☰

建立 IKE_SA 失败，对等方无响应

tag-icon • tag-icon vpn configuration strongswan
建立 IKE_SA 失败，对等方无响应

我对 VPN 还不熟悉。我使用 Strongswan 5.8.2 和 swan config 来建立 SA 并使用 PSK。我正在与一家公司合作，为我提供一些服务，他们给了我一个网关服务器 IP，我 ping 一下就可以访问。在我这边，swanctl 可以加载连接，systemctl 运行良好，但在我启动连接后，日志显示“建立 IKE_SA 失败，对等方无响应”和“写入套接字错误：网络不可达”。我为此使用了 CentOS 8。

这是我的 swanctl 配置：

connections {
    site-2-site {
        version = 1
        local_addrs = public-IP-site1
        remote_addrs = public-ip-site2
        local_port = 500
        remote_port = 500
        proposals = aes256-sha1-modp1536
        keyingtries = 1
        rekey_time = 86400s
        local {
                    auth = psk
                    id = public-IP-site1
        }
        remote {
            auth = psk
                    id = public-ip-site2
        }
        children {
                    site-2-site {
                            esp_proposals = aes128-sha1
                            local_ts = private-ip-site1
                            remote_ts = private-ip-site2
                            life_time = 3600s
                mode = tunnel
                }
        }
    }
}

secrets {
        secret = ThisIsPSKkey
        id-1a = public-ip-site1
        id-1b = public-ip-site2
}

当我启动连接时记录：

12[CFG] vici initiate CHILD_SA 'stickearn-to-cimb'
13[IKE] initiating Main Mode IKE_SA stickearn-to-cimb[3] to public-ip-site2
13[ENC] generating ID_PROT request 0 [ SA V V V V V ]
13[NET] sending packet: from public-ip-site1[500] to public-ip-site2[500] (184 bytes)
04[NET] error writing to socket: Network is unreachable
13[IKE] sending retransmit 1 of request message ID 0, seq 1
13[NET] sending packet: from public-ip-site1[500] to public-ip-site2[500] (184 bytes)
04[NET] error writing to socket: Network is unreachable
11[IKE] sending retransmit 2 of request message ID 0, seq 1
11[NET] sending packet: from public-ip-site1[500] to public-ip-site2[500] (184 bytes)
04[NET] error writing to socket: Network is unreachable
08[IKE] sending retransmit 3 of request message ID 0, seq 1
08[NET] sending packet: from public-ip-site1[500] to public-ip-site2[500] (184 bytes)
04[NET] error writing to socket: Network is unreachable
13[IKE] sending retransmit 4 of request message ID 0, seq 1
13[NET] sending packet: from public-ip-site1[500] to public-ip-site2[500] (184 bytes)
04[NET] error writing to socket: Network is unreachable
10[IKE] sending retransmit 5 of request message ID 0, seq 1
10[NET] sending packet: from public-ip-site1[500] to public-ip-site2[500] (184 bytes)
04[NET] error writing to socket: Network is unreachable
07[IKE] giving up after 5 retransmits
07[IKE] establishing IKE_SA failed, peer not responding

是防火墙的问题还是其他什么问题？我需要你的帮助。

答案1

我已经越过了障碍。你可以看到这里。

接下来您要做的就是制定防火墙规则以允许特定的 IP/端口。

相关内容