我正在尝试在使用 StrongSWAN 5.2.1 的 pfSense 和 ASA 5512（9.1 版软件）之间构建一个 IKEv2/IPSec VPN。
当 pfSense 开始连接时，一切正常。当 ASA 开始连接时，SA 出现，但 CHILD_SA 失败，因为ASA 声称它找不到匹配的策略。这种情况每天晚上都会发生，在 CHILD_SA 到期后，所以我必须每天早上从 pfSense 手动重新启动隧道。
Cisco 的配置如下所示：
object network Victoria-network
subnet 192.168.244.0 255.255.255.0
description Victoria office subnet
object network NOC-network
subnet 192.168.242.0 255.255.255.0
description NOC management subnet
nat (INSIDE,OUTSIDE) source static NOC-network NOC-network destination static Victoria-network Victoria-network no-proxy-arp route-lookup
access-list OUTSIDE_cryptomap extended permit ip 192.168.242.0 255.255.255.0 object Victoria-network
crypto ipsec ikev2 ipsec-proposal AES256-SHA256
protocol esp encryption aes-256
protocol esp integrity sha-512
crypto map OUTSIDE_map 1 match address OUTSIDE_cryptomap
crypto map OUTSIDE_map 1 set pfs group14
crypto map OUTSIDE_map 1 set peer 1.2.3.4
crypto map OUTSIDE_map 1 set ikev2 ipsec-proposal AES256-SHA256
crypto map OUTSIDE_map interface OUTSIDE
crypto ca trustpool policy
crypto ikev2 policy 2
encryption aes-256
integrity sha512
group 14
prf sha512
lifetime seconds 3600
crypto ikev2 enable OUTSIDE
group-policy GroupPolicy_1.2.3.4 internal
group-policy GroupPolicy_1.2.3.4 attributes
vpn-tunnel-protocol ikev2
tunnel-group 1.2.3.4 type ipsec-l2l
tunnel-group 1.2.3.4 general-attributes
default-group-policy GroupPolicy_1.2.3.4
tunnel-group 1.2.3.4 ipsec-attributes
ikev2 remote-authentication pre-shared-key *****
ikev2 local-authentication pre-shared-key *****
strongSwan 配置如下所示：
conn con1
fragmentation = yes
keyexchange = ikev2
reauth = yes
forceencaps = no
rekey = yes
reqid = 1
installpolicy = yes
type = tunnel
dpdaction = restart
dpddelay = 10s
dpdtimeout = 60s
auto = route
left = 1.2.3.4
right = 9.8.7.6
leftid = 1.2.3.4
ikelifetime = 28800s
lifetime = 3600s
rightsubnet = 192.168.242.0/24
leftsubnet = 192.168.244.0/24
ike = aes256-sha512-modp2048!
esp = aes256-sha512-modp2048,aes256gcm128-sha512-modp2048!
leftauth = psk
rightauth = psk
rightid = 9.8.7.6
完全披露：我可能完全没有资格完成这项任务。也就是说，到目前为止，我已经成功获得了一台 Juniper NS5-GT、Fortigate FG-60B 和一个通过隧道连接到这个 ASA 的 pfSense 2.1 盒子，所以我必须做一些正确的事情！任何帮助将不胜感激。