主页 / user-356322

Skar3's questions

Martin Hope
Pietro395
Asked: 2024-01-25 01:38:20 +0800 CST
  • 6

我正在尝试初始化 Google Cloud 上的 Ubuntu 虚拟机与远程站点之间的 IPsec 隧道。

连接已正确建立，但从 Google Cloud 上的 Ubuntu 计算机无法到达远程网络上的主机 (172.17.20.25)。

云云：

公共IP：50.50.50.50

私有IP：10.132.0.63/32

远程站点：

公共IP：100.100.100.100

远程专用网络：172.17.20.0/16

ipsec配置文件

config setup
        charondebug="all"
        uniqueids=yes
conn intacloud-to-tper
        type=tunnel
        auto=start
        keyexchange=ikev2
        authby=secret
        leftid=50.50.50.50
        leftsubnet=10.132.0.62/32
        right=100.100.100.100
        rightsubnet=172.17.20.0/16 
        ike=aes-sha1-modp2048
        esp=aes-sha1
        aggressive=no
        keyingtries=%forever
        ikelifetime=28800s
        lifetime=3600s
        dpddelay=30s
        dpdtimeout=120s
        dpdaction=restart

ip 路由显示表 220

172.17.0.0/16 via 10.132.0.1 dev ens4 proto static src 10.132.0.62

ipsec 状态全部

    Status of IKE charon daemon (strongSwan 5.9.5, Linux 6.2.0-1019-gcp, x86_64):
  uptime: 2 hours, since Jan 24 17:36:07 2024
  malloc: sbrk 3100672, mmap 0, used 1403424, free 1697248
  worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled: 3
  loaded plugins: charon aesni aes rc2 sha2 sha1 md5 mgf1 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf gmp agent xcbc hmac gcm drbg attr kernel-netlink resolve socket-default connmark stroke updown eap-mschapv2 xauth-generic counters
Listening IP addresses:
  10.132.0.62
Connections:
site-to-site:  %any...100.100.100.100  IKEv2, dpddelay=30s
site-to-site:   local:  [50.50.50.50] uses pre-shared key authentication
site-to-site:   remote: [100.100.100.100] uses pre-shared key authentication
site-to-site:   child:  10.132.0.62/32 === 172.17.0.0/16 TUNNEL, dpdaction=restart
Security Associations (1 up, 0 connecting):
site-to-site[1]: ESTABLISHED 2 hours ago, 10.132.0.62[50.50.50.50]...100.100.100.100[100.100.100.100]
site-to-site[1]: IKEv2 SPIs: -, pre-shared key reauthentication in 5 hours
site-to-site[1]: IKE proposal: AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_2048
site-to-site{4}:  INSTALLED, TUNNEL, reqid 1, ESP SPIs: cb5b6fdd_i 932ca574_o
site-to-site{4}:  AES_CBC_128/HMAC_SHA1_96, 0 bytes_i, 0 bytes_o, rekeying in 27 minutes
site-to-site{4}:   10.132.0.62/32 === 172.17.0.0/16

ip xfrm 策略

src 10.132.0.63/32 dst 172.17.0.0/16 
    dir out priority 375423 ptype main 
    tmpl src 10.132.0.63 dst 100.100.100.100
        proto esp spi 0xbb44a532 reqid 1 mode tunnel
src 172.17.0.0/16 dst 10.132.0.63/32 
    dir fwd priority 375423 ptype main 
    tmpl src 100.100.100.100 dst 10.132.0.63
        proto esp reqid 1 mode tunnel

我无法理解是否可能存在配置问题或者问题是否可能出在远程站点的配置中

linux-networking