_{Original file}

Для проверки работоспособности и поиска проблем следует выполнить последовательность шагов

Например, политика gost-ipsec

swanctl —list-conns

pass-mcast: IKEv1/2, no reauthentication, rekeying every 14400s

local: %any

remote: 127.0.0.1

local unspecified authentication:

remote unspecified authentication:

pass-mcast: PASS, no rekeying

local: 0.0.0.0/0

remote: 224.0.0.0/4

gost-ipsec: IKEv2, reauthentication every 28800s, rekeying every 86400s, dpd delay 15s

local: 192.168.25.182

remote: 192.168.25.49

local pre-shared key authentication:

id: 192.168.25.182

remote pre-shared key authentication:

id: 192.168.25.49

gost-ipsec: TUNNEL, rekeying every 86400s, dpd action is restart

local: 192.168.58.0/24

remote: 192.168.59.0/24

swanctl —list-sas

gost-ipsec: #1, ESTABLISHED, IKEv2, e947e9f4292464b7_i 28fb87626307809a_r*

local '192.168.25.182' @ 192.168.25.182[500]

remote '192.168.25.49' @ 192.168.25.49[500]

AES_CBC-128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1536

established 159s ago, rekeying in 79793s, reauth in 28548s

gost-ipsec: #2, reqid 1, INSTALLED, TUNNEL, ESP:3DES_CBC/HMAC_MD5_96

installed 159s ago, rekeying in 77772s, expires in 94881s

in ca249833, 13356 bytes, 159 packets, 0s ago

out c50c4def, 13356 bytes, 159 packets, 0s ago

local 192.168.58.0/24

remote 192.168.59.0/24

В выводе могут/должны быть сведения о числе прошедших пакетов и сумме байт.

Status of IKE charon daemon (weakSwan 5.8.2, Linux 4.19.82, x86_64):

uptime: 4 minutes, since Feb 07 17:26:24 2020

worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled: 4

loaded plugins: charon random nonce constraints pubkey pkcs1 pkcs7 pkcs12 af-alg gmp attr kernel-netlink resolve socket-default farp stroke vici updown addrblock

Listening IP addresses:

192.168.25.182

192.168.58.1

Connections:

pass-mcast: %any…127.0.0.1 IKEv1/2

pass-mcast: local: uses any authentication

pass-mcast: remote: uses any authentication

pass-mcast: child: 0.0.0.0/0 === 224.0.0.0/4 PASS

gost-ipsec: 192.168.25.182…192.168.25.49 IKEv2, dpddelay=15s

gost-ipsec: local: [192.168.25.182] uses pre-shared key authentication

gost-ipsec: remote: [192.168.25.49] uses pre-shared key authentication

gost-ipsec: child: 192.168.58.0/24 === 192.168.59.0/24 TUNNEL, dpdaction=restart

Shunted Connections:

pass-mcast: 0.0.0.0/0 === 224.0.0.0/4 PASS

Routed Connections:

gost-ipsec{1}: ROUTED, TUNNEL, reqid 1

gost-ipsec{1}: 192.168.58.0/24 === 192.168.59.0/24

Security Associations (1 up, 0 connecting):

gost-ipsec[1]: ESTABLISHED 3 minutes ago, 192.168.25.182[192.168.25.182]…192.168.25.49[192.168.25.49]

gost-ipsec[1]: IKEv2 SPIs: e947e9f4292464b7_i 28fb87626307809a_r*, rekeying in 22 hours, pre-shared key reauthentication in 7 hours

gost-ipsec[1]: IKE proposal: AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1536

gost-ipsec{2}: INSTALLED, TUNNEL, reqid 1, ESP SPIs: ca249833_i c50c4def_o

gost-ipsec{2}: 3DES_CBC/HMAC_MD5_96, 20076 bytes_i (239 pkts, 1s ago), 20076 bytes_o (239 pkts, 1s ago), rekeying in 21 hours

gost-ipsec{2}: 192.168.58.0/24 === 192.168.59.0/24

ESTABLISHED в выводе означает, что фаза 1 закончилась успешно.

INSTALLED в выводе означает, что фаза 2 закончилась успешно. Присутствуют счетчики пакетов и байт.

Для вывода логов можно использовать команду /opt/stasoft/bin/ipsec-log.sh [x] или

ipsec stroke loglevel any 4

swanctl –log

06[NET] received packet: from 192.168.25.49[500] to 192.168.25.182[500] (418 bytes)

disconnecting…

06[ENC] parsed IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) V ]

06[IKE] received strongSwan vendor ID

06[IKE] 192.168.25.49 is initiating an IKE_SA

06[CFG] received proposals: IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1536

06[CFG] configured proposals: IKE:3DES_CBC/HMAC_MD5_96/PRF_HMAC_MD5/MODP_768

06[IKE] received proposals unacceptable

06[ENC] generating IKE_SA_INIT response 0 [ N(NO_PROP) ]

06[NET] sending packet: from 192.168.25.182[500] to 192.168.25.49[500] (36 bytes)

11[NET] received packet: from 192.168.25.49[500] to 192.168.25.182[500] (418 bytes)

11[ENC] parsed IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) V ]

11[IKE] received strongSwan vendor ID

11[IKE] 192.168.25.49 is initiating an IKE_SA

11[CFG] received proposals: IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1536

11[CFG] configured proposals: IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1536

11[CFG] selected proposal: IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1536

11[ENC] generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(CHDLESS_SUP) N(MULT_AUTH) V ]

11[NET] sending packet: from 192.168.25.182[500] to 192.168.25.49[500] (430 bytes)

06[NET] received packet: from 192.168.25.49[500] to 192.168.25.182[500] (268 bytes)

06[ENC] parsed IKE_AUTH request 1 [ IDi N(INIT_CONTACT) IDr AUTH SA TSi TSr N(MULT_AUTH) N(EAP_ONLY) N(MSG_ID_SYN_SUP) ]

06[CFG] looking for peer configs matching 192.168.25.182[192.168.25.182]…192.168.25.49[192.168.25.49]

06[CFG] selected peer config 'gost-ipsec'

06[IKE] tried 1 shared key for '192.168.25.182' - '192.168.25.49', but MAC mismatched

disconnecting…

06[ENC] generating IKE_AUTH response 1 [ N(AUTH_FAILED) ]

06[NET] sending packet: from 192.168.25.182[500] to 192.168.25.49[500] (76 bytes)

15[NET] received packet: from 192.168.25.49[500] to 192.168.25.182[500] (418 bytes)

15[ENC] parsed IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) V ]

15[IKE] received strongSwan vendor ID

15[IKE] 192.168.25.49 is initiating an IKE_SA

15[CFG] received proposals: IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1536

15[CFG] configured proposals: IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1536

15[CFG] selected proposal: IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1536

15[ENC] generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(CHDLESS_SUP) N(MULT_AUTH) V ]

15[NET] sending packet: from 192.168.25.182[500] to 192.168.25.49[500] (430 bytes)

07[NET] received packet: from 192.168.25.49[500] to 192.168.25.182[500] (268 bytes)

07[ENC] parsed IKE_AUTH request 1 [ IDi N(INIT_CONTACT) IDr AUTH SA TSi TSr N(MULT_AUTH) N(EAP_ONLY) N(MSG_ID_SYN_SUP) ]

07[CFG] looking for peer configs matching 192.168.25.182[192.168.25.182]…192.168.25.49[192.168.25.49]

07[CFG] selected peer config 'gost-ipsec'

07[IKE] authentication of '192.168.25.49' with pre-shared key successful

07[IKE] authentication of '192.168.25.182' (myself) with pre-shared key

07[IKE] destroying duplicate IKE_SA for peer '192.168.25.49', received INITIAL_CONTACT

07[IKE] IKE_SA gost-ipsec[2] established between 192.168.25.182[192.168.25.182]…192.168.25.49[192.168.25.49]

disconnecting…

07[IKE] scheduling rekeying in 80140s

07[IKE] scheduling reauthentication in 25528s

07[IKE] maximum IKE_SA lifetime 34168s

07[CFG] received proposals: ESP:3DES_CBC/HMAC_MD5_96/NO_EXT_SEQ

07[CFG] configured proposals: ESP:3DES_CBC/HMAC_SHA1_96/MODP_768/NO_EXT_SEQ

07[IKE] no acceptable proposal found

07[IKE] failed to establish CHILD_SA, keeping IKE_SA

07[ENC] generating IKE_AUTH response 1 [ IDr AUTH N(AUTH_LFT) N(NO_PROP) ]

07[NET] sending packet: from 192.168.25.182[500] to 192.168.25.49[500] (124 bytes)

08[IKE] sending DPD request

08[ENC] generating INFORMATIONAL request 0 [ ]

08[NET] sending packet: from 192.168.25.182[500] to 192.168.25.49[500] (76 bytes)

05[NET] received packet: from 192.168.25.49[500] to 192.168.25.182[500] (76 bytes)

05[ENC] parsed INFORMATIONAL response 0 [ ]

13[NET] received packet: from 192.168.25.49[500] to 192.168.25.182[500] (418 bytes)

13[ENC] parsed IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) V ]

13[IKE] received strongSwan vendor ID

13[IKE] 192.168.25.49 is initiating an IKE_SA

13[CFG] received proposals: IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1536

13[CFG] configured proposals: IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1536

13[CFG] selected proposal: IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1536

13[ENC] generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(CHDLESS_SUP) N(MULT_AUTH) V ]

13[NET] sending packet: from 192.168.25.182[500] to 192.168.25.49[500] (430 bytes)

07[NET] received packet: from 192.168.25.49[500] to 192.168.25.182[500] (268 bytes)

07[ENC] parsed IKE_AUTH request 1 [ IDi N(INIT_CONTACT) IDr AUTH SA TSi TSr N(MULT_AUTH) N(EAP_ONLY) N(MSG_ID_SYN_SUP) ]

07[CFG] looking for peer configs matching 192.168.25.182[192.168.25.182]…192.168.25.49[192.168.25.49]

07[CFG] selected peer config 'gost-ipsec'

07[IKE] authentication of '192.168.25.49' with pre-shared key successful

disconnecting…

07[IKE] authentication of '192.168.25.182' (myself) with pre-shared key

07[IKE] IKE_SA gost-ipsec[1] established between 192.168.25.182[192.168.25.182]…192.168.25.49[192.168.25.49]

07[IKE] scheduling rekeying in 85745s

07[IKE] scheduling reauthentication in 20238s

07[IKE] maximum IKE_SA lifetime 28878s

07[CFG] received proposals: ESP:3DES_CBC/HMAC_MD5_96/NO_EXT_SEQ

07[CFG] configured proposals: ESP:3DES_CBC/HMAC_MD5_96/MODP_768/NO_EXT_SEQ

07[CFG] selected proposal: ESP:3DES_CBC/HMAC_MD5_96/NO_EXT_SEQ

07[KNL] using encryption algorithm 3DES_CBC with key size 192

07[KNL] using encryption algorithm des3_ede

07[KNL] using encryption algorithm 3DES_CBC with key size 192

07[KNL] using encryption algorithm des3_ede

07[IKE] CHILD_SA gost-ipsec{2} established with SPIs cea50306_i c1be0866_o and TS 192.168.58.0/24 === 192.168.59.0/24

07[ENC] generating IKE_AUTH response 1 [ IDr AUTH SA TSi TSr N(AUTH_LFT) ]

07[NET] sending packet: from 192.168.25.182[500] to 192.168.25.49[500] (204 bytes)