我有两个虚拟机
VM-1：我已经安装了 Strongswan 5.9。
VM-2：已安装 Strongswan 5.9，已安装freeradius（半径服务器）
我已经在两个 VM 上启动了 Strongswan systemctl start strongswan。
当我radtest <username> <password> <ipaddress> <NAS Port> <secretkey>从 VM-1 运行命令时，请求未经过 aaa 服务器的身份验证，但是当我停止时，strongswan.service我收到了Received Access-Accept来自 aaa 服务器的响应。
我的问题是为什么 VM-1 在活动时无法通信strongswan.service。我猜IPsec隧道没有建立。下面是我的swanctl.conf文件。任何人都可以在这里帮助我缺少什么。如何建立隧道并访问 AAA 服务器。
虚拟机-1
connections {
conn1 {
local_addrs = x.x.x.83
remote_addrs = x.x.x.171
local {
auth = psk
id = x.x.x.83
}
remote {
auth = psk
id = x.x.x.171
}
children {
vm1-to-aaa {
local_ts = x.x.x.83
remote_ts = x.x.x.171
start_action = trap
esp_proposals = aes192gcm16-aes128gcm16-prfsha256-ecp256-modp3072,aes192-sha256-ecp256-modp3072,default
mode = transport
}
}
version = 2
mobike = no
reauth_time = 10800
proposals = aes192gcm16-aes128gcm16-prfsha256-ecp256-ecp521,aes192-sha256- modp3072,default
}
}
secrets {
ike-1 {
id-1 = x.x.x.83
id-2 = x.x.x.171
secret = "thisissecret"
}
}
虚拟机 - 2
connections {
conn2 {
local_addrs = x.x.x.171
remote_addrs = x.x.x.83
local {
auth = psk
id = x.x.x.171
}
remote {
auth = psk
id = x.x.x.83
}
children {
aaa-to-vm1 {
local_ts = x.x.x.171
remote_ts = x.x.x.83
start_action = trap
esp_proposals = aes192gcm16-aes128gcm16-prfsha256-ecp256-modp3072,aes192-sha256-ecp256-modp3072,default
mode = transport
}
}
version = 2
mobike = no
reauth_time = 10800
proposals = aes192gcm16-aes128gcm16-prfsha256-ecp256-ecp521,aes192-sha256-modp3072,default
}
}
secrets {
ike-1 {
id-1 = x.x.x.171
id-2 = x.x.x.83
secret = "thisissecret"
}
}
更新
当我启动命令swanctl -i conn1 -c vm1-to-aaa时，我得到 -
[IKE] giving up after 5 retransmits
[IKE] establishing IKE_SA failed, peer not responding
initiate failed: establishing CHILD_SA 'vm1-to-aaa' failed
以下是我的防火墙设置 -
public (active)
target: default
icmp-block-inversion: no
interfaces: ens32
sources:
services: cockpit dhcpv6-client http https ipsec ssh
ports: 443/tcp 8765/tcp 8088/tcp 1812/udp 1813/udp 500/udp 4500/udp
protocols:
forward: no
masquerade: yes
forward-ports:
source-ports:
icmp-blocks:
rich rules:
rule protocol value="ah" accept
rule protocol value="esp" accept
