![ipsec strongswan debian LXC:收到 NO_PROPOSAL_CHOSEN 通知错误](https://linux22.com/image/714976/ipsec%20strongswan%20debian%20LXC%EF%BC%9A%E6%94%B6%E5%88%B0%20NO_PROPOSAL_CHOSEN%20%E9%80%9A%E7%9F%A5%E9%94%99%E8%AF%AF.png)
我正在尝试在同一物理服务器(Debian 也是如此)上的两个 LXC Debian Jessie 之间设置 IPSec 隧道。这是我的网络拓扑:
172.17.23.0/24 ---- 172.17.23.100 - VPN1 - 10.73.52.1 ==== 10.73.53.2 - VPN2 - 192.168.100.100 ---- 192.168.100.0/24
VPN1 和 VPN2 上的配置相同,我使用预共享密钥进行身份验证:
/etc/ipsec.conf 配置设置 charondebug="all" uniqueids=yes
conn %default
conn testconn
left=10.73.53.1
leftsubnet=172.17.23.0/24
right=10.73.53.2
rightsubnet=192.168.100.0/24
ike=aes128-sha1-modp1024
esp=aes128-sha1
keyingtries=0
ikelifetime=60m
auto=start
closeaction=restart
keylife=20m
rekeymargin=3m
keyexchange=ike
mobike=no
authby=secret
type=tunnel
/etc/ipsec.secrets 10.73.53.1 10.73.53.2 : PSK “PasswordHere”
我启动双方ipsec start
并建立text
连接ipsec up
root@vpn1:~# ipsec up testconn
initiating IKE_SA testconn[3] to 10.73.53.2
generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]
sending packet: from 10.73.53.1[500] to 10.73.53.2[500] (304 bytes)
received packet: from 10.73.53.2[500] to 10.73.53.1[500] (36 bytes)
parsed IKE_SA_INIT response 0 [ N(NO_PROP) ]
received NO_PROPOSAL_CHOSEN notify error
establishing connection 'testconn' failed
Idem pour vpn2.
我在系统日志中收到了类似的消息。
我不明白为什么我会得到这个NO_PROPOSAL_CHOSEN
,因为我正试图强制选择文件中使用的算法/etc/ipsec.conf
!
非常感谢您的帮助,如需更多信息,请随时询问。
编辑:这是从 VPN2(接收连接)的 /var/log/syslog 中提取的:
vpn2 charon: 07[NET] sending packet: from 10.73.53.2[500] to 10.73.53.1[500] (940 bytes)
vpn2 charon: 09[NET] received packet: from 10.73.53.1[500] to 10.73.53.2[500] (36 bytes)
vpn2 charon: 09[ENC] parsed IKE_SA_INIT response 0 [ N(NO_PROP) ]
vpn2 charon: 09[IKE] received NO_PROPOSAL_CHOSEN notify error
vpn2 charon: 10[NET] received packet: from 10.73.53.254[500] to 10.73.53.2[500] (940 bytes)
vpn2 charon: 10[ENC] parsed IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]
vpn2 charon: 10[IKE] no IKE config found for 10.73.53.2...10.73.53.254, sending NO_PROPOSAL_CHOSEN
我明白了no IKE config found
,谷歌搜索没有太大帮助 :/
EDIT2:这是输出ipsec statusall
:
root@vpn1:~# ipsec statusall
Status of IKE charon daemon (strongSwan 5.2.1, Linux 3.16.0-4-amd64, x86_64):
uptime: 46 minutes, since Dec 15 14:56:02 2017
malloc: sbrk 2408448, mmap 0, used 310128, free 2098320
worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled: 0
loaded plugins: charon aes rc2 sha1 sha2 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf gmp agent xcbc hmac gcm attr kernel-netlink resolve socket-default stroke updown
Listening IP addresses:
172.17.23.10
10.73.53.1
Connections:
test: 10.73.53.1...10.73.53.2 IKEv1/2
test: local: [10.73.53.1] uses pre-shared key authentication
test: remote: [10.73.53.2] uses pre-shared key authentication
test: child: 172.17.23.0/24 === 192.168.100.0/24 TUNNEL
Security Associations (0 up, 0 connecting):
none
root@vpn1:~#
我在服务器 VPN2 上有完全相同的操作(除了 172.17.23.0/24 更改为 192.168.100.0/24,它是 VPN2 端的本地子网)。
答案1
它与 strongswan 服务器上的配置的连接尝试不匹配。
如果运行“ipsec statusall”,输出结果是什么?命令可能是“strongswan statusall”——似乎每个发行版都不同,它会显示你已加载的配置