无法通过 OpenSWAN <-> ISA Server IPSec VPN 上的“待定阶段 2”

Question

问题

我很难在我的 Linux 服务器（Ubuntu 12.04）上配置 OpenSWAN 以连接到 ISA Server 2004 IPSec VPN。阻碍隧道工作的配置显然有问题。看起来我的一些数据包在某处丢失了？我不确定。

对方说他们这边的日志没有任何问题。我这边没有防火墙。这是/var/log/auth.log（下面的更长版本）中的违规部分。

Jan 29 17:28:11 P-INV-SD07 pluto[5821]: "myconn" #1: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3
Jan 29 17:28:11 P-INV-SD07 pluto[5821]: "myconn" #1: STATE_MAIN_I3: sent MI3, expecting MR3
Jan 29 17:28:12 P-INV-SD07 pluto[5821]: "myconn" #1: discarding duplicate packet; already STATE_MAIN_I3
Jan 29 17:28:34  pluto[5821]: last message repeated 3 times
Jan 29 17:28:42 P-INV-SD07 pluto[5821]: packet from <hispublicip>:500: Informational Exchange is for an unknown (expired?) SA with MSGID:0x8341092b
Jan 29 17:28:42 P-INV-SD07 pluto[5821]: "myconn" #1: discarding duplicate packet; already STATE_MAIN_I3

接下来是有关设置的详细信息，以防万一有人可以提供帮助:) 提前致谢！

当前配置

我用我们这边的大部分默认参数建立了连接（我确实尝试了很多其他的东西，但似乎没有比这更好的了）：

conn myconn
    authby=secret
    type=tunnel
    left=<hispublic>
    leftsubnet=<hislanip>/32
    right=<mypublic>
    rightsubnet=<mylanip>/32
    auto=start

输出ipsec auto status：

000 "myconn": <mylanip>/32===<mypublicip><<mypublicip>>[+S=C]...<hispublicip>    <<hispublicip>>[+S=C]===<hislanip>/32; prospective erouted; eroute owner: #0
000 "myconn":     myip=unset; hisip=unset;
000 "myconn":   ike_life: 7200s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz:     100%; keyingtries: 0
000 "myconn":   policy: PSK+ENCRYPT+TUNNEL+PFS+UP+IKEv2ALLOW+SAREFTRACK+lKOD+rKOD;   prio:   32,32; interface: eth0;
000 "myconn":   newest ISAKMP SA: #0; newest IPsec SA: #0;
000
000 #2: "myconn":500 STATE_MAIN_I3 (sent MI3, expecting MR3); EVENT_RETRANSMIT in 18s;     nodpd; idle; import:admin initiate
000 #2: pending Phase 2 for "myconn" replacing #0

摘录自/var/log/auth.log：

Jan 29 17:28:11 P-INV-SD07 pluto[5821]: loading secrets from "/etc/ipsec.secrets"
Jan 29 17:28:11 P-INV-SD07 pluto[5821]: "myconn" #1: initiating Main Mode
Jan 29 17:28:11 P-INV-SD07 pluto[5821]: "myconn" #1: ignoring Vendor ID payload [MS NT5 ISAKMPOAKLEY 00000004]
Jan 29 17:28:11 P-INV-SD07 pluto[5821]: "myconn" #1: ignoring Vendor ID payload [FRAGMENTATION]
Jan 29 17:28:11 P-INV-SD07 pluto[5821]: "myconn" #1: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] method set to=106
Jan 29 17:28:11 P-INV-SD07 pluto[5821]: "myconn" #1: enabling possible NAT-traversal     with method draft-ietf-ipsec-nat-t-ike-05
Jan 29 17:28:11 P-INV-SD07 pluto[5821]: "myconn" #1: transition from state STATE_MAIN_I1 to state STATE_MAIN_I2
Jan 29 17:28:11 P-INV-SD07 pluto[5821]: "myconn" #1: STATE_MAIN_I2: sent MI2, expecting    MR2
Jan 29 17:28:11 P-INV-SD07 pluto[5821]: "myconn" #1: NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike-02/03: no NAT detected
Jan 29 17:28:11 P-INV-SD07 pluto[5821]: "myconn" #1: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3
Jan 29 17:28:11 P-INV-SD07 pluto[5821]: "myconn" #1: STATE_MAIN_I3: sent MI3, expecting MR3
Jan 29 17:28:12 P-INV-SD07 pluto[5821]: "myconn" #1: discarding duplicate packet; already STATE_MAIN_I3
Jan 29 17:28:34  pluto[5821]: last message repeated 3 times
Jan 29 17:28:42 P-INV-SD07 pluto[5821]: packet from <hispublicip>:500: Informational Exchange is for an unknown (expired?) SA with MSGID:0x8341092b
Jan 29 17:28:42 P-INV-SD07 pluto[5821]: "myconn" #1: discarding duplicate packet; already STATE_MAIN_I3

以下是 ISA 服务器端使用的配置选项：

• 阶段1
  • 加密：3DES
  • 完整性：SHA1
  • DH 组：第 2 组
• 阶段2
  • 加密：3DES
  • 完整性：SHA1
  • 每 86400 秒生成一个新密钥
  • 使用 PFS：是（DH 组 2）

更新

我设法在 OpenSWAN 端运行了一个数据包嗅探器，并在 ISA 端启用了Oakley 日志。嗅探与您所期望的差不多：从 OpenSWAN 端发送的第三个数据包被 ISA 服务器拒绝，ISA 服务器不断发送第二个数据包，因为他认为它没有被确认。

Oakley (ISA) 日志上的错误说：

Receive: (get) SA = 0x00108cf0 from 50.57.73.135.500
2-07: 14:44:25:250:44b24 ISAKMP Header: (V1.0), len = 68
2-07: 14:44:25:250:44b24   I-COOKIE 8802248fab719171
2-07: 14:44:25:250:44b24   R-COOKIE 296787dc0ec4227a
2-07: 14:44:25:250:44b24   exchange: Oakley Main Mode
2-07: 14:44:25:250:44b24   flags: 1 ( encrypted )
2-07: 14:44:25:250:44b24   next payload: ID
2-07: 14:44:25:250:44b24   message ID: 00000000
2-07: 14:44:25:250:44b24 invalid payload received
2-07: 14:44:25:250:44b24 Preshared key ID.  Peer IP Address: <mypublicip>
2-07: 14:44:25:250:44b24 Source IP Address <hispublicip>  Source IP Address Mask 255.255.255.255  Destination IP Address <mypublicip>  Destination IP Address Mask 255.255.255.255  Protocol 0  Source Port 0  Destination Port 0  IKE Local Addr <hispublicip>  IKE Peer Addr <mypublicip>  IKE Source Port 500  IKE Destination Port 500  Peer Private Addr
2-07: 14:44:25:250:44b24 GetPacket failed 3613

所以基本上invalid payload received然后GetPacket failed 3613。最后一个错误代码在谷歌上没有产生很多信息，包括人们说他们一直得到这个并且一切正常。

我放弃了，我们正在设置一个本地服务器，但我正在更新它以备将来参考，以防有人为 Internet 提供线索。

Answer 1

我最近几天也遇到过这样的情况。

这是由于两个问题。

1. 防火墙
2. 禁用内核 IP 转发
3. 预共享密钥不匹配

对于防火墙，结果发现端口 500 和 4500 被阻止。通过运行ipsec verify，可以看到是500还是4500被阻塞。

在/etc/sysctl.conf，

改成net.ipv4.ip_forward​1

附加

net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.lo.accept_redirects = 0
net.ipv4.conf.lo.send_redirects = 0
net.ipv4.conf.em1.accept_redirects = 0
net.ipv4.conf.em1.send_redirects = 0

这em1是网络接口，可能是你的eth0，或者eth1

最后，在我的例子中，预共享密钥/etc/ipsec.d/ipsec.secrets被错误地用双引号引起来"，这导致预共享密钥不匹配。

希望它对某人有帮助。