理解Cisco IP Security排错

如果需要搭建IPSec VPN网络，除了知道如何配置isakmp和ipsec外，还需要知道如何进行排错和调试，本文基于Cisco IOS VPN对IKE协议和相关的排错命令进行介绍。

Router#show crypto isakmp sa dst src state conn-id slot 12.1.1.2 12.1.1.1 QM_IDLE 1 0

这条命令用来查看在两段间建立的Internet Security Association Management Protocol (ISAKMP)的security associations (SAs)。

Router#show crypto ipsec sa

interface: FastEthernet0
    Crypto map tag: test, local addr. 12.1.1.1
   local  ident (addr/mask/prot/port): (20.1.1.0/255.255.255.0/0/0)
   remote ident (addr/mask/prot/port): (10.1.1.0/255.255.255.0/0/0)
   current_peer: 12.1.1.2
     PERMIT, flags={origin_is_acl,}
    #pkts encaps: 7767918, #pkts encrypt: 7767918, #pkts digest 7767918
    #pkts decaps: 7760382, #pkts decrypt: 7760382, #pkts verify 7760382
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0, 
    #pkts decompress failed: 0, #send errors 1, #recv errors 0
     local crypto endpt.: 12.1.1.1, remote crypto endpt.: 12.1.1.2
     path mtu 1500, media mtu 1500
     current outbound spi: 3D3
     inbound esp sas:
      spi: 0x136A010F(325714191)
        transform: esp-3des esp-md5-hmac ,
        in use settings ={Tunnel, }
        slot: 0, conn id: 3442, flow_id: 1443, crypto map: test
        sa timing: remaining key lifetime (k/sec): (4608000/52)
        IV size: 8 bytes
        replay detection support: Y
     inbound ah sas:
     inbound pcp sas:
inbound pcp sas:
outbound esp sas:
   spi: 0x3D3(979)
    transform: esp-3des esp-md5-hmac ,
    in use settings ={Tunnel, }
    slot: 0, conn id: 3443, flow_id: 1444, crypto map: test
    sa timing: remaining key lifetime (k/sec): (4608000/52)
    IV size: 8 bytes
    replay detection support: Y
outbound ah sas:
outbound pcp sas: 

上面的命令用了查看IPSec的Sa。可以看到从20.1.1.0/24到10.1.1.0/24的数据将通过建立起来的隧道(Tunnel)进行传输。你能够看到在Inbound和Outbound上建立了两个Encapsulating Security Payload (ESP)。并且，这里没有使用Authentication Head(AH)。

Router#show crypto engine connection active

这条命令可以查看Phase 2 的SA建立和统计的流量信息。由于Phase 2的SA是单项的(inbound是解密，outbound是加密)，所以可以看到通过隧道的流入和流出的流量。

---

下面来介绍crypto的debug命令

Router#debug crypto isakmp

processing SA payload. message ID = 0 
Checking ISAKMP transform against priority 1 policy 
	encryption DES-CBC 
      	hash SHA 
	default group 2 
	auth pre-share 
	life type in seconds 
	life duration (basic) of 240 
atts are acceptable. Next payload is 0 
processing KE payload. message ID = 0 
processing NONCE payload. message ID = 0 
processing ID payload. message ID = 0 
SKEYID state generated 
processing HASH payload. message ID = 0 
SA has been authenticated 
processing SA payload. message ID = 800032287

Router#debug crypto ipsec

Checking IPSec proposal 1transform 1, ESP_DES 
attributes in transform: 
	encaps is 1 
	SA life type in seconds 
	SA life duration (basic) of 3600 
	SA life type in kilobytes 
	SA life duration (VPI) of 0x0 0x46 0x50 0x0 
HMAC algorithm is SHA 
atts are acceptable. 
Invalid attribute combinations between peers will show up as "atts 
  not acceptable".
IPSEC(validate_proposal_request): proposal part #2, 
(key eng. msg.) dest= 12.1.1.2, SRC= 12.1.1.1, 
      dest_proxy= 10.1.1.0/0.0.0.0/0/0,
      src_proxy= 20.1.1.0/0.0.0.16/0/0, 
      protocol= ESP, transform= esp-des esp-sha-hmac 
      lifedur= 0s and 0kb,
      spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x4 
IPSEC(key_engine): got a queue event... 
IPSEC(spi_response): getting spi 203563166 for SA 
      from 12.1.1.2 to 12.1.1.1 for prot 2 
IPSEC(spi_response): getting spi 194838793 for SA 
      from 12.1.1.2 to 12.1.1.1 for prot 3 
IPSEC(key_engine): got a queue event... 
IPSEC(initialize_sas): , 
  (key eng. msg.) dest= 12.1.1.2, SRC= 12.1.1.1, 
      dest_proxy= 10.1.1.0/255.255.255.0/0/0, 
      src_proxy= 20.1.1.0/255.255.255.0/0/0, 
      protocol= ESP, transform= esp-des esp-sha-hmac
      lifedur= 3600s and 4608000kb, 
      spi= 0xC22209E(203563166), conn_id= 3, 
              keysize=0, flags= 0x4 
IPSEC(initialize_sas): ,
  (key eng. msg.) SRC= 12.1.1.2, dest= 12.1.1.1, 
      src_proxy= 10.1.1.0/255.255.255.0/0/0, 
      dest_proxy= 20.1.1.0/255.255.255.0/0/0, 
      protocol= ESP, transform= esp-des esp-sha-hmac 
      lifedur= 3600s and 4608000kb, 
      spi= 0xDED0AB4(233638580), conn_id= 6, 
              keysize= 0, flags= 0x4 
IPSEC(create_sa): sa created, 
      (sa) sa_dest= 12.1.1.2, sa_prot= 50, 
      sa_spi= 0xB9D0109(194838793), 
      sa_trans= esp-des esp-sha-hmac , sa_conn_id= 5 
 IPSEC(create_sa): sa created, 
      (sa) sa_dest= 12.1.1.2, sa_prot= 50, 
      sa_spi= 0xDED0AB4(233638580), 
      sa_trans= esp-des esp-sha-hmac , sa_conn_id= 6 

上面命令用来调试Ipsec，src_proxy表示本地地址，dest_proxy表示远程网络地址。在每个方向上，会有两个sa被建立。

---

简单的错误信息解释

下面这些信息是通过debug命令得到

Replay Check Failed

 "%CRYPTO-4-PKT_REPLAY_ERR: decrypt: replay check failed connection id=#."

这个错误信息只有使用了esp-md5-hmac才会发生，如果要解决这个问题，可以参考Cisco的BugID为或者仅使用加密。

Invalid Local Address

IPSEC(validate_proposal): invalid local address 12.2.6.2
ISAKMP (0:3): atts not acceptable. Next payload is 0
ISAKMP (0:3): SA not acceptable!

产生这个问题有两种可能：
1、是由于使用了crypto map map-name local-address interface-id命令，导致路由器使用了一个错误的IP地址。
2、crypto map被应用到一个错误的接口上或者根本就没有被应用，这时应该检查你的配置。

当你使用show crypto isakmp sa 查看ISAKMP SA 信息时，得到的状态是 MM_NO_STATE. 这以为着主模式(Main Mode)失败。

dst src state conn-id slot 10.1.1.2 10.1.1.1 MM_NO_STATE 1 0

这时候要作的就是验证两端设备Policy是否匹配。

Encryption DES or 3DES
Hash MD5 or SHA
Diffie-Hellman Group 1 or 2
Authentication {rsa-sig | rsa-encr | pre-share}