• 全部
  • 經驗案例
  • 典型配置
  • 技術公告
  • FAQ
  • 漏洞說明
  • 全部
  • 是
  • 否
  • 全部
  • 是
  • 否
  • 大數據引擎
  • 知了引擎
產品線
搜索
取消
案例類型
發布者
是否解決
是否官方
時間
搜索引擎
匹配模式
高級搜索
問

ike失敗後無法協商成功

2024-11-27提問
  • 0關注
  • 0收藏，800瀏覽
LINHAOBIN
LINHAOBIN 零段
粉絲：0人 關注：0人

問題描述：

某一分支端突然無法與總部端進行ike協商，分支端debug信息如下

 

<H3C>debugging ike all

 

<H3C>*Nov 27 01:29:34:043 2024 H3C IKE/7/EVENT: Sent config set message.

 

*Nov 27 01:29:34:420 2024 H3C IKE/7/EVENT: Received message from ipsec, message type is 0.

 

*Nov 27 01:29:34:420 2024 H3C IKE/7/EVENT: Received SA acquire message from IPsec.

 

*Nov 27 01:29:34:420 2024 H3C IKE/7/EVENT: IKE thread 1099527456 processes a job.

 

*Nov 27 01:29:34:420 2024 H3C IKE/7/EVENT: Received SA acquire message from IPsec.

 

*Nov 27 01:29:34:420 2024 H3C IKE/7/EVENT: vrf = 0, local = 125.93.252.192, remote = 103.239.206.97/500

 

Collision of phase 2 negotiation is found when acquired sa.

 

*Nov 27 01:29:36:106 2024 H3C IKE/7/EVENT: Received message from ipsec, message type is 0.

 

*Nov 27 01:29:36:106 2024 H3C IKE/7/EVENT: Received SA acquire message from IPsec.

 

*Nov 27 01:29:36:106 2024 H3C IKE/7/EVENT: IKE thread 1099527456 processes a job.

 

*Nov 27 01:29:36:106 2024 H3C IKE/7/EVENT: Received SA acquire message from IPsec.

 

*Nov 27 01:29:36:106 2024 H3C IKE/7/EVENT: vrf = 0, local = 125.93.252.192, remote = 103.239.206.97/500

 

Collision of phase 2 negotiation is found when acquired sa.

 

*Nov 27 01:29:36:324 2024 H3C IKE/7/EVENT: Received message from ipsec, message type is 0.

 

*Nov 27 01:29:36:324 2024 H3C IKE/7/EVENT: Received SA acquire message from IPsec.

 

*Nov 27 01:29:36:324 2024 H3C IKE/7/EVENT: IKE thread 1099527456 processes a job.

 

*Nov 27 01:29:36:324 2024 H3C IKE/7/EVENT: Received SA acquire message from IPsec.

 

*Nov 27 01:29:36:324 2024 H3C IKE/7/EVENT: vrf = 0, local = 125.93.252.192, remote = 103.239.206.97/500

 

Collision of phase 2 negotiation is found when acquired sa.

 

*Nov 27 01:29:36:353 2024 H3C IKE/7/EVENT: Received message from ipsec, message type is 0.

 

*Nov 27 01:29:36:353 2024 H3C IKE/7/EVENT: Received SA acquire message from IPsec.

 

*Nov 27 01:29:36:353 2024 H3C IKE/7/EVENT: IKE thread 1099527456 processes a job.

 

*Nov 27 01:29:36:353 2024 H3C IKE/7/EVENT: Received SA acquire message from IPsec.

 

*Nov 27 01:29:36:353 2024 H3C IKE/7/EVENT: vrf = 0, local = 125.93.252.192, remote = 103.239.206.97/500

 

Collision of phase 2 negotiation is found when acquired sa.

 

*Nov 27 01:29:36:621 2024 H3C IKE/7/EVENT: Received message from ipsec, message type is 0.

 

*Nov 27 01:29:36:621 2024 H3C IKE/7/EVENT: Received SA acquire message from IPsec.

 

*Nov 27 01:29:36:621 2024 H3C IKE/7/EVENT: IKE thread 1099527456 processes a job.

 

*Nov 27 01:29:36:621 2024 H3C IKE/7/EVENT: Received SA acquire message from IPsec.

 

*Nov 27 01:29:36:621 2024 H3C IKE/7/EVENT: vrf = 0, local = 125.93.252.192, remote = 103.239.206.97/500

 

Collision of phase 2 negotiation is found when acquired sa.

 

*Nov 27 01:29:37:353 2024 H3C IKE/7/EVENT: Received message from ipsec, message type is 0.

 

*Nov 27 01:29:37:353 2024 H3C IKE/7/EVENT: Received SA acquire message from IPsec.

 

*Nov 27 01:29:37:353 2024 H3C IKE/7/EVENT: IKE thread 1099527456 processes a job.

 

*Nov 27 01:29:37:353 2024 H3C IKE/7/EVENT: Received SA acquire message from IPsec.

 

*Nov 27 01:29:37:353 2024 H3C IKE/7/EVENT: vrf = 0, local = 125.93.252.192, remote = 103.239.206.97/500

 

Collision of phase 2 negotiation is found when acquired sa.

 

*Nov 27 01:29:38:110 2024 H3C IKE/7/EVENT: Received message from ipsec, message type is 0.

 

*Nov 27 01:29:38:110 2024 H3C IKE/7/EVENT: Received SA acquire message from IPsec.

 

*Nov 27 01:29:38:110 2024 H3C IKE/7/EVENT: IKE thread 1099527456 processes a job.

 

*Nov 27 01:29:38:111 2024 H3C IKE/7/EVENT: Received SA acquire message from IPsec.

 

*Nov 27 01:29:38:111 2024 H3C IKE/7/EVENT: vrf = 0, local = 125.93.252.192, remote = 103.239.206.97/500

 

Collision of phase 2 negotiation is found when acquired sa.

 

*Nov 27 01:29:38:187 2024 H3C IKE/7/EVENT: Received message from ipsec, message type is 0.

 

*Nov 27 01:29:38:187 2024 H3C IKE/7/EVENT: Received SA acquire message from IPsec.

 

*Nov 27 01:29:38:187 2024 H3C IKE/7/EVENT: IKE thread 1099527456 processes a job.

 

*Nov 27 01:29:38:188 2024 H3C IKE/7/EVENT: Received SA acquire message from IPsec.

 

*Nov 27 01:29:38:188 2024 H3C IKE/7/EVENT: vrf = 0, local = 125.93.252.192, remote = 103.239.206.97/500

 

Collision of phase 2 negotiation is found when acquired sa.

 

*Nov 27 01:29:38:213 2024 H3C IKE/7/EVENT: Received message from ipsec, message type is 0.

 

*Nov 27 01:29:38:213 2024 H3C IKE/7/EVENT: Received SA acquire message from IPsec.

 

*Nov 27 01:29:38:213 2024 H3C IKE/7/EVENT: IKE thread 1099527456 processes a job.

 

*Nov 27 01:29:38:213 2024 H3C IKE/7/EVENT: Received SA acquire message from IPsec.

 

*Nov 27 01:29:38:213 2024 H3C IKE/7/EVENT: vrf = 0, local = 125.93.252.192, remote = 103.239.206.97/500

 

Collision of phase 2 negotiation is found when acquired sa.

 

%Nov 27 01:29:38:822 2024 H3C PING/6/PING_STATISTICS: Ping statistics for 172.20.232.1: 5 packet(s) transmitted, 0 packet(s) received, 100.0% packet loss.

 

*Nov 27 01:29:38:842 2024 H3C IKE/7/EVENT: Received message from ipsec, message type is 0.

 

*Nov 27 01:29:38:842 2024 H3C IKE/7/EVENT: Received SA acquire message from IPsec.

 

*Nov 27 01:29:38:842 2024 H3C IKE/7/EVENT: IKE thread 1099527456 processes a job.

 

*Nov 27 01:29:38:842 2024 H3C IKE/7/EVENT: Received SA acquire message from IPsec.

 

*Nov 27 01:29:38:842 2024 H3C IKE/7/EVENT: vrf = 0, local = 125.93.252.192, remote = 103.239.206.97/500

 

Collision of phase 2 negotiation is found when acquired sa.

 

*Nov 27 01:29:39:213 2024 H3C IKE/7/EVENT: Received message from ipsec, message type is 0.

 

*Nov 27 01:29:39:213 2024 H3C IKE/7/EVENT: Received SA acquire message from IPsec.

 

*Nov 27 01:29:39:213 2024 H3C IKE/7/EVENT: IKE thread 1099527456 processes a job.

 

*Nov 27 01:29:39:213 2024 H3C IKE/7/EVENT: Received SA acquire message from IPsec.

 

*Nov 27 01:29:39:213 2024 H3C IKE/7/EVENT: vrf = 0, local = 125.93.252.192, remote = 103.239.206.97/500

 

Set IPsec SA state to IKE_P2_STATE_INIT.

 

*Nov 27 01:29:39:213 2024 H3C IKE/7/EVENT: IKE SA not found. Initiate IKE SA negotiation.

 

*Nov 27 01:29:39:213 2024 H3C IKE/7/EVENT: vrf = 0, local = 125.93.252.192, remote = 103.239.206.97/500

 

Obtained profile bigoneIDC.

 

*Nov 27 01:29:39:213 2024 H3C IKE/7/EVENT: vrf = 0, local = 125.93.252.192, remote = 103.239.206.97/500

 

Initiator created an SA for peer 103.239.206.97, local port 500, remote port 500.

 

*Nov 27 01:29:39:213 2024 H3C IKE/7/EVENT: vrf = 0, local = 125.93.252.192, remote = 103.239.206.97/500

 

Set IKE SA state to IKE_P1_STATE_INIT.

 

*Nov 27 01:29:39:213 2024 H3C IKE/7/EVENT: IKE thread 1099527456 processes a job.

 

*Nov 27 01:29:39:214 2024 H3C IKE/7/EVENT: vrf = 0, local = 125.93.252.192, remote = 103.239.206.97/500

 

Begin Aggressive mode exchange.

 

*Nov 27 01:29:39:214 2024 H3C IKE/7/EVENT: vrf = 0, local = 125.93.252.192, remote = 103.239.206.97/500

 

Found pre-shared key that matches address 103.239.206.97 in keychain 1.

 

*Nov 27 01:29:39:214 2024 H3C IKE/7/PACKET: vrf = 0, local = 125.93.252.192, remote = 103.239.206.97/500

 

  Encryption algorithm is AES-CBC.

 

*Nov 27 01:29:39:214 2024 H3C IKE/7/PACKET: vrf = 0, local = 125.93.252.192, remote = 103.239.206.97/500

 

  Key length is 256 bits.

 

*Nov 27 01:29:39:214 2024 H3C IKE/7/PACKET: vrf = 0, local = 125.93.252.192, remote = 103.239.206.97/500

 

  Hash algorithm is HMAC-SHA2_256.

 

*Nov 27 01:29:39:214 2024 H3C IKE/7/PACKET: vrf = 0, local = 125.93.252.192, remote = 103.239.206.97/500

 

  DH group 2.

 

*Nov 27 01:29:39:214 2024 H3C IKE/7/PACKET: vrf = 0, local = 125.93.252.192, remote = 103.239.206.97/500

 

  Authentication method is Pre-shared key.

 

*Nov 27 01:29:39:214 2024 H3C IKE/7/PACKET: vrf = 0, local = 125.93.252.192, remote = 103.239.206.97/500

 

  Lifetime type is in seconds.

 

*Nov 27 01:29:39:214 2024 H3C IKE/7/PACKET: vrf = 0, local = 125.93.252.192, remote = 103.239.206.97/500

 

  Life duration is 86400.

 

*Nov 27 01:29:39:214 2024 H3C IKE/7/PACKET: vrf = 0, local = 125.93.252.192, remote = 103.239.206.97/500

 

Construct transform payload for transform 1.

 

*Nov 27 01:29:39:214 2024 H3C IKE/7/PACKET: vrf = 0, local = 125.93.252.192, remote = 103.239.206.97/500

 

Constructed SA payload.

 

*Nov 27 01:29:39:239 2024 H3C IKE/7/PACKET: vrf = 0, local = 125.93.252.192, remote = 103.239.206.97/500

 

Construct KE payload.

 

*Nov 27 01:29:39:239 2024 H3C IKE/7/PACKET: vrf = 0, local = 125.93.252.192, remote = 103.239.206.97/500

 

Construct NONCE payload.

 

*Nov 27 01:29:39:239 2024 H3C IKE/7/PACKET: vrf = 0, local = 125.93.252.192, remote = 103.239.206.97/500

 

Local ID type: FQDN (2).

 

*Nov 27 01:29:39:239 2024 H3C IKE/7/PACKET: vrf = 0, local = 125.93.252.192, remote = 103.239.206.97/500

 

Local ID value: DG1215.

 

*Nov 27 01:29:39:239 2024 H3C IKE/7/PACKET: vrf = 0, local = 125.93.252.192, remote = 103.239.206.97/500

 

Construct ID payload.

 

*Nov 27 01:29:39:239 2024 H3C IKE/7/PACKET: vrf = 0, local = 125.93.252.192, remote = 103.239.206.97/500

 

Construct DPD vendor ID payload.

 

*Nov 27 01:29:39:240 2024 H3C IKE/7/PACKET: vrf = 0, local = 125.93.252.192, remote = 103.239.206.97/500

 

Construct NAT-T rfc3947 vendor ID payload.

 

*Nov 27 01:29:39:240 2024 H3C IKE/7/PACKET: vrf = 0, local = 125.93.252.192, remote = 103.239.206.97/500

 

Construct NAT-T draft3 vendor ID payload.

 

*Nov 27 01:29:39:240 2024 H3C IKE/7/PACKET: vrf = 0, local = 125.93.252.192, remote = 103.239.206.97/500

 

Construct NAT-T draft2 vendor ID payload.

 

*Nov 27 01:29:39:240 2024 H3C IKE/7/PACKET: vrf = 0, local = 125.93.252.192, remote = 103.239.206.97/500

 

Construct NAT-T draft1 vendor ID payload.

 

*Nov 27 01:29:39:240 2024 H3C IKE/7/PACKET: vrf = 0, local = 125.93.252.192, remote = 103.239.206.97/500

 

Construct XAUTH Cisco Unity 1.0 vendor ID payload.

 

*Nov 27 01:29:39:240 2024 H3C IKE/7/PACKET: vrf = 0, local = 125.93.252.192, remote = 103.239.206.97/500

 

Construct XAUTH draft6 vendor ID payload.

 

*Nov 27 01:29:39:240 2024 H3C IKE/7/EVENT: vrf = 0, local = 125.93.252.192, remote = 103.239.206.97/500

 

IKE SA state changed from IKE_P1_STATE_INIT to IKE_P1_STATE_SEND1.

 

*Nov 27 01:29:39:240 2024 H3C IKE/7/PACKET: vrf = 0, local = 125.93.252.192, remote = 103.239.206.97/500

 

Sending packet to 103.239.206.97 remote port 500, local port 500.

 

*Nov 27 01:29:39:240 2024 H3C IKE/7/PACKET: vrf = 0, local = 125.93.252.192, remote = 103.239.206.97/500

 

 

 

  I-COOKIE: 1bff2de7d9bad717

 

  R-COOKIE: 0000000000000000

 

  next payload: SA

 

  version: ISAKMP Version 1.0

 

  exchange mode: Aggressive

 

  flags:

 

  message ID: 0

 

  length: 388

 

*Nov 27 01:29:39:240 2024 H3C IKE/7/PACKET: vrf = 0, local = 125.93.252.192, remote = 103.239.206.97/500

 

Sending an IPv4 packet.

 

*Nov 27 01:29:39:240 2024 H3C IKE/7/EVENT: vrf = 0, local = 125.93.252.192, remote = 103.239.206.97/500

 

Sent data to socket successfully.

 

*Nov 27 01:29:39:846 2024 H3C IKE/7/EVENT: Received message from ipsec, message type is 0.

 

*Nov 27 01:29:39:846 2024 H3C IKE/7/EVENT: Received SA acquire message from IPsec.

 

*Nov 27 01:29:39:846 2024 H3C IKE/7/EVENT: Received message from ipsec, message type is 0.

 

*Nov 27 01:29:39:846 2024 H3C IKE/7/EVENT: Received SA acquire message from IPsec.

 

*Nov 27 01:29:39:846 2024 H3C IKE/7/EVENT: Received message from ipsec, message type is 0.

 

*Nov 27 01:29:39:846 2024 H3C IKE/7/EVENT: Received SA acquire message from IPsec.

 

*Nov 27 01:29:39:846 2024 H3C IKE/7/EVENT: Received message from ipsec, message type is 0.

 

*Nov 27 01:29:39:846 2024 H3C IKE/7/EVENT: Received SA acquire message from IPsec.

 

*Nov 27 01:29:39:846 2024 H3C IKE/7/EVENT: IKE thread 1099527456 processes a job.

 

*Nov 27 01:29:39:846 2024 H3C IKE/7/EVENT: Received SA acquire message from IPsec.

 

*Nov 27 01:29:39:847 2024 H3C IKE/7/EVENT: vrf = 0, local = 125.93.252.192, remote = 103.239.206.97/500

 

Collision of phase 2 negotiation is found when acquired sa.

 

 

 

[H3C]dis ike sa

 

    Connection-ID   Remote                Flag         DOI

 

------------------------------------------------------------------

 

    38              103.239.206.97        Unknown      IPsec

 

 

 

檢查過一階段與二階段配置，acl感興趣流以及ike密鑰均正確。一階段無法協商unknown狀態

組網及組網描述：

總部端日誌信息，21點後分支端重新觸發協商總部端也收不到任何日誌信息。總部端與其餘100多分支端協商均正常

1 個回答
按時間 按讚數
zhiliao_LAB7KF
zhiliao_LAB7KF 五段
粉絲：0人 關注：0人

從debug看重新進行IKE協商的時候，125.93.252.192這端發出了IKE協商報文，但是沒有收到對端103.239.206.97的回包。可以在對端也debug看下

*Nov 27 01:29:39:240 2024 H3C IKE/7/EVENT: vrf = 0, local = 125.93.252.192, remote = 103.239.206.97/500

 

IKE SA state changed from IKE_P1_STATE_INIT to IKE_P1_STATE_SEND1.

 

*Nov 27 01:29:39:240 2024 H3C IKE/7/PACKET: vrf = 0, local = 125.93.252.192, remote = 103.239.206.97/500

 

Sending packet to 103.239.206.97 remote port 500, local port 500.

 

*Nov 27 01:29:39:240 2024 H3C IKE/7/PACKET: vrf = 0, local = 125.93.252.192, remote = 103.239.206.97/500

 

 

 

  I-COOKIE: 1bff2de7d9bad717

 

  R-COOKIE: 0000000000000000

 

  next payload: SA

 

  version: ISAKMP Version 1.0

 

  exchange mode: Aggressive

 

  flags:

 

  message ID: 0

 

  length: 388

 

*Nov 27 01:29:39:240 2024 H3C IKE/7/PACKET: vrf = 0, local = 125.93.252.192, remote = 103.239.206.97/500

 

Sending an IPv4 packet.

 

*Nov 27 01:29:39:240 2024 H3C IKE/7/EVENT: vrf = 0, local = 125.93.252.192, remote = 103.239.206.97/500

 

Sent data to socket successfully.

暫無評論

編輯答案

你正在編輯答案

如果你要對問題或其他回答進行點評或詢問，請使用評論功能。

✖

分享擴散:

➤

提出建議

✖

    +
網站相關
關於我們
服務條款
幫助中心
經驗與權限
積分規則
聯係我們
聯係我們
建議反饋
常用鏈接
標杆的神器下載
關注我們
H3C官網
BOB登陆 服務公眾號
安仔遠程運維服務
BOB登陆 商城
內容許可
除特別說明外，用戶內容均可采用知識共享署名-相同方式共享3.0中國大陸許可協議進行許可

Copyright©2025BOB登陆 集團保留一切權利 當前呈現版本 NO.1

本圖標版權歸BOB登陆 集團所有，僅限本社區使用，切勿用做商業目的，違者必究

浙ICP備09064986號-1   浙公網安備 33010802004416號

✖

親~登錄後才可以操作哦!

確定
✖

親~檢測到您登陸的賬號未在http://hclhub.h3c.com進行注冊

注冊後可訪問此模塊

跳轉hclhub
✖

你的郵箱還未認證，請認證郵箱或綁定手機後進行當前操作

✖

舉報

×

侵犯我的權益 >
對根叔社區有害的內容 >
辱罵、歧視、挑釁等（不友善）

侵犯我的權益

×

泄露了我的隱私 >
侵犯了我企業的權益 >
抄襲了我的內容 >
誹謗我 >
辱罵、歧視、挑釁等（不友善）
騷擾我

泄露了我的隱私

×

您好，當您發現根叔知了上有泄漏您隱私的內容時，您可以向根叔知了進行舉報。 請您把以下內容通過郵件發送到pub.zhiliao@h3c.com 郵箱，我們會盡快處理。
  • 1. 您認為哪些內容泄露了您的隱私？（請在郵件中列出您舉報的內容、鏈接地址，並給出簡短的說明）
  • 2. 您是誰？（身份證明材料，可以是身份證或護照等證件）

侵犯了我企業的權益

×

您好，當您發現根叔知了上有關於您企業的造謠與誹謗、商業侵權等內容時，您可以向根叔知了進行舉報。 請您把以下內容通過郵件發送到 pub.zhiliao@h3c.com 郵箱，我們會在審核後盡快給您答複。
  • 1. 您舉報的內容是什麼？（請在郵件中列出您舉報的內容和鏈接地址）
  • 2. 您是誰？（身份證明材料，可以是身份證或護照等證件）
  • 3. 是哪家企業？（營業執照，單位登記證明等證件）
  • 4. 您與該企業的關係是？（您是企業法人或被授權人，需提供企業委托授權書）
我們認為知名企業應該坦然接受公眾討論，對於答案中不準確的部分，我們歡迎您以正式或非正式身份在根叔知了上進行澄清。

抄襲了我的內容

×

原文鏈接或出處

誹謗我

×

您好，當您發現根叔知了上有誹謗您的內容時，您可以向根叔知了進行舉報。 請您把以下內容通過郵件發送到pub.zhiliao@h3c.com 郵箱，我們會盡快處理。
  • 1. 您舉報的內容以及侵犯了您什麼權益？（請在郵件中列出您舉報的內容、鏈接地址，並給出簡短的說明）
  • 2. 您是誰？（身份證明材料，可以是身份證或護照等證件）
我們認為知名企業應該坦然接受公眾討論，對於答案中不準確的部分，我們歡迎您以正式或非正式身份在根叔知了上進行澄清。

對根叔社區有害的內容

×

垃圾廣告信息
色情、暴力、血腥等違反法律法規的內容
政治敏感
不規範轉載 >
辱罵、歧視、挑釁等（不友善）
騷擾我
誘導投票

不規範轉載

×

舉報說明