网络工程 - ASA 和 Mikrotik 之间的 IKEv2 隧道 - 吾爱随笔录

尝试将办公路由器从 pfSense 迁移到 Mikrotik，唯一的绊脚石是在它与我们的 Cisco ASA 之间维护站点到站点 IPSEC 隧道。对我来说，这些设置看起来都正确，隧道两边都显示（见下面的注释），但网络之间没有流量通过。

我能找到的唯一可疑的事情是 Cisco 日志中的这条消息：

Apr  7 13:08:35 asa1.pofp.internal %ASA-4-750003: Local:9.8.7.6:500 Remote:2.3.4.5:500 Username:Unknown 
IKEv2 Negotiation aborted due to ERROR: Failed to receive the AUTH msg before the timer expired

这里不涉及 NAT，这些设备之间也没有防火墙。

我很犹豫要不要提及它，因为害怕把水弄脏，但是在我的测试过程中，这条隧道已经使用了两次，使用了相同的配置。成功似乎是在手动拆除两个设备上的隧道时随机发生的，可能与双方启动的时间有关？但是，在这两种情况下，隧道都在 P2 超时后停止传输流量。

Mikrotik 配置：

/ip ipsec profile
add dh-group=ecp521 dpd-interval=10s enc-algorithm=aes-256 hash-algorithm=sha512 name=asa-p1 nat-traversal=no
/ip ipsec peer
add address=9.8.7.6/32 exchange-mode=ike2 name=NOC port=500 profile=asa-p1 send-initial-contact=no
/ip ipsec proposal
set [ find default=yes ] disabled=yes
add auth-algorithms=sha512 enc-algorithms=aes-256-gcm lifetime=8h name=asa-p2 pfs-group=ecp521
/ip ipsec identity
add peer=NOC secret="*****"
/ip ipsec policy
set 0 disabled=yes
add dst-address=192.168.242.0/24 proposal=asa-p2 sa-dst-address=9.8.7.6 sa-src-address=0.0.0.0 src-address=192.168.243.0/24 tunnel=yes
/ip firewall nat
add chain=srcnat dst-address=192.168.242.0/24 src-address=192.168.243.0/24
add chain=srcnat dst-address=192.168.243.0/24 src-address=192.168.242.0/24
add action=masquerade chain=srcnat out-interface="WAN port"
/ip firewall filter
add action=accept chain=input comment="Allow established input traffic" connection-state=established,related
add action=accept chain=input comment=IPSEC dst-port=500 in-interface="WAN port" protocol=udp
add action=accept chain=input comment="IPSEC NAT-T" dst-port=4500 in-interface="WAN port" protocol=udp
add action=accept chain=input comment="IPSEC ESP" in-interface="WAN port" protocol=ipsec-esp
...

思科配置

object network NOC-network
 subnet 192.168.242.0 255.255.255.0
object network Calgary-network
 subnet 192.168.243.0 255.255.255.0

crypto ipsec ikev2 ipsec-proposal AESGCM
 protocol esp encryption aes-gcm-256
 protocol esp integrity sha-512
crypto ipsec ikev2 sa-strength-enforcement
crypto ipsec security-association pmtu-aging infinite

crypto ikev2 policy 2
 encryption aes-gcm-256
 integrity null
 group 21 24
 prf sha512
 lifetime seconds 86400
crypto ikev2 policy 3
 encryption aes-256
 integrity sha512
 group 21 24
 prf sha512
 lifetime seconds 86400
crypto ikev2 enable OUTSIDE

group-policy GroupPolicy_IKEv2 internal
group-policy GroupPolicy_IKEv2 attributes
 vpn-tunnel-protocol ikev2 
tunnel-group 2.3.4.5 type ipsec-l2l
tunnel-group 2.3.4.5 general-attributes
 default-group-policy GroupPolicy_IKEv2
tunnel-group 2.3.4.5 ipsec-attributes
 ikev2 remote-authentication pre-shared-key *****
 ikev2 local-authentication pre-shared-key *****

access-list OUTSIDE_cryptomap_1 extended permit ip object NOC-network object Calgary-network 
nat (INSIDE,OUTSIDE) source static NOC-network NOC-network destination static Calgary-network Calgary-network no-proxy-arp route-lookup
crypto map OUTSIDE_map 2 match address OUTSIDE_cryptomap_1
crypto map OUTSIDE_map 2 set pfs group21
crypto map OUTSIDE_map 2 set peer 2.3.4.5 
crypto map OUTSIDE_map 2 set ikev2 ipsec-proposal AESGCM
crypto map OUTSIDE_map 2 set security-association lifetime kilobytes unlimited
crypto map OUTSIDE_map 2 set nat-t-disable
crypto map OUTSIDE_map interface OUTSIDE

出于某种原因，ASA 显示了两个双向隧道：

虽然 Mikrotik 只能看到一个（与 ASA 不同，它将每个方向显示为一个单独的条目。）

> ip ipsec installed-sa print 
Flags: H - hw-aead, A - AH, E - ESP 
 0  E spi=0x6FFE0E4 src-address=9.8.7.6 dst-address=2.3.4.5 state=mature enc-algorithm=aes-gcm enc-key-size=288 
      enc-key="2a217b491be5a5297a8a78759e940bc4677b59834630282a2a24baaf3198c6539cc435b0" add-lifetime=6h24m8s/8h10s replay=128 

 1  E spi=0xF315FE3C src-address=2.3.4.5 dst-address=9.8.7.6 state=mature enc-algorithm=aes-gcm enc-key-size=288 
      enc-key="405b00868a64c35521ccfa6feac97316d19220bb4b7b3346964ad0dd0415a54d3ccda8ca" add-lifetime=6h24m8s/8h10s replay=128

数据包跟踪器输出：

CORP-ASA1# packet-tracer input INSIDE tcp 192.168.242.100 1234 192.168.243.100$

Phase: 1
Type: ACCESS-LIST
Subtype: 
Result: ALLOW
Config:
Implicit Rule
Additional Information:
MAC Access list

Phase: 2
Type: ROUTE-LOOKUP
Subtype: Resolve Egress Interface
Result: ALLOW
Config:
Additional Information:
found next-hop 9.8.7.6 using egress ifc  OUTSIDE

Phase: 3
Type: UN-NAT
Subtype: static
Result: ALLOW
Config:
nat (INSIDE,OUTSIDE) source static NOC-network NOC-network destination static Calgary-network Calgary-network no-proxy-arp route-lookup
Additional Information:
NAT divert to egress interface OUTSIDE
Untranslate 192.168.243.100/1234 to 192.168.243.100/1234

Phase: 4
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group INSIDE_access_in in interface INSIDE
access-list INSIDE_access_in extended permit ip object-group DM_INLINE_NETWORK_4 any 
object-group network DM_INLINE_NETWORK_4
 network-object aaa:bbb:ccc:242::/64
 network-object 192.168.242.0 255.255.255.0
Additional Information:

Phase: 5
Type: CONN-SETTINGS
Subtype: 
Result: ALLOW
Config:
class-map class-default
 match any
policy-map global_policy
 class class-default
  set connection decrement-ttl
service-policy global_policy global
Additional Information:

Phase: 6
Type: NAT
Subtype: 
Result: ALLOW
Config:
nat (INSIDE,OUTSIDE) source static NOC-network NOC-network destination static Calgary-network Calgary-network no-proxy-arp route-lookup
Additional Information:
Static translate 192.168.242.100/1234 to 192.168.242.100/1234

Phase: 7
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:

Phase: 8
Type: IP-OPTIONS
Subtype: 
Result: ALLOW
Config:       
Additional Information:

Phase: 9
Type: FOVER
Subtype: standby-update
Result: ALLOW
Config:
Additional Information:

Phase: 10
Type: FLOW-EXPORT
Subtype: 
Result: ALLOW
Config:
Additional Information:

Phase: 11
Type: VPN
Subtype: encrypt
Result: ALLOW
Config:
Additional Information:

Phase: 12     
Type: NAT
Subtype: rpf-check
Result: ALLOW
Config:
nat (INSIDE,OUTSIDE) source static NOC-network NOC-network destination static Calgary-network Calgary-network no-proxy-arp route-lookup
Additional Information:

Phase: 13
Type: VPN
Subtype: ipsec-tunnel-flow
Result: ALLOW
Config:
Additional Information:

Phase: 14
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:

Phase: 15
Type: IP-OPTIONS
Subtype:      
Result: ALLOW
Config:
Additional Information:

Phase: 16
Type: FLOW-CREATION
Subtype: 
Result: ALLOW
Config:
Additional Information:
New flow created with id 2426669873, packet dispatched to next module

Result:
input-interface: INSIDE
input-status: up
input-line-status: up
output-interface: OUTSIDE
output-status: up
output-line-status: up
Action: allow