☰

IPSEC 키 재생성에 대한 제안을 구성하는 방법

tag-icon • tag-icon ipsec strongswan
IPSEC 키 재생성에 대한 제안을 구성하는 방법

IPSEC(strongswan)를 통한 VPN 연결이 성공적으로 실행되고 있습니다. 그러나 적어도 하루에 한 번 연결이 끊어집니다. 키를 다시 입력하는 것과 관련이 있다고 생각합니다. 로그를 참조하세요.

Aug 25 02:34:25 myserver charon: 09[KNL] creating rekey job for CHILD_SA ESP/0xcbd335d0/xxx.xxx.xxx.xxx
Aug 25 02:34:25 myserver charon: 10[IKE] establishing CHILD_SA infonline_datapool{2} reqid 1
Aug 25 02:34:25 myserver charon: 12[CFG] received proposals: ESP:AES_CBC_256/HMAC_SHA2_256_128/MODP_2048/NO_EXT_SEQ
Aug 25 02:34:25 myserver charon: 12[CFG] configured proposals: ESP:AES_CBC_256/HMAC_SHA1_96/MODP_2048/NO_EXT_SEQ, ESP:AES_CBC_128/AES_CBC_192/AES_CBC_256/HMAC_SHA2_256_128/HMAC_SHA2_384_192/HMAC_SHA
2_512_256/HMAC_SHA1_96/AES_XCBC_96/NO_EXT_SEQ
Aug 25 02:34:25 myserver charon: 12[IKE] no acceptable proposal found
Aug 25 02:34:25 myserver charon: 12[IKE] failed to establish CHILD_SA, keeping IKE_SA
Aug 25 02:34:25 myserver charon: 12[IKE] sending DELETE for ESP CHILD_SA with SPI cbd2f4c3
Aug 25 02:34:25 myserver charon: 11[IKE] CHILD_SA rekeying failed, trying again in 10 seconds
Aug 25 02:34:35 myserver charon: 15[IKE] establishing CHILD_SA infonline_datapool{3} reqid 1
Aug 25 02:34:35 myserver charon: 06[CFG] received proposals: ESP:AES_CBC_256/HMAC_SHA2_256_128/MODP_2048/NO_EXT_SEQ
Aug 25 02:34:35 myserver charon: 06[CFG] configured proposals: ESP:AES_CBC_256/HMAC_SHA1_96/MODP_2048/NO_EXT_SEQ, ESP:AES_CBC_128/AES_CBC_192/AES_CBC_256/HMAC_SHA2_256_128/HMAC_SHA2_384_192/HMAC_SHA
2_512_256/HMAC_SHA1_96/AES_XCBC_96/NO_EXT_SEQ
Aug 25 02:34:35 myserver charon: 06[IKE] no acceptable proposal found
Aug 25 02:34:35 myserver charon: 06[IKE] failed to establish CHILD_SA, keeping IKE_SA
Aug 25 02:34:35 myserver charon: 06[IKE] sending DELETE for ESP CHILD_SA with SPI c068db7b
Aug 25 02:34:35 myserver charon: 07[IKE] received DELETE for ESP CHILD_SA with SPI c7a90494
Aug 25 02:34:35 myserver charon: 07[IKE] closing CHILD_SA infonline_datapool{1} with SPIs cbd335d0_i (34701240 bytes) c7a90494_o (451113 bytes) and TS yyy.yyy.yyy.0/25 === 10.10.42.0/24
Aug 25 02:34:35 myserver charon: 07[IKE] sending DELETE for ESP CHILD_SA with SPI cbd335d0
Aug 25 02:34:35 myserver charon: 07[IKE] CHILD_SA closed
Aug 25 02:34:35 myserver charon: 07[IKE] detected CHILD_REKEY collision with CHILD_DELETE
Aug 25 02:34:35 myserver charon: 09[IKE] received DELETE for unknown ESP CHILD_SA with SPI 632d34ba
Aug 25 02:34:35 myserver charon: 09[IKE] CHILD_SA closed
Aug 25 02:34:35 myserver charon: 10[IKE] received DELETE for unknown ESP CHILD_SA with SPI 632d34ba
Aug 25 02:34:35 myserver charon: 10[IKE] CHILD_SA closed
Aug 25 02:34:35 myserver charon: 12[IKE] received DELETE for IKE_SA infonline_datapool[1]
Aug 25 02:34:35 myserver charon: 12[IKE] deleting IKE_SA infonline_datapool[1] between xxx.xxx.xxx.xxx[xxx.xxx.xxx.xxx]...yyy.yyy.yyy.yyy[yyy.yyy.yyy.yyy]
Aug 25 02:34:35 myserver charon: 12[IKE] IKE_SA deleted

여기서 핵심 내용은 다음과 같습니다.

Aug 25 02:34:25 myserver charon: 12[CFG] received proposals: ESP:AES_CBC_256/HMAC_SHA2_256_128/MODP_2048/NO_EXT_SEQ
Aug 25 02:34:25 myserver charon: 12[CFG] configured proposals: ESP:AES_CBC_256/HMAC_SHA1_96/MODP_2048/NO_EXT_SEQ, ESP:AES_CBC_128/AES_CBC_192/AES_CBC_256/HMAC_SHA2_256_128/HMAC_SHA2_384_192/HMAC_SHA
2_512_256/HMAC_SHA1_96/AES_XCBC_96/NO_EXT_SEQ
Aug 25 02:34:25 myserver charon: 12[IKE] no acceptable proposal found

구성은

conn conn_name
    type=tunnel
    authby=secret
    left=xxx.xxx.xxx.xxx
    leftsubnet=xxx.xxx.xxx.0/25
    right=yyy.yyy.yyy.yyy
    rightsubnet=10.10.42.0/24
    ike=aes256-sha256-modp2048
    ikelifetime=86400s
    esp=aes256-sha1-modp2048
    pfs=yes
    auto=start

연결이 끊어지지 않도록 어떻게 구성합니까? (ipsec을 다시 시작하면 정상적으로 연결됩니다.)

답변1

귀하의 분석은 정확했습니다. 이제 올바른 결론을 내리기만 하면 됩니다 :)

당신이 지적한 로그 메시지에서 상대방이 제안하는 알고리즘을 확인할 수 있습니다. SHA-1을 구성했고 피어가 SHA-256을 제안했기 때문에 일치하는 항목이 없습니다(구성한 제안을 따르는 기본 제안에는 SHA-256이 포함되지만 DH 그룹이 없으므로 둘 중 하나도 일치하지 않습니다).

따라서 수정은 매우 간단합니다 esp=aes256-sha256-modp2048.

관련 정보