网络工程 - Cisco dVTI - 虚拟访问接口没有 IP 地址 - 吾爱随笔录

我在 Cisco ASR1000 机器上遇到了一些 dVTI 问题。

这是我对中心站点的配置：

crypto keyring FOO-KEYRING  
  pre-shared-key hostname r2-foo key iawg8b32hah
!
crypto isakmp policy 104
 encr aes 256
 authentication pre-share
 group 5
 lifetime 7200
crypto isakmp keepalive 10
crypto isakmp profile FOO-IKEPROFILE
   keyring FOO-KEYRING
   match identity user-fqdn r2-foo
   virtual-template 104
!
!
crypto ipsec transform-set AES_256-SHA esp-aes 256 esp-sha-hmac 
 mode tunnel
!
crypto ipsec profile FOO-IPSECPROFILE
 set security-association lifetime seconds 7200
 set transform-set AES_256-SHA 
 set pfs group5
 responder-only

crypto ipsec transform-set AES_256-SHA esp-aes 256 esp-sha-hmac 
 mode tunnel
!
crypto ipsec profile FOO-IPSECPROFILE
 set security-association lifetime seconds 7200
 set transform-set AES_256-SHA 
 set pfs group5
 responder-only

interface Virtual-Template104 type tunnel
 ip address 10.241.1.13 255.255.255.252
 tunnel source Loopback0
 tunnel mode ipsec ipv4
 tunnel protection ipsec profile FOO-IPSECPROFILE

当 Spoke 站点的路由器正在建立连接时，虚拟模板将按预期克隆，但没有 IP 地址：

Virtual-Access3 is up, line protocol is up 
  Hardware is Virtual Access interface
  MTU 9922 bytes, BW 100 Kbit/sec, DLY 50000 usec, 
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation TUNNEL
  Tunnel vaccess, cloned from Virtual-Template104
  Vaccess status 0x4, loopback not set
  Keepalive not set
  Tunnel linestate evaluation up
  Tunnel source 212.X.Y.Z (Loopback0), destination 85.X.Y.Z
   Tunnel Subblocks:
      src-track:
         Virtual-Access3 source tracking subblock associated with Loopback0
          Set of tunnels with source Loopback0, 2 members (includes iterators), on interface <OK>
  Tunnel protocol/transport IPSEC/IP
  Tunnel TTL 255
  Tunnel transport MTU 1422 bytes
  Tunnel transmit bandwidth 8000 (kbps)
  Tunnel receive bandwidth 8000 (kbps)
  Tunnel protection via IPSec (profile "FOO-IPSECPROFILE")
  Last input never, output never, output hang never
  Last clearing of "show interface" counters 00:00:58
  Input queue: 0/375/0/0 (size/max/drops/flushes); Total output drops: 0
  Queueing strategy: fifo
  Output queue: 0/0 (size/max)
  5 minute input rate 0 bits/sec, 0 packets/sec
  5 minute output rate 0 bits/sec, 0 packets/sec
     0 packets input, 0 bytes, 0 no buffer
     Received 0 broadcasts (0 IP multicasts)
     0 runts, 0 giants, 0 throttles 
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
     0 packets output, 0 bytes, 0 underruns
     0 output errors, 0 collisions, 0 interface resets
     0 unknown protocol drops
     0 output buffer failures, 0 output buffers swapped out

#sh ip int Virtual-Access3
Virtual-Access3 is up, line protocol is up
  Internet protocol processing disabled

阶段 1 和 2 已正确建立，输出中没有可见的明显错误。我有 2 个类似配置的 dVTI 端点，它们工作正常。我将“deb cry isakmp”和“deb cry ipsec”的输出在成功的工作 dVTI 端点和不工作的端点之间进行了区分......一切看起来都一样。

我还将配置移动到具有相同效果的不同路由器。

知道如何在这里调试虚拟模板克隆过程吗？也欢迎任何其他建议！

编辑：添加了“show cry ipsec sa”示例

interface: Virtual-Access3
    Crypto map tag: Virtual-Access3-head-0, local addr 212.X.Y.Z

   protected vrf: (none)
   local  ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
   remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
   current_peer 85.X.Y.Z port 4500
     PERMIT, flags={origin_is_acl,}
    #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
    #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0
    #pkts not decompressed: 0, #pkts decompress failed: 0
    #send errors 0, #recv errors 0

     local crypto endpt.: 212.X.Y.Z, remote crypto endpt.: 85.X.Y.Z
     plaintext mtu 1422, path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/0/0
     current outbound spi: 0xF213DE06(4061388294)
     PFS (Y/N): Y, DH group: group5

     inbound esp sas:
      spi: 0x21480EF2(558370546)
        transform: esp-256-aes esp-sha-hmac ,
        in use settings ={Tunnel UDP-Encaps, }
        conn id: 2029, flow_id: HW:29, sibling_flags 80000048, crypto map: Virtual-Access3-head-0
        sa timing: remaining key lifetime (k/sec): (4608000/6130)
        IV size: 16 bytes
        replay detection support: Y
        Status: ACTIVE(ACTIVE)

     inbound ah sas:

     inbound pcp sas:

     outbound esp sas:
      spi: 0xF213DE06(4061388294)
        transform: esp-256-aes esp-sha-hmac ,
        in use settings ={Tunnel UDP-Encaps, }
        conn id: 2030, flow_id: HW:30, sibling_flags 80000048, crypto map: Virtual-Access3-head-0
        sa timing: remaining key lifetime (k/sec): (4608000/6130)
        IV size: 16 bytes
        replay detection support: Y
        Status: ACTIVE(ACTIVE)

     outbound ah sas:

     outbound pcp sas:

更多编辑：我发现配置克隆 VirtualAccess 的“ip unnumbered Loopback0”结果将分配一个 IP 地址。不幸的是，我只在这里处理静态路由并且需要一个静态的下一跳地址。我不能使用基于多播的路由协议。在几种情况下，我为虚拟模板分配了一个 /30 网络，没有任何问题。

我还检查了 Cisco Bugtracker，但没有成功。还有几个像“deb vaccess”这样的调试也没有为我提供任何线索。

编辑 3：在摆弄了一下之后，已经工作的 dVTI 配置和新创建的配置之间的唯一区别是工作的配置是在大约 14 个月前路由器重新启动之前配置的。所以虚拟模板接口配置是从 NVRAM 加载的，不是手动配置的。

所以我取消了一个工作的 dVTI 接口并重新配置它。结果是：删除 Virtual-Template 界面配置并将相同的配置行粘贴回框后会导致相同的问题。虚拟模板已克隆，但 IP 地址未克隆。

所以我认为我正在与某种软件错误作斗争。我会看看我是否可以在即将到来的维护窗口中重新加载这两个 ASR。

不幸的是，我们决定今年暂停我们的思科支持合同，因为明年旧的 1002F 盒子将被两个 1001X 取代。