与H3C SecPath防火墙建立IPSec VPN

网络需求

如图所示,通过IPsec VPN(接口模式)将2个局域网连接起来,实现10.10.1.0/24与10.10.2.0/24两个网段的通信。与H3C SecPath防火墙进行IPsec VPN(IKE v1)对接。

H3C SecPath防火墙版本:

<H3C>display version
H3C Comware Software, Version 7.1.064, ESS 1185P29
Copyright (c) 2004-2022 New H3C Technologies Co., Ltd. All rights reserved.
H3C SecPath vFW1000 uptime is 0 weeks, 0 days, 0 hours, 7 minutes
Last reboot reason : Power on
Boot image: flash:/vFW1000-CMW710-BOOT-E1185P29-X64.bin
Boot image version: 7.1.064, ESS 1185P29
  Compiled Oct 31 2022 14:00:00
System image: flash:/vFW1000-CMW710-SYSTEM-E1185P29-X64.bin
System image version: 7.1.064, ESS 1185P29
  Compiled Oct 31 2022 14:00:00

网络拓扑

image-20230407143613640

配置要点

  • 配置FortiGate
    • 基本上网配置
    • 配置IPsec VPN
  • 配置H3C SecPath防火墙
    • 基本上网配置
    • 配置IPsec VPN
  • 说明:如果要删除IPSEC VPN第一阶段、第二阶段时,需要先删除被调用的路由与防火墙安全策略。

配置步骤

FortiGate

  1. 基本上网配置。

    image-20230406170902324

    image-20230406162053557

    image-20230406152810519

  2. 配置IPSec VPN,进入VPN→IPSec隧道,点击新建→IPSec隧道按钮。

    image-20230406151353826

  3. 选择IPsec VPN自定义模板进行配置,点击下一步。

    image-20230406151654592

  4. 如图配置网络、认证、第一阶段、第二阶段。

    不像和Cisco/PA/Juniper/山石使用虚拟接口创建IPSec,感兴趣流是全0。H3C防火墙通常都是使用物理口创建IPSec,需要写明细的感兴趣流,所以FortiGate也要对应的写明细感兴趣数据流,不能写全0。

    image-20230406152527280

    config vpn ipsec phase1-interface
        edit "VPN-to-Remote"
            set interface "port2"
            set peertype any
            set net-device disable
            set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1
            set dpd on-idle
            set remote-gw 202.103.23.2
            set psksecret xxxxxxxx
        next
    end
    
    config vpn ipsec phase2-interface
        edit "VPN-to-Remote"
            set phase1name "VPN-to-Remote"
            set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305
            set auto-negotiate enable
            set src-subnet 10.10.1.0 255.255.255.0
            set dst-subnet 10.10.2.0 255.255.255.0
        next
    end
    
  5. 配置VPN相关的网段地址对象和防火墙策略。

    image-20230406152921211

    image-20230406153125073

    config firewall address
        edit "Local_10.10.1.0/24"
            set subnet 10.10.1.0 255.255.255.0
        next
        edit "Remote_10.10.2.0/24"
            set subnet 10.10.2.0 255.255.255.0
        next
    end
    
    config firewall policy
        edit 2
            set name "VPN-Local-to-Remote"
            set srcintf "port3"
            set dstintf "VPN-to-Remote"
            set action accept
            set srcaddr "Local_10.10.1.0/24"
            set dstaddr "Remote_10.10.2.0/24"
            set schedule "always"
            set service "ALL"
        next
        edit 3
            set name "VPN-Remote-to-Local"
            set srcintf "VPN-to-Remote"
            set dstintf "port3"
            set action accept
            set srcaddr "Remote_10.10.2.0/24"
            set dstaddr "LAN_10.10.1.0/24"
            set schedule "always"
            set service "ALL"
        next
    end
    
  6. 配置VPN业务网段的静态路由。

    相关VPN的路由配置中“黑洞路由的意义:

    你可能会遇到以下的VPN业务问题:通过VPN的SIP电话,时不时中断,无法向服务器成功注册 ?通过VPN的Radius认证无法经常会无法认证成功? 通过VPN的AP注册到总部时不时会中断?持续的PRGT监控ping总部的服务器,时不时会显示中断?

    VPN有时候会因为各种原因重新连接,比如互联网不稳定,PPPOE重新连接更换公网IP地址等,VPN tunnel此时会出现短暂的DOWN,而去往对方的VPN业务网段的路由也会短暂消失,此时VPN的业务流量(SIP注册请求/Radius/Capwap/ICMP)会因为查询到了默认路由而走向了WAN(Internet),从而产生了错误的UDP-NAT-Seesion,此时即便VPN tunnel再次UP,VPN业务网段的路由再次恢复,SIP等VPN旧的业务流量依旧会走到错误的Session上去,从而引起该业务异常。

    解决方法:

    • 方法一:配置去往VPN业务网段的“黑洞路由”,管理距离为254,VPN正常的情况下此黑洞路由不生效,而当VPN中断的时候,黑洞路由浮起来并且生效,将VPN中断时候的VPN流量丢弃,避免将流量转发到互联网而产生错误的session。配置VPN的备份黑洞路由的意义在此。

    • 方法二:配置源接口:LAN,目的接口:WAN,源IP:本地内网网段,目的IP:对端内网网段,动作:丢包的策略。将此去往Internet的私网(无用的)流量丢弃掉,避免FGT产生这种错误的session,从而避免了UDP业务时不时中断的问题。

    • 方法三:在全局下开启“set snat-route-change enable”,一旦路由发生变化,将相关的会话flag置位为“Dirty”,清除路由缓存并重新查找目的IP的下一跳地址,这样VPN隧道恢复的时候,流量也会相应的切换到VPN隧道里面来。

      FortiGate # config system global
      FortiGate (global) # set snat-route-change enable                             
      FortiGate (global) # end
      

    三种方式任意选择一种即可。推荐使用黑洞路由方式。

    image-20230406162206218

    config router static
        edit 1
            set gateway 202.103.12.1
            set device "port2"
        next
        edit 2
            set dst 10.10.2.0 255.255.255.0
            set device "VPN-to-Remote"
        next
        edit 3
            set dst 10.10.2.0 255.255.255.0
            set distance 254
            set blackhole enable
        next
    end
    

H3C SecPath

  1. 基本IP与路由配置。

    image-20230407145224241

    image-20230407145254968

    interface GigabitEthernet2/0
     port link-mode route
     ip address 202.103.23.2 255.255.255.0
     manage ping inbound
     manage ping outbound
    #
    interface GigabitEthernet3/0
     port link-mode route
     ip address 10.10.2.1 255.255.255.0
     manage ping inbound
     manage ping outbound
    #
    security-zone name Trust
     import interface GigabitEthernet3/0
    #
    security-zone name Untrust
     import interface GigabitEthernet2/0
    #
     ip route-static 0.0.0.0 0 GigabitEthernet2/0 202.103.23.1
    
  2. 地址对象、策略、NAT配置。

    image-20230407145809794

    image-20230407150155866

    image-20230407150426518

    object-group ip address Local_10.10.2.0/24
     0 network subnet 10.10.2.0 255.255.255.0
    #
    object-group ip address Remote_10.10.1.0/24
     0 network subnet 10.10.1.0 255.255.255.0
    #
    security-policy ip
     rule 2 name to_Internet
      action pass
      source-zone Trust
      destination-zone Untrust
      source-ip Local_10.10.2.0/24
    #
    nat policy
     rule name to_Internet
      source-ip Local_10.10.2.0/24
      outbound-interface GigabitEthernet2/0
      action easy-ip
    
  3. 配置IPSec,新建IKE提议,按照如图安全提议配置,点击确定下发配置。

    image-20230407150808990

  4. 新建IPSec策略,如下图参数配置,注意与FortiGate端的安全提议要一致,注意对端ID选择“IPv4地址”,内容填写为FortiGate的公网口IP地址,如果FortiGate的地址是动态的,可以选择FQDN形式的ID,FortiGate侧本地ID也要对应修改为FQDN形式,开启“自动触发”和“DPD”,勾选“自动生成安全策略”(这里自动创建的策略是允许IPSec协商的发起和接受)。

    image-20230407155453402

    acl advanced name IPsec_to_FortiGate_IPv4_1
     rule 0 permit ip source 10.10.2.0 0.0.0.255 destination 10.10.1.0 0.0.0.255
    #
    ipsec transform-set to_FortiGate_IPv4_1
     esp encryption-algorithm aes-cbc-256 
     esp authentication-algorithm sha256 
     pfs dh-group14
    #
    ipsec policy to_FortiGate 1 isakmp
     transform-set to_FortiGate_IPv4_1 
     security acl name IPsec_to_FortiGate_IPv4_1 
     local-address 202.103.23.2
     remote-address 202.103.13.2 
     ike-profile to_FortiGate_IPv4_1
     sa trigger-mode auto
     sa duration time-based 43200
     sa idle-time 60
    #
    ike profile to_FortiGate_IPv4_1
     keychain to_FortiGate_IPv4_1
     dpd interval 20 on-demand
     match remote identity address 202.103.13.2 255.255.255.255
     match local address GigabitEthernet2/0
    #
    ike proposal 1
     encryption-algorithm aes-cbc-256
     dh group14
     authentication-algorithm sha256
    #
    ike keychain to_FortiGate_IPv4_1
     match local address GigabitEthernet2/0
     pre-shared-key address 202.103.13.2 255.255.255.255 key cipher $c$3$OAC3tjUo2G+AOc7w0iW8jeQvV2wpRj96iHSZ
    #
    interface GigabitEthernet2/0
     ipsec apply policy to_FortiGate
    #
    security-policy ip
     rule 4 name IPsec_to_FortiGate_1_20230407151324_IN
      action pass
      destination-zone Local
      service ike
      service nat-t-ipsec
      service ipsec-ah
      service ipsec-esp
     rule 3 name IPsec_to_FortiGate_1_20230407151324_OUT
      action pass
      source-zone Local
      service ike
      service nat-t-ipsec
      service ipsec-ah
      service ipsec-esp
    
  5. 配置IPSec VPN相关网段放通的安全策略,并将他们移动至上网策略之前。

    image-20230407154732180

    security-policy ip
     rule 6 name VPN_from_FortiGate
      action pass
      source-zone Untrust
      destination-zone Trust
      source-ip Remote_10.10.1.0/24
      destination-ip Local_10.10.2.0/24
     rule 5 name VPN_to_FortiGate
      action pass
      source-zone Trust
      destination-zone Untrust
      source-ip Local_10.10.2.0/24
      destination-ip Remote_10.10.1.0/24
     rule 4 name IPsec_to_FortiGate_1_20230407151324_IN
      action pass
      destination-zone Local
      service ike
      service nat-t-ipsec
      service ipsec-ah
      service ipsec-esp
     rule 3 name IPsec_to_FortiGate_1_20230407151324_OUT
      action pass
      source-zone Local
      service ike
      service nat-t-ipsec
      service ipsec-ah
      service ipsec-esp
     rule 2 name to_Internet
      action pass
      source-zone Trust
      destination-zone Untrust
      source-ip Local_10.10.2.0/24
    
  6. H3C防火墙的转发流程是先做SNAT,再做IPsec VPN,也就是说,如果按照我们之前配置的SNAT规则,VPN的流量10.10.2.2去访问10.10.1.2的流量会被SNAT成公网IP 202.103.23.2,然后再进入到IPsec VPN流程,这个时候是无法匹配到感兴趣流的,因此流量将无法成功被IPSec加密。所以需要再配置一个VPN流量bypass的SNAT规则,让VPN流量不做SNAT转换,然后将其放置到最前面,优先匹配即可。

    image-20230407155758708

    nat policy
     rule name VPN_to_FortiGate
      source-ip Local_10.10.2.0/24
      destination-ip Remote_10.10.1.0/24
      outbound-interface GigabitEthernet2/0
      action no-nat
     rule name to_Internet
      source-ip Local_10.10.2.0/24
      outbound-interface GigabitEthernet2/0
      action easy-ip
    
  7. 添加去往FortiGate内网VPN网段的静态路由(由于已经配置了默认路由从IPSec绑定的物理口出去,其实这里不需要配置,但如果没有默认路由或默认路由是其他接口,可以参考此配置)。

    image-20230407160159902

    ip route-static 10.10.1.0 24 GigabitEthernet2/0 202.103.23.1
    

结果验证

  1. FortiGate上查看IPSec隧道建立,在仪表盘新建IPSec监控,可以看到IPSec建立成功。

    image-20230406172145986

    FortiGate # diagnose vpn ike gateway list 
    vd: root/0
    name: VPN-to-Remote
    version: 1
    interface: port2 4
    addr: 202.103.13.2:500 -> 202.103.23.2:500
    tun_id: 202.103.23.2/::202.103.23.2
    remote_location: 0.0.0.0
    network-id: 0
    created: 2435s ago
    IKE SA: created 1/1  established 1/1  time 20/20/20 ms
    IPsec SA: created 1/38  established 1/38  time 20/75/2030 ms
      id/spi: 365 3f178bf07066db5b/4bc6621ed12c3030
      direction: initiator
      status: established 2435-2435s ago = 20ms
      proposal: aes256-sha256
      key: 2f13f4b81d3eb4c1-575e1272457cc854-d37978c764f9a778-cd5724cdc244f07a
      lifetime/rekey: 86400/83664
      DPD sent/recv: 00000a61/000030dd
    
    FortiGate # diagnose vpn tunnel list 
    list all ipsec tunnel in vd 0
    ------------------------------------------------------
    name=VPN-to-Remote ver=1 serial=1 202.103.13.2:0->202.103.23.2:0 tun_id=202.103.23.2 tun_id6=::202.103.23.2 dst_mtu=1500 dpd-link=on weight=1
    bound_if=4 lgwy=static/1 tun=intf mode=auto/1 encap=none/552 options[0228]=npu frag-rfc  run_state=0 role=primary accept_traffic=1 overlay_id=0
    proxyid_num=1 child_num=0 refcnt=4 ilast=13 olast=13 ad=/0
    stat: rxp=10 txp=15 rxb=840 txb=1260
    dpd: mode=on-idle on=1 idle=20000ms retry=3 count=0 seqno=2658
    natt: mode=none draft=0 interval=0 remote_port=0
    proxyid=VPN-to-Remote proto=0 sa=1 ref=2 serial=1 auto-negotiate
      src: 0:10.10.1.0-10.10.1.255:0
      dst: 0:10.10.2.0-10.10.2.255:0
      SA:  ref=3 options=38203 type=00 soft=0 mtu=1438 expire=42881/0B replaywin=2048
           seqno=1 esn=0 replaywin_lastseq=00000000 qat=0 rekey=0 hash_search_len=1
      life: type=01 bytes=0/0 timeout=42901/43200
      dec: spi=34dc89a0 esp=aes key=32 9ebf3ec4affd4b4a57b18fe15c1c505184622c2cdcba87d788887f569cfaa23e
           ah=sha256 key=32 c3efca48ffbcd7fb0e8013fef745576010a71ec3c9a02a32f333c380de01e2a6
      enc: spi=bc07e7b7 esp=aes key=32 660dedaa1a6d145b94073c031a3e9f1587dcb44d3b50b9683382b27ecd5562ce
           ah=sha256 key=32 308adc9899b8775255c59053ed4a5edc3df8231135007d2a26614097619361de
      dec:pkts/bytes=0/0, enc:pkts/bytes=0/0
      npu_flag=00 npu_rgwy=202.103.23.2 npu_lgwy=202.103.13.2 npu_selid=0 dec_npuid=0 enc_npuid=0
    run_tally=0
    
  2. 查看FortiGate的路由表。

    FortiGate # get router info routing-table all
    Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
           O - OSPF, IA - OSPF inter area
           N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
           E1 - OSPF external type 1, E2 - OSPF external type 2
           i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
           * - candidate default
    
    Routing table for VRF=0
    S*      0.0.0.0/0 [10/0] via 202.103.13.1, port2, [1/0]
    C       10.10.1.0/24 is directly connected, port3
    S       10.10.2.0/24 [10/0] via VPN-to-Remote tunnel 202.103.23.2, [1/0]
    C       192.168.100.0/24 is directly connected, port1
    C       202.103.13.0/24 is directly connected, port2
    
  3. FortiGate侧PC1业务测试。

    VPCS> show
    NAME   IP/MASK              GATEWAY                             GATEWAY
    VPCS1  10.10.1.2/24         10.10.1.1
           fe80::250:79ff:fe66:6804/64
    
    VPCS> ping 10.10.2.2
    84 bytes from 10.10.2.2 icmp_seq=1 ttl=62 time=4.769 ms
    84 bytes from 10.10.2.2 icmp_seq=2 ttl=62 time=2.769 ms
    84 bytes from 10.10.2.2 icmp_seq=3 ttl=62 time=2.194 ms
    84 bytes from 10.10.2.2 icmp_seq=4 ttl=62 time=3.881 ms
    84 bytes from 10.10.2.2 icmp_seq=5 ttl=62 time=2.335 ms
    
  4. H3C防火墙查看IPSec连接状态。

    image-20230407160522278

    <H3C>display ike sa verbose remote 202.103.13.2
       -----------------------------------------------
       Connection ID: 2
       Outside VPN: 
       Inside VPN: 
       Profile: to_FortiGate_IPv4_1
       Transmitting entity: Responder
       Initiator cookie: 3f178bf07066db5b
       Responder cookie: 4bc6621ed12c3030
       -----------------------------------------------
       Local IP/port: 202.103.23.2/500
       Local ID type: IPV4_ADDR
       Local ID: 202.103.23.2
    
       Remote IP/port: 202.103.13.2/500
       Remote ID type: IPV4_ADDR
       Remote ID: 202.103.13.2
    
       Authentication-method: PRE-SHARED-KEY
       Authentication-algorithm: SHA256
       Encryption-algorithm: AES-CBC-256
    
       Life duration(sec): 86400
       Remaining key duration(sec): 83791
       Exchange-mode: Main
       Diffie-Hellman group: Group 14
       NAT traversal: Not detected
    
       Extend authentication: Disabled
       Assigned IP address:
       Vendor ID index:0xffffffff
       Vendor ID sequence number:0x0
    
    <H3C> display ipsec sa remote 202.103.13.2
    -------------------------------
    Interface: GigabitEthernet2/0
    -------------------------------
    
      -----------------------------
      IPsec policy: to_FortiGate
      Sequence number: 1
      Mode: ISAKMP
      -----------------------------
        Tunnel id: 0
        Encapsulation mode: tunnel
        Perfect Forward Secrecy: dh-group14
        Inside VPN: 
        Extended Sequence Numbers enable: N
        Traffic Flow Confidentiality enable: N
        Transmitting entity: Responder
        Path MTU: 1424
        Tunnel:
            local  address: 202.103.23.2
            remote address: 202.103.13.2
        Flow:
            sour addr: 10.10.2.0/255.255.255.0  port: 0  protocol: ip
            dest addr: 10.10.1.0/255.255.255.0  port: 0  protocol: ip
    
        [Inbound ESP SAs]
          SPI: 1271313254 (0x4bc6b366)
          Connection ID: 347892350977
          Transform set: ESP-ENCRYPT-AES-CBC-256 ESP-AUTH-SHA256
          SA idle time: 60
          SA duration (kilobytes/sec): 1843200/43200
          SA remaining duration (kilobytes/sec): 1843200/43177
          Max received sequence-number: 0
          Anti-replay check enable: Y
          Anti-replay window size: 64
          UDP encapsulation used for NAT traversal: N
          Status: Active
    
        [Outbound ESP SAs]
          SPI: 886868385 (0x34dc89a1)
          Connection ID: 347892350976
          Transform set: ESP-ENCRYPT-AES-CBC-256 ESP-AUTH-SHA256
          SA idle time: 60
          SA duration (kilobytes/sec): 1843200/43200
          SA remaining duration (kilobytes/sec): 1843200/43177
          Max sent sequence-number: 0
          UDP encapsulation used for NAT traversal: N
          Status: Active
    
  5. 查看H3C防火墙的路由表,可以看到包含了手动配置的到FortiGate内网的路由。

    <H3C>display ip routing-table
    Destinations : 18       Routes : 18
    Destination/Mask   Proto   Pre Cost        NextHop         Interface
    0.0.0.0/0          Static  60  0           202.103.23.1    GE2/0
    0.0.0.0/32         Direct  0   0           127.0.0.1       InLoop0
    10.10.1.0/24       Static  60  0           202.103.23.1    GE2/0
    10.10.2.0/24       Direct  0   0           10.10.2.1       GE3/0
    10.10.2.1/32       Direct  0   0           127.0.0.1       InLoop0
    10.10.2.255/32     Direct  0   0           10.10.2.1       GE3/0
    127.0.0.0/8        Direct  0   0           127.0.0.1       InLoop0
    127.0.0.1/32       Direct  0   0           127.0.0.1       InLoop0
    127.255.255.255/32 Direct  0   0           127.0.0.1       InLoop0
    192.168.100.0/24   Direct  0   0           192.168.100.6   GE1/0
    192.168.100.6/32   Direct  0   0           127.0.0.1       InLoop0
    192.168.100.255/32 Direct  0   0           192.168.100.6   GE1/0
    202.103.23.0/24    Direct  0   0           202.103.23.2    GE2/0
    202.103.23.2/32    Direct  0   0           127.0.0.1       InLoop0
    202.103.23.255/32  Direct  0   0           202.103.23.2    GE2/0
    224.0.0.0/4        Direct  0   0           0.0.0.0         NULL0
    224.0.0.0/24       Direct  0   0           0.0.0.0         NULL0
    255.255.255.255/32 Direct  0   0           127.0.0.1       InLoop0
    
  6. H3C防火墙侧PC2业务测试。

    VPCS> show
    
    NAME   IP/MASK              GATEWAY                             GATEWAY
    VPCS1  10.10.2.2/24         10.10.2.1
           fe80::250:79ff:fe66:6805/64
    
    VPCS> ping 10.10.1.2
    
    84 bytes from 10.10.1.2 icmp_seq=1 ttl=62 time=3.529 ms
    84 bytes from 10.10.1.2 icmp_seq=2 ttl=62 time=2.741 ms
    84 bytes from 10.10.1.2 icmp_seq=3 ttl=62 time=2.472 ms
    84 bytes from 10.10.1.2 icmp_seq=4 ttl=62 time=2.250 ms
    84 bytes from 10.10.1.2 icmp_seq=5 ttl=62 time=2.193 ms
    
  7. FortiGate侧抓包查看。

    FortiGate # diagnose sniffer packet any 'host 10.10.2.2 and host 10.10.1.2 and icmp' 4 0 l
    Using Original Sniffing Mode
    interfaces=[any]
    filters=[host 10.10.2.2 and host 10.10.1.2 and icmp]
    2023-04-07 16:07:08.123477 VPN-to-Remote in 10.10.2.2 -> 10.10.1.2: icmp: echo request
    2023-04-07 16:07:08.123667 port3 out 10.10.2.2 -> 10.10.1.2: icmp: echo request
    2023-04-07 16:07:08.123902 port3 in 10.10.1.2 -> 10.10.2.2: icmp: echo reply
    2023-04-07 16:07:08.123914 VPN-to-Remote out 10.10.1.2 -> 10.10.2.2: icmp: echo reply
    2023-04-07 16:07:09.127191 VPN-to-Remote in 10.10.2.2 -> 10.10.1.2: icmp: echo request
    2023-04-07 16:07:09.127380 port3 out 10.10.2.2 -> 10.10.1.2: icmp: echo request
    2023-04-07 16:07:09.127691 port3 in 10.10.1.2 -> 10.10.2.2: icmp: echo reply
    2023-04-07 16:07:09.127700 VPN-to-Remote out 10.10.1.2 -> 10.10.2.2: icmp: echo reply
    2023-04-07 16:07:10.131278 VPN-to-Remote in 10.10.2.2 -> 10.10.1.2: icmp: echo request
    2023-04-07 16:07:10.131445 port3 out 10.10.2.2 -> 10.10.1.2: icmp: echo request
    2023-04-07 16:07:10.131618 port3 in 10.10.1.2 -> 10.10.2.2: icmp: echo reply
    2023-04-07 16:07:10.131624 VPN-to-Remote out 10.10.1.2 -> 10.10.2.2: icmp: echo reply
    2023-04-07 16:07:11.134468 VPN-to-Remote in 10.10.2.2 -> 10.10.1.2: icmp: echo request
    2023-04-07 16:07:11.134502 port3 out 10.10.2.2 -> 10.10.1.2: icmp: echo request
    2023-04-07 16:07:11.134737 port3 in 10.10.1.2 -> 10.10.2.2: icmp: echo reply
    2023-04-07 16:07:11.134744 VPN-to-Remote out 10.10.1.2 -> 10.10.2.2: icmp: echo reply
    2023-04-07 16:07:12.137190 VPN-to-Remote in 10.10.2.2 -> 10.10.1.2: icmp: echo request
    2023-04-07 16:07:12.137220 port3 out 10.10.2.2 -> 10.10.1.2: icmp: echo request
    2023-04-07 16:07:12.137409 port3 in 10.10.1.2 -> 10.10.2.2: icmp: echo reply
    2023-04-07 16:07:12.137416 VPN-to-Remote out 10.10.1.2 -> 10.10.2.2: icmp: echo reply
    

说明

关于sniffer抓VPN业务和ESP的包:

  • 抓取IPsec VPN的IKE协商包:

    diagnose sniffer packet any "host 101.1.1.1 and (port 500 or port 4500)" 4
    
  • 抓取IPsec VPN的ESP加密数据包:

    diagnose sniffer packet any "host 101.1.1.1 and esp" 4
    
  • 抓取IPsec VPN的明文业务数据包:

    diagnose sniffer packet any "host 192.168.112.100 and icmp" 4
    
  • 注意:由于硬件设备存在IPsec VPN芯片加速,因此可能数据包会抓不完全,主要指“ESP数据和明文业务数据”抓不全,因此有时候需要将VPN隧道的NP加速关闭:

    FortiGate # config vpn ipsec phase1-interface        
    FortiGate (phase1-interface) # edit BJ-OSPF-TO-SH        
    FortiGate (BJ-OSPF-TO-SH) # set npu-offload disable
    FortiGate (BJ-OSPF-TO-SH) # end
    

Copyright © 2024 Fortinet Inc. All rights reserved. Powered by Fortinet TAC Team.
📲扫描下方二维码分享此页面👇
该页面修订于: 2024-03-14 11:34:06

results matching ""

    No results matching ""