.B.4500: UDP-encap: ESP(spi=0x18759fd1,seq=0x1), length 116
19:26:16.509400 IP (tos 0x0, ttl 64, id 5073, offset 0, flags [DF], proto UDP (17), length 144)
    172.31.9.78.4500 > B.B.B.B.4500: UDP-encap: ESP(spi=0x18759fd1,seq=0x2), length 116
19:26:17.517442 IP (tos 0x0, ttl 64, id 5122, offset 0, flags [DF], proto UDP (17), length 144)
    172.31.9.78.4500 > B.B.B.B.4500: UDP-encap: ESP(spi=0x18759fd1,seq=0x3), length 116
19:26:18.525418 IP (tos 0x0, ttl 64, id 5218, offset 0, flags [DF], proto UDP (17), length 144)
    172.31.9.78.4500 > B.B.B.B.4500: UDP-encap: ESP(spi=0x18759fd1,seq=0x4), length 116
19:26:19.533404 IP (tos 0x0, ttl 64, id 5239, offset 0, flags [DF], proto UDP (17), length 144)
    172.31.9.78.4500 > B.B.B.B.4500: UDP-encap: ESP(spi=0x18759fd1,seq=0x5), length 116
19:26:20.541386 IP (tos 0x0, ttl 64, id 5411, offset 0, flags [DF], proto UDP (17), length 144)
    172.31.9.78.4500 > B.B.B.B.4500: UDP-encap: ESP(spi=0x18759fd1,seq=0x6), length 116
19:26:21.549451 IP (tos 0x0, ttl 64, id 5554, offset 0, flags [DF], proto UDP (17), length 144)
    172.31.9.78.4500 > B.B.B.B.4500: UDP-encap: ESP(spi=0x18759fd1,seq=0x7), length 116

答案1

我的配置没有问题。这是客户端 rackspace cisco 防火墙的配置问题。

我认为我这边的路由设置不正确。供以后参考，如果您使用 tcpdump 看到数据包从隧道传出，则说明您这边的路由正常。

相关内容