من در حال تلاش برای ایجاد یک تونل IPSec بین دو روتر PFSense هستم. فاز 1 (ikev2) اتصال را با موفقیت پیکربندی و برقرار کردم. به نظر می رسد اتصال فاز 2 موفقیت آمیز است، اما هیچ ترافیکی بین دو روتر عبور نمی کند (شمارنده ها 0 بایت را نشان می دهند). بررسی لاگ ها (قسمت زیر) من مشکلی در تونل فاز 2 نمی بینم.
هر دو روتر دارای آدرس های داخلی IPv4 در رابط LAN و آدرس های IPv6 WAN هستند و می توانند از طریق IPv6 یکدیگر را پینگ کنند (IPv4 در شبکه WAN موجود است اما برای این اتصال استفاده نمی شود). سایت A PFSense نسخه 2.8.1 و سایت B PFSense + 24.11 است.
مراحل عیب یابی من
این چیزی است که من امتحان کردم:
- من تمام تنظیمات فاز 2 و همه بیت های مهم را بررسی کردم، مانند شبکه، الگوریتم های رمزگذاری و طول عمر.
- رابط های ipsec را بررسی کردم و سعی کردم بین آنها پینگ کنم. من می توانم رابط ipsec را در سمت محلی پینگ کنم، اما سمت دور پاسخی دریافت نمی کند
- من یک دروازه و یک مسیر ثابت برای شبکه انتهایی راه اندازی کردم.
- من مطمئن شدم که ترافیک از طریق فایروال در تب IPSec مجاز است. من لاگ های فایروال را بررسی کرده ام و هیچ بلوکی در حین تست پینگ، استقرار تونل و غیره نمی بینم.
اطلاعات دیگر
من توانستم با استفاده از حالت Tunnel IPv4 با خط مشی پینگ کنم، اما به دلایل مقیاس پذیری می خواهم از VTI استفاده کنم. من تا جایی که فکر می کنم بررسی کردم و مراحل صفحه عیب یابی ترافیک IPSec را دنبال کردم، اما راه حلی در آنجا پیدا نکردم. هر گونه فکری در مورد آنچه که در مرحله بعد بررسی یا امتحان شود قدردانی خواهد شد.
نمودار وضعیت و خروجی
در اینجا نموداری از راه اندازی شبکه آمده است (WAN IPv6 ناشناس است، همه آدرس های IP دیگر صحیح هستند)
در اینجا صفحه وضعیت تونل از سایت A آمده است:
خروجی ورود به سیستم IPSec
در اینجا خروجی /var/log/ipsec.log در حین پرش پیوند P2 از سایت A آمده است:
Feb 12 16:58:02 inside charon[87535]: 05[KNL] querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 in failed, not found
Feb 12 16:58:02 inside charon[87535]: 05[KNL] querying policy ::/0|/0 === ::/0|/0 in failed, not found
Feb 12 16:58:02 inside charon[87535]: 05[IKE] sending DPD request
Feb 12 16:58:02 inside charon[87535]: 05[IKE] queueing IKE_DPD task
Feb 12 16:58:02 inside charon[87535]: 05[IKE] activating new tasks
Feb 12 16:58:02 inside charon[87535]: 05[IKE] activating IKE_DPD task
Feb 12 16:58:02 inside charon[87535]: 05[ENC] generating INFORMATIONAL request 486 [ ]
Feb 12 16:58:02 inside charon[87535]: 05[NET] sending packet: from 2600:****:48[500] to 2605:****:5d28[500] (80 bytes)
Feb 12 16:58:02 inside charon[87535]: 05[NET] received packet: from 2605:****:5d28[500] to 2600:****:48[500] (80 bytes)
Feb 12 16:58:02 inside charon[87535]: 05[ENC] parsed INFORMATIONAL response 486 [ ]
Feb 12 16:58:02 inside charon[87535]: 05[IKE] activating new tasks
Feb 12 16:58:02 inside charon[87535]: 05[IKE] nothing to initiate
Feb 12 16:58:03 inside charon[87535]: 06[CFG] vici client 2387 connected
Feb 12 16:58:03 inside charon[87535]: 05[CFG] vici client 2387 registered for: control-log
Feb 12 16:58:03 inside charon[87535]: 15[CFG] vici client 2388 connected
Feb 12 16:58:03 inside charon[87535]: 15[CFG] vici client 2388 registered for: list-sa
Feb 12 16:58:03 inside charon[87535]: 16[CFG] vici client 2387 requests: terminate
Feb 12 16:58:03 inside charon[87535]: 16[CFG] vici terminate CHILD_SA #154
Feb 12 16:58:03 inside charon[87535]: 11[IKE] queueing CHILD_DELETE task
Feb 12 16:58:03 inside charon[87535]: 11[IKE] activating new tasks
Feb 12 16:58:03 inside charon[87535]: 11[IKE] activating CHILD_DELETE task
Feb 12 16:58:03 inside charon[87535]: 11[IKE] closing CHILD_SA con1{154} with SPIs c8a342ae_i (0 bytes) c39706a1_o (0 bytes) and TS 0.0.0.0/0|/0 ::/0|/0 === 0.0.0.0/0|/0 ::/0|/0
Feb 12 16:58:03 inside charon[87535]: 11[IKE] sending DELETE for ESP CHILD_SA with SPI c8a342ae
Feb 12 16:58:03 inside charon[87535]: 11[CHD] CHILD_SA con1{154} state change: INSTALLED => DELETING
Feb 12 16:58:03 inside charon[87535]: 11[ENC] generating INFORMATIONAL request 487 [ D ]
Feb 12 16:58:03 inside charon[87535]: 11[NET] sending packet: from 2600:****:48[500] to 2605:****:5d28[500] (80 bytes)
Feb 12 16:58:03 inside charon[87535]: 10[CFG] vici client 2388 requests: list-sas
Feb 12 16:58:03 inside charon[87535]: 06[CFG] vici client 2388 disconnected
Feb 12 16:58:03 inside charon[87535]: 15[CFG] vici client 2389 connected
Feb 12 16:58:03 inside charon[87535]: 10[CFG] vici client 2389 registered for: list-sa
Feb 12 16:58:03 inside charon[87535]: 11[CFG] vici client 2389 requests: list-sas
Feb 12 16:58:03 inside charon[87535]: 10[CFG] vici client 2389 disconnected
Feb 12 16:58:03 inside charon[87535]: 10[NET] received packet: from 2605:****:5d28[500] to 2600:****:48[500] (80 bytes)
Feb 12 16:58:03 inside charon[87535]: 10[ENC] parsed INFORMATIONAL response 487 [ D ]
Feb 12 16:58:03 inside charon[87535]: 10[IKE] received DELETE for ESP CHILD_SA with SPI c39706a1
Feb 12 16:58:03 inside charon[87535]: 10[IKE] CHILD_SA closed
Feb 12 16:58:03 inside charon[87535]: 10[CHD] CHILD_SA con1{154} state change: DELETING => DELETED
Feb 12 16:58:03 inside charon[87535]: 10[CHD] CHILD_SA con1{154} state change: DELETED => DESTROYING
Feb 12 16:58:03 inside charon[87535]: 10[IKE] activating new tasks
Feb 12 16:58:03 inside charon[87535]: 10[IKE] nothing to initiate
Feb 12 16:58:03 inside charon[87535]: 10[CFG] vici client 2387 disconnected
Feb 12 16:58:05 inside charon[87535]: 10[KNL] creating acquire job for policy 2600:****:48/128|/0 === 2605:****:5d28/128|/0 with reqid {5002}
Feb 12 16:58:05 inside charon[87535]: 16[CFG] trap not found, unable to acquire reqid 5002
Feb 12 16:58:08 inside charon[87535]: 10[CFG] vici client 2390 connected
Feb 12 16:58:08 inside charon[87535]: 15[CFG] vici client 2390 registered for: list-sa
Feb 12 16:58:08 inside charon[87535]: 15[CFG] vici client 2390 requests: list-sas
Feb 12 16:58:08 inside charon[87535]: 05[CFG] vici client 2390 disconnected
Feb 12 16:58:09 inside charon[87535]: 15[CFG] vici client 2391 connected
Feb 12 16:58:09 inside charon[87535]: 15[CFG] vici client 2392 connected
Feb 12 16:58:09 inside charon[87535]: 10[CFG] vici client 2391 registered for: list-sa
Feb 12 16:58:09 inside charon[87535]: 10[CFG] vici client 2392 registered for: control-log
Feb 12 16:58:09 inside charon[87535]: 05[CFG] vici client 2391 requests: list-sas
Feb 12 16:58:09 inside charon[87535]: 08[CFG] vici client 2392 requests: initiate
Feb 12 16:58:09 inside charon[87535]: 08[CFG] vici initiate CHILD_SA 'con1'
Feb 12 16:58:09 inside charon[87535]: 05[IKE] queueing CHILD_CREATE task
Feb 12 16:58:09 inside charon[87535]: 05[IKE] activating new tasks
Feb 12 16:58:09 inside charon[87535]: 05[IKE] activating CHILD_CREATE task
Feb 12 16:58:09 inside charon[87535]: 05[CFG] proposing traffic selectors for us:
Feb 12 16:58:09 inside charon[87535]: 05[CFG] 192.168.65.252/30|/0
Feb 12 16:58:09 inside charon[87535]: 05[CFG] 0.0.0.0/0|/0
Feb 12 16:58:09 inside charon[87535]: 05[CFG] ::/0|/0
Feb 12 16:58:09 inside charon[87535]: 05[CFG] proposing traffic selectors for other:
Feb 12 16:58:09 inside charon[87535]: 05[CFG] 192.168.65.253/32|/0
Feb 12 16:58:09 inside charon[87535]: 05[CFG] 0.0.0.0/0|/0
Feb 12 16:58:09 inside charon[87535]: 05[CFG] ::/0|/0
Feb 12 16:58:09 inside charon[87535]: 05[CFG] configured proposals: ESP:AES_GCM_16_128/MODP_2048/NO_EXT_SEQ, ESP:AES_CBC_128/HMAC_SHA2_256_128/MODP_2048/NO_EXT_SEQ, ESP:AES_CBC_128/HMAC_SHA2_512_256/MODP_2048/NO_EXT_SEQ
Feb 12 16:58:09 inside charon[87535]: 05[IKE] establishing CHILD_SA con1{155}
Feb 12 16:58:09 inside charon[87535]: 05[ENC] generating CREATE_CHILD_SA request 488 [ N(ESP_TFC_PAD_N) SA No KE TSi TSr ]
Feb 12 16:58:09 inside charon[87535]: 05[NET] sending packet: from 2600:****:48[500] to 2605:****:5d28[500] (656 bytes)
Feb 12 16:58:09 inside charon[87535]: 07[CFG] vici client 2391 disconnected
Feb 12 16:58:09 inside charon[87535]: 07[NET] received packet: from 2605:****:5d28[500] to 2600:****:48[500] (560 bytes)
Feb 12 16:58:09 inside charon[87535]: 07[ENC] parsed CREATE_CHILD_SA response 488 [ N(ESP_TFC_PAD_N) SA No KE TSi TSr ]
Feb 12 16:58:09 inside charon[87535]: 07[IKE] received ESP_TFC_PADDING_NOT_SUPPORTED notify
Feb 12 16:58:09 inside charon[87535]: 07[IKE] received ESP_TFC_PADDING_NOT_SUPPORTED, not using ESPv3 TFC padding
Feb 12 16:58:09 inside charon[87535]: 07[CFG] selecting proposal:
Feb 12 16:58:09 inside charon[87535]: 07[CFG] proposal matches
Feb 12 16:58:09 inside charon[87535]: 07[CFG] received proposals: ESP:AES_GCM_16_128/MODP_2048/NO_EXT_SEQ
Feb 12 16:58:09 inside charon[87535]: 07[CFG] configured proposals: ESP:AES_GCM_16_128/MODP_2048/NO_EXT_SEQ, ESP:AES_CBC_128/HMAC_SHA2_256_128/MODP_2048/NO_EXT_SEQ, ESP:AES_CBC_128/HMAC_SHA2_512_256/MODP_2048/NO_EXT_SEQ
Feb 12 16:58:09 inside charon[87535]: 07[CFG] selected proposal: ESP:AES_GCM_16_128/MODP_2048/NO_EXT_SEQ
Feb 12 16:58:09 inside charon[87535]: 07[CFG] selecting traffic selectors for us:
Feb 12 16:58:09 inside charon[87535]: 07[CFG] config: 192.168.65.252/30|/0, received: 0.0.0.0/0|/0 => match: 192.168.65.252/30|/0
Feb 12 16:58:09 inside charon[87535]: 07[CFG] config: 192.168.65.252/30|/0, received: ::/0|/0 => no match
Feb 12 16:58:09 inside charon[87535]: 07[CFG] config: 0.0.0.0/0|/0, received: 0.0.0.0/0|/0 => match: 0.0.0.0/0|/0
Feb 12 16:58:09 inside charon[87535]: 07[CFG] config: 0.0.0.0/0|/0, received: ::/0|/0 => no match
Feb 12 16:58:09 inside charon[87535]: 07[CFG] config: ::/0|/0, received: 0.0.0.0/0|/0 => no match
Feb 12 16:58:09 inside charon[87535]: 07[CFG] config: ::/0|/0, received: ::/0|/0 => match: ::/0|/0
Feb 12 16:58:09 inside charon[87535]: 07[CFG] selecting traffic selectors for other:
Feb 12 16:58:09 inside charon[87535]: 07[CFG] config: 192.168.65.253/32|/0, received: 0.0.0.0/0|/0 => match: 192.168.65.253/32|/0
Feb 12 16:58:09 inside charon[87535]: 07[CFG] config: 192.168.65.253/32|/0, received: ::/0|/0 => no match
Feb 12 16:58:09 inside charon[87535]: 07[CFG] config: 0.0.0.0/0|/0, received: 0.0.0.0/0|/0 => match: 0.0.0.0/0|/0
Feb 12 16:58:09 inside charon[87535]: 07[CFG] config: 0.0.0.0/0|/0, received: ::/0|/0 => no match
Feb 12 16:58:09 inside charon[87535]: 07[CFG] config: ::/0|/0, received: 0.0.0.0/0|/0 => no match
Feb 12 16:58:09 inside charon[87535]: 07[CFG] config: ::/0|/0, received: ::/0|/0 => match: ::/0|/0
Feb 12 16:58:09 inside charon[87535]: 07[CHD] CHILD_SA con1{155} state change: CREATED => INSTALLING
Feb 12 16:58:09 inside charon[87535]: 07[CHD] using AES_GCM_16 for encryption
Feb 12 16:58:09 inside charon[87535]: 07[CHD] adding inbound ESP SA
Feb 12 16:58:09 inside charon[87535]: 07[CHD] SPI 0xc5e5f7f2, src 2605:****:5d28 dst 2600:****:48
Feb 12 16:58:09 inside charon[87535]: 07[CHD] adding outbound ESP SA
Feb 12 16:58:09 inside charon[87535]: 07[CHD] SPI 0xcb426d36, src 2600:****:48 dst 2605:****:5d28
Feb 12 16:58:09 inside charon[87535]: 07[IKE] CHILD_SA con1{155} established with SPIs c5e5f7f2_i cb426d36_o and TS 0.0.0.0/0|/0 ::/0|/0 === 0.0.0.0/0|/0 ::/0|/0
Feb 12 16:58:09 inside charon[87535]: 07[CHD] CHILD_SA con1{155} state change: INSTALLING => INSTALLED
Feb 12 16:58:09 inside charon[87535]: 07[IKE] activating new tasks
Feb 12 16:58:09 inside charon[87535]: 07[IKE] nothing to initiate
Feb 12 16:58:09 inside charon[87535]: 07[CFG] vici client 2392 disconnected
Feb 12 16:58:12 inside charon[87535]: 07[KNL] creating acquire job for policy 2600:****:48/128|/0 === 2605:****:5d28/128|/0 with reqid {5002}
Feb 12 16:58:12 inside charon[87535]: 05[CFG] trap not found, unable to acquire reqid 5002
Feb 12 16:58:12 inside charon[87535]: 05[KNL] querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 in failed, not found
Feb 12 16:58:12 inside charon[87535]: 05[KNL] querying policy ::/0|/0 === ::/0|/0 in failed, not found
Feb 12 16:58:13 inside charon[87535]: 07[CFG] vici client 2393 connected
Feb 12 16:58:13 inside charon[87535]: 07[CFG] vici client 2393 registered for: list-sa
Feb 12 16:58:13 inside charon[87535]: 13[CFG] vici client 2393 requests: list-sas
Feb 12 16:58:13 inside charon[87535]: 14[CFG] vici client 2393 disconnected
Feb 12 16:58:18 inside charon[87535]: 14[KNL] creating acquire job for policy 2600:****:48/128|/0 === 2605:****:5d28/128|/0 with reqid {5002}
Feb 12 16:58:18 inside charon[87535]: 13[CFG] trap not found, unable to acquire reqid 5002
Feb 12 16:58:18 inside charon[87535]: 14[CFG] vici client 2394 connected
Feb 12 16:58:18 inside charon[87535]: 07[CFG] vici client 2394 registered for: list-sa
Feb 12 16:58:18 inside charon[87535]: 07[CFG] vici client 2394 requests: list-sas
Feb 12 16:58:18 inside charon[87535]: 12[CFG] vici client 2394 disconnected
