No relevant resource is found in the selected language.

This site uses cookies. By continuing to browse the site you are agreeing to our use of cookies. Read our privacy policy>Search

Reminder

To have a better experience, please upgrade your IE browser.

upgrade

CLI-based Configuration Guide - VPN

AR100, AR120, AR150, AR160, AR200, AR1200, AR2200, AR3200, and AR3600 V200R010

This document describes VPN features on the device and provides configuration procedures and configuration examples.
Rate and give feedback:
Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document. Note: Even the most advanced machine translation cannot match the quality of professional translators. Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).
IKE SA Negotiation Failed

IKE SA Negotiation Failed

Symptom

The IPSec service cannot be normally transmitted. The output of the display ike sa command shows that IKE SA negotiation failed.

The following shows an example of the command output. If the Flag parameter is displayed as RD or RD|ST, an SA is established successfully. ST indicates that the local end is the IKE initiator.

    Conn-ID  Peer            VPN   Flag(s)                Phase                 
  ---------------------------------------------------------------               
    13118    10.1.3.2        0     RD                     v1:2  
    12390    10.1.3.2        0     RD                     v1:1

   Number of IKE SA : 2
  ---------------------------------------------------------------
         
  Flag Description:    
  RD--READY   ST--STAYALIVE   RL--REPLACED   FD--FADING   TO--TIMEOUT
  HRT--HEARTBEAT   LKG--LAST KNOWN GOOD SEQ NO.   BCK--BACKED UP
  M--ACTIVE   S--STANDBY   A--ALONE  NEG--NEGOTIATING

If IKE SA negotiation fails, the Flag parameter is empty, the Peer parameter is 0.0.0.0, or the command output contains no record.

Procedure

  1. Run the display ike proposal command to check whether the IKE peer uses the same IKE proposal.

    If not, change IKE proposals on the peer to be the same. If the authentication algorithms in the IKE proposals are different, perform the following operations.

    On the IKE initiator:

    ike proposal 10
     authentication-algorithm sha2-256
    

    On the IKE responder:

    ike proposal 10
     authentication-algorithm sha2-384
    

  2. Run the display ipsec proposal command to check whether the security protocol matches the configured security algorithms.

    For example, when you run the display ipsec proposal name tran1 command and find that the security protocol is ah-esp-new, that is, both AH and ESP are used, IKE negotiation will fail if the ESP authentication and encryption algorithms are not configured.

    <Huawei> display ipsec proposal name tran1
    IPSec proposal name: tran1
     Encapsulation mode: Tunnel
     Transform         : ah-esp-new
     ESP protocol      : Authentication NULL
                         Encryption NULL
    
    • If you only need to use the AH protocol, run the transform command to change the configuration.

      ipsec proposal tran1
       transform ah
       ah authentication-algorithm sha2-256
      
    • If you need to use both the AH and ESP protocols, run the esp authentication-algorithm and esp encryption-algorithm commands to configure the ESP authentication and encryption algorithms.

      ipsec proposal tran1
       transform ah-esp
       ah authentication-algorithm sha2-256
       esp authentication-algorithm sha2-256
       esp encryption-algorithm aes-256
      

  3. Run the display ike peer command to check whether the configuration in the peer view is correct.

    • Check whether the remote IP address is configured.

      When the ACL mode is used for IPSec tunnel establishment, the remote IP address must be specified for the device in IKE main negotiation mode. In addition, the remote IP addresses specified for the IKE peer must match each other.

      If the IP addresses of the IKE initiator and responder are 10.1.1.2 and 10.2.1.2, the configuration is as follows.

      On the IKE initiator:

      ike peer mypeer1
       remote-address 10.2.1.2
      

      On the IKE responder:

      ike peer mypeer2
       remote-address 10.1.1.2
      

      If the IKE responder uses the policy template mode, you do not need to configure the remote IP address for the responder.

    • Check whether the pre-shared keys of the IKE peer are the same.

      ike peer mypeer
       pre-shared-key cipher %^%#JvZxR2g8c;a9~FPN~n'$7`DEV&=G(=Et02P/%\*!%^%#   //The key is Huawei@123.
      

      If not, change the pre-shared keys to be the same.

    • Check whether the IKE proposals referenced by the IKE peer are the same.

      For example, the IKE initiator references IKE proposal 10.

      ike peer mypeer
       ike-proposal 10
      

      The related configuration of IKE proposal 10 is as follows.

      ike proposal 10
       encryption-algorithm aes-128
       authentication-algorithm sha2-256 
      

      If the configurations in the IKE proposals are different, change the configurations to be the same.

Translation
Download
Updated: 2019-08-07

Document ID: EDOC1100033725

Views: 153238

Downloads: 369

Average rating:
This Document Applies to these Products
Related Version
Related Documents
Share
Previous Next