![StrongSwan 和 Zyxel NSG200 之间的站点到站点 IPSec](https://linux22.com/image/759738/StrongSwan%20%E5%92%8C%20Zyxel%20NSG200%20%E4%B9%8B%E9%97%B4%E7%9A%84%E7%AB%99%E7%82%B9%E5%88%B0%E7%AB%99%E7%82%B9%20IPSec.png)
我正在尝试在装有 StrongSwan 的 Debian 10 服务器和 Nebula NSG200 之间建立 IPSec 连接(站点到站点)。
假设:
- Debian 服务器:
- 公网 IP:50.50.50.45
- 私有网络:10.1.0.0/16
- 星云NSG200:
- 公网 IP:100.100.100.123
- 私有网络:10.40.0.0/24
但每次身份验证都会失败。我在 debian 的日志中收到以下消息。
我不明白为什么认证失败!
...
charon: 13[NET] received packet: from 100.100.100.123[500] to 50.50.50.45[500] (480 bytes)
charon: 13[ENC] parsed IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) V V V ]
charon: 13[ENC] received unknown vendor ID: xx:xx:xx:xx:xx:...
charon: 13[ENC] received unknown vendor ID: yy:yy:yy:yy:yy:...
charon: 13[ENC] received unknown vendor ID: zz:zz:zz:zz:zz:...
charon: 13[IKE] 100.100.100.123 is initiating an IKE_SA
charon: 13[CFG] selected proposal: IKE:AES_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_1024
charon: 13[IKE] remote host is behind NAT
charon: 13[ENC] generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(MULT_AUTH) ]
charon: 13[NET] sending packet: from 50.50.50.45[500] to 100.100.100.123[500] (312 bytes)
charon: 14[NET] received packet: from 100.100.100.123[4500] to 50.50.50.45[4500] (320 bytes)
charon: 14[ENC] parsed IKE_AUTH request 1 [ IDi CERTREQ AUTH SA TSi TSr N(HTTP_CERT_LOOK) N(INIT_CONTACT) N(ESP_TFC_PAD_N) N(NON_FIRST_FRAG) ]
charon: 14[IKE] received 1 cert requests for an unknown ca
charon: 14[CFG] looking for peer configs matching 50.50.50.45[%any]...100.100.100.123[10.0.1.250]
charon: 14[CFG] no matching peer config found
charon: 14[IKE] received ESP_TFC_PADDING_NOT_SUPPORTED, not using ESPv3 TFC padding
charon: 14[ENC] generating IKE_AUTH response 1 [ N(AUTH_FAILED) ]
charon: 14[NET] sending packet: from 50.50.50.45[4500] to 100.100.100.123[4500] (96 bytes)
...
StrongSwan 侧
/etc/ipsec.conf
:
config setup
charondebug="all"
uniqueids=yes
conn deb-to-neb
type=tunnel
auto=start
keyexchange=ikev2
authby=secret
left=100.100.100.123
leftsubnet=10.40.0.1/24
right=50.50.50.45
rightsubnet=10.1.0.1/16
ike=aes256-sha512-modp1024!
esp=aes256-sha512!
aggressive=yes
keyingtries=%forever
ikelifetime=86400s
lifetime=3600s
dpdaction=restart
/etc/ipsec.secrets
:
100.100.100.123 50.50.50.45 : PSK "MySuperSecret"
50.50.50.45 100.100.100.123 : PSK "MySuperSecret"
星云侧
- 阶段1
- IKE 版本 : IKEv2
- 加密:AES256
- 身份验证:SHA512
- Diffie-Hellman 集团:DH2
- 寿命(秒):86400
- 第 2 阶段(第 1 组)
- 加密:AES256
- 身份验证:SHA512
- PFS 集团:DH2
- 寿命(秒):3600
答案1
这不是身份验证错误,问题是您的配置不匹配:
charon: 14[CFG] looking for peer configs matching 50.50.50.45[%any]...100.100.100.123[10.0.1.250]
charon: 14[CFG] no matching peer config found
特别是远程身份。由于您尚未配置右标识,它默认为远程 IP 地址 ( 100.100.100.123
),但这与对等端发送的身份不匹配 ( 10.0.1.250
)。由于更改对等端的身份似乎不是一个选项(基于该屏幕截图),请尝试配置rightid=10.0.1.250
。
答案2
我让它工作了,但出于某种原因,我无法从托管 StrongSwan 的地方 ping 我的 Zyxel LAN。我可以通过我的 Zyxel LAN 网络 ping 和访问网络资源到我的 StrongSwan VPN 客户端/网络,也可以 ping。我遗漏了什么吗?请指教。