☰

업데이트

tag-icon • tag-icon vpn ipsec openswan
업데이트

Office Fortigate에 대한 VPN 연결을 설정하려고 하는데 2단계를 통과할 수 없습니다.

시스템 관리자로부터 정보를 받았습니다:

  • PSK
  • IKE v1

  • 공격적 모드

  • 1단계 3DES-SHA1

  • DH 그룹 5

  • 키 수명 28800

  • XAUTH PAP 서버(알아야 할지는 확실하지 않음)

  • 2단계 3DES-SHA1

  • PFS 번호

이것은 여러 구성 시도 중 하나입니다. 다양한 매개변수를 추가/제거해 보았습니다.

config setup
interfaces=%defaultroute
plutodebug="control parsing"
plutoopts="--interface=wlan0"
dumpdir=/var/run/pluto/
nat_traversal=no
virtual_private=%v4:
10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v6:fd00::/8,%v6:fe80::/10
oe=off
protostack=netkey

conn office
left=%defaultroute
right=<my gateway ip>

phase2=ah
phase2alg=sha1;modp1536
type=transport
authby=secret
pfs=no
compress=no
   keyingtries=%forever

출력

?  /etc  sudo service ipsec restart
?  /etc  sudo ipsec auto --add office && sudo ipsec auto --up office
104 "office" #1: STATE_MAIN_I1: initiate
003 "office" #1: received Vendor ID payload [Dead Peer Detection]
003 "office" #1: ignoring unknown Vendor ID payload
[8299031757a36082c6a621de00050282]
106 "office" #1: STATE_MAIN_I2: sent MI2, expecting MR2
108 "office" #1: STATE_MAIN_I3: sent MI3, expecting MR3
003 "office" #1: discarding duplicate packet; already STATE_MAIN_I3
010 "office" #1: STATE_MAIN_I3: retransmission; will wait 20s for response
003 "office" #1: discarding duplicate packet; already STATE_MAIN_I3
010 "office" #1: STATE_MAIN_I3: retransmission; will wait 40s for response
031 "office" #1: max number of retransmissions (2) reached STATE_MAIN_I3.
Possible authentication failure: no acceptable response to our first
encrypted message
000 "office" #1: starting keying attempt 2 of an unlimited number, but
releasing whack

업데이트

내 구성에 공격적 모드를 추가했는데 잘못된 해시 정보에 대한 오류가 발생했습니다. 왜 그렇습니까? 매개변수가 올바르게 설정되어 있지 않습니까?

conn office 
    aggrmode=yes
     left=%defaultroute
     right=<vpn gateway>
     phase2=ah
     phase2alg=sha1;modp1536
     type=transport
     ike=3des-sha1;modp1536

     authby=secret
     #esp=3des;modp1536
     pfs=no
     compress=no
     keyingtries=%forever

산출

➜  /etc  sudo ipsec auto --up office 
112 "office" #1: STATE_AGGR_I1: initiate
003 "office" #1: received Vendor ID payload [Dead Peer Detection]
003 "office" #1: received Vendor ID payload [XAUTH]
003 "office" #1: ignoring unknown Vendor ID payload [8299031757a36082c6a621de00050282]
003 "office" #1: received Hash Payload does not match computed value
223 "office" #1: STATE_AGGR_I1: INVALID_HASH_INFORMATION

ipsec 자동 --상태

000 "office":     myip=unset; hisip=unset;
000 "office":   ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0
000 "office":   policy: PSK+AUTHENTICATE+UP+AGGRESSIVE+IKEv2ALLOW+SAREFTRACK+lKOD+rKOD; prio: 32,24; interface: wlan0; 
000 "office":   newest ISAKMP SA: #0; newest IPsec SA: #0; 
000 "office":   IKE algorithms wanted: 3DES_CBC(5)_000-SHA1(2)_000-MODP1536(5); flags=-strict
000 "office":   IKE algorithms found:  3DES_CBC(5)_192-SHA1(2)_160-MODP1536(5)
000 "office":   AH algorithms wanted: SHA1(2)_000; pfsgroup=MODP1536(5); flags=-strict
000 "office":   AH algorithms loaded: SHA1(2)_160
000  
000 #3: "office":500 STATE_AGGR_I1 (sent AI1, expecting AR1); none in -1s; lastdpd=-1s(seq in:0 out:0); idle; import:admin initiate
000 #3: pending Phase 2 for "office" replacing #0

업데이트 2

1단계를 통과했습니다. 방화벽 로그를 분석한 결과 설정된 터널이 예상과 다르고 PSK가 다른 것으로 나타났습니다.

이제 2단계 협상 오류가 발생했습니다. 시스템 관리자는 2단계에 사용자가 필요하다고 하는데 어떻게 지정해야 할지 모르겠나요?

➜  /etc  sudo ipsec auto --up office 
104 "office" #2: STATE_MAIN_I1: initiate
003 "office" #2: received Vendor ID payload [RFC 3947] method set to=109 
003 "office" #2: received Vendor ID payload [Dead Peer Detection]
003 "office" #2: ignoring unknown Vendor ID payload [8299031757a36082c6a621de00050282]
106 "office" #2: STATE_MAIN_I2: sent MI2, expecting MR2
003 "office" #2: NAT-Traversal: Result using RFC 3947 (NAT-Traversal): i am NATed
108 "office" #2: STATE_MAIN_I3: sent MI3, expecting MR3
004 "office" #2: STATE_MAIN_I4: ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY cipher=oakley_3des_cbc_192 prf=oakley_sha group=modp1024}
117 "office" #3: STATE_QUICK_I1: initiate
010 "office" #3: STATE_QUICK_I1: retransmission; will wait 20s for response
010 "office" #3: STATE_QUICK_I1: retransmission; will wait 40s for response
031 "office" #3: max number of retransmissions (2) reached STATE_QUICK_I1.  No acceptable response to our first Quick Mode message: perhaps peer likes no proposal
000 "office" #3: starting keying attempt 2 of an unlimited number, but releasing whack

답변1

수신기(Fortigate) 로그가 없으면 명확한 답변을 제공하기 어렵습니다.

가장 확실한 것부터 시작해 보겠습니다. VPN을 다음에서 재구성하세요.main mode(~ 아니다 aggressive mode) 유형을 에서 transport다음 으로 변경합니다.tunnel.

연결을 다시 시도하고 가능하다면 Fortigate 로그를 제공해 주세요.

관련 정보