Cisco ASA — проблема IKEv2 SVTI

[mikiNet]

Здравствуйте! У меня возникла проблема с установкой второго туннеля IPSec с использованием STVI с Ikev2 на ASA. Опишу свою ситуацию: ![lab.jpg] У меня есть ASA с двумя внешними интерфейсами, как показано на рисунке. Я пытаюсь установить два VPN-туннеля с маршрутизатором vIOS2, используя IKEv2 и SVTI (route base vpn). Маршрутизатор имеет только один IP-адрес 50.50.50.1. Один туннель работает через Gi0/1 на ASA. Но второй (через Gi0/0 на ASA) не может быть установлен, даже если я использую те же команды. На маршрутизаторе посередине я настроил только интерфейсы для обеспечения связи между ASA и vIOS2. Вот моя конфигурация: ASA ciscoasa# sh run
:
ASA Version 9.8(4)41
!
hostname ciscoasa
enable password $sha512$5000$FBjCoJZvSqJDyvXz9T5vug==$ak/p3gNIoXuwENUAXdRVGw== pbkdf2
names
no mac-address auto !
interface GigabitEthernet0/0 nameif ISP2 security-level 100 ip address 200.200.200.1 255.255.255.0
!
interface GigabitEthernet0/1 nameif ISP1 security-level 100 ip address 100.100.100.1 255.255.255.0
!
interface Tunnel10 nameif TU-10 ip address 10.14.252.2 255.255.255.0 tunnel source interface ISP1 tunnel destination 50.50.50.1 tunnel mode ipsec ipv4 tunnel protection ipsec profile IPSEC_PROFILE
!
interface Tunnel20 nameif TU-20 ip address 10.14.253.2 255.255.255.0 tunnel source interface ISP2 tunnel destination 50.50.50.1 tunnel mode ipsec ipv4 tunnel protection ipsec profile IPSEC_PROFILE
!
ftp mode passive
same-security-traffic permit intra-interface
pager lines 23
mtu ISP1 1500
mtu ISP2 1500
no failover
no failover wait-disable
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
arp rate-limit 8192
router bgp 65000 bgp log-neighbor-changes address-family ipv4 unicast neighbor 10.14.252.1 remote-as 65300 neighbor 10.14.252.1 activate no auto-summary no synchronization exit-address-family
!
route ISP1 0.0.0.0 0.0.0.0 100.100.100.2 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
timeout conn-holddown 0:00:15
timeout igp stale-route 0:01:10
user-identity default-domain LOCAL
aaa authentication login-history
no snmp-server location
no snmp-server contact crypto ipsec ikev2 ipsec-proposal TSET protocol esp encryption aes-256 aes-192 protocol esp integrity sha-512 sha-384 sha-256
crypto ipsec profile IPSEC_PROFILE set ikev2 ipsec-proposal TSET crypto ipsec security-association pmtu-aging infinite crypto ikev2 policy 5 encryption aes-256 integrity sha512 sha384 group 19 14 prf sha512 sha384 lifetime seconds 86400
crypto ikev2 enable ISP1
crypto ikev2 enable ISP2
telnet timeout 5
ssh stricthostkeycheck
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
group-policy VPN-GP internal
group-policy VPN-GP attributes vpn-tunnel-protocol ikev2
dynamic-access-policy-record DfltAccessPolicy
tunnel-group 50.50.50.1 type ipsec-l2l
tunnel-group 50.50.50.1 general-attributes default-group-policy VPN-GP
tunnel-group 50.50.50.1 ipsec-attributes ikev2 remote-authentication pre-shared-key ***** ikev2 local-authentication pre-shared-key *****
!
class-map inspection_default match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map parameters message-length maximum client auto message-length maximum 512 no tcp-inspection
policy-map global_policy class inspection_default inspect ip-options inspect netbios inspect rtsp inspect sunrpc inspect tftp inspect xdmcp inspect dns preset_dns_map inspect ftp inspect h323 h225 inspect h323 ras inspect rsh inspect esmtp inspect sqlnet inspect sip inspect skinny
policy-map type inspect dns migrated_dns_map_2 parameters message-length maximum client auto message-length maximum 512 no tcp-inspection
policy-map type inspect dns migrated_dns_map_1 parameters message-length maximum client auto message-length maximum 512 no tcp-inspection
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous ciscoasa# vIOS2: Router#sh run
Building configuration... Current configuration : 4639 bytes
!
! Last configuration change at 20:08:36 UTC Fri Aug 22 2025
!
version 15.7
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router
!
boot-start-marker
boot-end-marker
!
!
!
no aaa new-model
!
!
ip cef
no ipv6 cef
!
!
crypto ikev2 proposal PROP-1 encryption aes-cbc-256 integrity sha512 sha384 group 19 14
!
crypto ikev2 policy IKEV2_POLICY proposal PROP-1
!
crypto ikev2 keyring KEYRING peer ALL address 0.0.0.0 0.0.0.0 pre-shared-key local Cisco1234 pre-shared-key remote Cisco1234 !
!
!
crypto ikev2 profile ASA_VTI_PROFILE match identity remote address 100.100.100.1 255.255.255.255 identity local address 50.50.50.1 authentication remote pre-share authentication local pre-share keyring local KEYRING dpd 10 2 on-demand
!
crypto ikev2 profile ASA_VTI_PROFILE-2 match identity remote address 200.200.200.1 255.255.255.255 identity local address 50.50.50.1 authentication remote pre-share authentication local pre-share keyring local KEYRING dpd 10 2 on-demand
!
!
!
crypto ipsec transform-set TSET esp-aes 256 esp-sha512-hmac mode tunnel
!
crypto ipsec profile IPSEC_PROFILE set transform-set TSET set ikev2-profile ASA_VTI_PROFILE
!
crypto ipsec profile IPSEC_PROFILE-2 set transform-set TSET set ikev2-profile ASA_VTI_PROFILE-2
!
!
!
interface Tunnel10 ip address 10.14.252.1 255.255.255.0 tunnel source GigabitEthernet0/2 tunnel mode ipsec ipv4 tunnel destination 100.100.100.1 tunnel protection ipsec profile IPSEC_PROFILE
!
interface Tunnel20 ip address 10.14.253.1 255.255.255.0 tunnel source GigabitEthernet0/2 tunnel mode ipsec ipv4 tunnel destination 200.200.200.1 tunnel protection ipsec profile IPSEC_PROFILE-2
!
!
interface GigabitEthernet0/2 ip address 50.50.50.1 255.255.255.0 duplex auto speed auto media-type rj45
!
!
router bgp 65300 bgp log-neighbor-changes neighbor 10.14.252.2 remote-as 65000 ! address-family ipv4 neighbor 10.14.252.2 activate exit-address-family
!
ip forward-protocol nd
!
!
no ip http server
no ip http secure-server
ip route 100.100.100.0 255.255.255.0 50.50.50.2
ip route 200.200.200.0 255.255.255.0 50.50.50.2
! end Router# Вывод ASA: show crypto ikev2 sa: ciscoasa# show crypto ikev2 sa IKEv2 SAs: Session-id:1, Status:UP-ACTIVE, IKE count:1, CHILD count:1 Tunnel-id Local Remote Status Role 11111205 100.100.100.1/500 50.50.50.1/500 READY INITIATOR Encr: AES-CBC, keysize: 256, Hash: SHA512, DH Grp:19, Auth sign: PSK, Auth verify: PSK Life/Active Time: 86400/4925 sec
Child sa: local selector 0.0.0.0/0 - 255.255.255.255/65535 remote selector 0.0.0.0/0 - 255.255.255.255/65535 ESP spi in/out: 0x979c0704/0x2ed10494 Отладка Cisco ASA: ciscoasa# debug crypto ikev2 platform
ciscoasa# IKEv2-PROTO-1: decrypt queuedIKEv2-PROTO-1: Asynchronous request queued
IKEv2-PROTO-1:
IKEv2-PROTO-1: decrypt queuedIKEv2-PROTO-1: Asynchronous request queued
IKEv2-PROTO-1:
IKEv2-PROTO-1: (81): Failed to receive the AUTH msg before the timer expired
IKEv2-PROTO-1: (81):
IKEv2-PROTO-1: (81): Auth exchange failed
IKEv2-PROTO-1: (81): Auth exchange failed
IKEv2-PLAT-1: NO IKEv2 ID
IKEv2-PROTO-1: decrypt queuedIKEv2-PROTO-1: Asynchronous request queued
IKEv2-PROTO-1:
Failed to receive the AUTH msg before the timer expiredIKEv2-PROTO-1: decrypt queuedIKEv2-PROTO-1: Asynchronous request queued
IKEv2-PROTO-1:
IKEv2-PROTO-1: decrypt queuedIKEv2-PROTO-1: Asynchronous request queued
IKEv2-PROTO-1:
IKEv2-PROTO-1: decrypt queuedIKEv2-PROTO-1: Asynchronous request queued
IKEv2-PROTO-1:
IKEv2-PROTO-1: (80): Maximum number of retransmissions reached
IKEv2-PROTO-1: (80):
IKEv2-PROTO-1: (80): Initial exchange failed
IKEv2-PROTO-1: (80): Initial exchange failed
IKEv2-PROTO-1: decrypt queuedIKEv2-PROTO-1: Asynchronous request queued
IKEv2-PROTO-1:
IKEv2-PROTO-1: (82): Failed to receive the AUTH msg before the timer expired
IKEv2-PROTO-1: (82):
IKEv2-PROTO-1: (82): Auth exchange failed
IKEv2-PROTO-1: (82): Auth exchange failed
IKEv2-PLAT-1: NO IKEv2 ID
IKEv2-PROTO-1: decrypt queuedIKEv2-PROTO-1: Asynchronous request queued
IKEv2-PROTO-1:
IKEv2-PROTO-1: decrypt queuedIKEv2-PROTO-1: Asynchronous request queued
IKEv2-PROTO-1:
IKEv2-PROTO-1: Packet is a retransmission
IKEv2-PROTO-1:
IKEv2-PROTO-1: decrypt queuedIKEv2-PROTO-1: Asynchronous request queued
IKEv2-PROTO-1:
IKEv2-PROTO-1: Packet is a retransmission
IKEv2-PROTO-1:
IKEv2-PROTO-1: Packet is a retransmission
IKEv2-PROTO-1:
IKEv2-PROTO-1: decrypt queuedIKEv2-PROTO-1: Asynchronous request queued
IKEv2-PROTO-1:
IKEv2-PROTO-1: decrypt queuedIKEv2-PROTO-1: Asynchronous request queued
IKEv2-PROTO-1:
IKEv2-PROTO-1: Packet is a retransmission
IKEv2-PROTO-1:
IKEv2-PROTO-1: (84): Failed to receive the AUTH msg before the timer expired
IKEv2-PROTO-1: (84):
IKEv2-PROTO-1: (84): Auth exchange failed
IKEv2-PROTO-1: (84): Auth exchange failed
IKEv2-PLAT-1: NO IKEv2 ID
IKEv2-PROTO-1: decrypt queuedIKEv2-PROTO-1: Asynchronous request queued
IKEv2-PROTO-1:
IKEv2-PROTO-1: decrypt queuedIKEv2-PROTO-1: Asynchronous request queued
IKEv2-PROTO-1:
IKEv2-PROTO-1: decrypt queuedIKEv2-PROTO-1: Asynchronous request queued
IKEv2-PROTO-1:
IKEv2-PROTO-1: decrypt queuedIKEv2-PROTO-1: Asynchronous request queued
IKEv2-PROTO-1:
IKEv2-PROTO-1: decrypt queuedIKEv2-PROTO-1: Asynchronous request queued
IKEv2-PROTO-1:
IKEv2-PROTO-1: (85): Failed to receive the AUTH msg before the timer expired
IKEv2-PROTO-1: (85):
IKEv2-PROTO-1: (85): Auth exchange failed
IKEv2-PROTO-1: (85): Auth exchange failed
IKEv2-PLAT-1: NO IKEv2 ID
IKEv2-PROTO-1: decrypt queuedIKEv2-PROTO-1: Asynchronous request queued
IKEv2-PROTO-1:
IKEv2-PROTO-1: decrypt queuedIKEv2-PROTO-1: Asynchronous request queued
IKEv2-PROTO-1:
IKEv2-PROTO-1: decrypt queuedIKEv2-PROTO-1: Asynchronous request queued
IKEv2-PROTO-1:
IKEv2-PROTO-1: (83): Maximum number of retransmissions reached
IKEv2-PROTO-1: (83):
IKEv2-PROTO-1: (83): Initial exchange failed
IKEv2-PROTO-1: (83): Initial exchange failed
IKEv2-PROTO-1: decrypt queuedIKEv2-PROTO-1: Asynchronous request queued
IKEv2-PROTO-1:
IKEv2-PROTO-1: decrypt queuedIKEv2-PROTO-1: Asynchronous request queued
IKEv2-PROTO-1:
IKEv2-PROTO-1: (86): Failed to receive the AUTH msg before the timer expired
IKEv2-PROTO-1: (86):
IKEv2-PROTO-1: (86): Auth exchange failed
IKEv2-PROTO-1: (86): Auth exchange failed
IKEv2-PLAT-1: NO IKEv2 ID
IKEv2-PROTO-1: decrypt queuedIKEv2-PROTO-1: Asynchronous request queued
IKEv2-PROTO-1:
IKEv2-PROTO-1: decrypt queuedIKEv2-PROTO-1: Asynchronous request queued
IKEv2-PROTO-1:
IKEv2-PROTO-1: decrypt queuedIKEv2-PROTO-1: Asynchronous request queued
IKEv2-PROTO-1:
IKEv2-PROTO-1: decrypt queuedIKEv2-PROTO-1: Asynchronous request queued
IKEv2-PROTO-1:
IKEv2-PROTO-1: Packet is a retransmission
IKEv2-PROTO-1:
IKEv2-PROTO-1: Packet is a retransmission
IKEv2-PROTO-1:
IKEv2-PROTO-1: decrypt queuedIKEv2-PROTO-1: Asynchronous request queued
IKEv2-PROTO-1:
IKEv2-PROTO-1: Packet is a retransmission
IKEv2-PROTO-1:
IKEv2-PROTO-1: decrypt queuedIKEv2-PROTO-1: Asynchronous request queued
IKEv2-PROTO-1:
IKEv2-PROTO-1: Packet is a retransmission
IKEv2-PROTO-1:
IKEv2-PROTO-1: (88): Failed to receive the AUTH msg before the timer expired
IKEv2-PROTO-1: (88):
IKEv2-PROTO-1: (88): Auth exchange failed
IKEv2-PROTO-1: (88): Auth exchange failed
IKEv2-PLAT-1: NO IKEv2 ID
IKEv2-PROTO-1: decrypt queuedIKEv2-PROTO-1: Asynchronous request queued
IKEv2-PROTO-1:
IKEv2-PROTO-1: decrypt queuedIKEv2-PROTO-1: Asynchronous request queued
IKEv2-PROTO-1:
IKEv2-PROTO-1: decrypt queuedIKEv2-PROTO-1: Asynchronous request queued
IKEv2-PROTO-1: На ASA я вижу пакет, поступающий от маршрутизатора: ciscoasa# show capture cap1 174 packets captured 6: 20:10:05.739723 50.50.50.1.500 > 200.200.200.1.500: udp 350 7: 20:11:06.382411 50.50.50.1.500 > 200.200.200.1.500: udp 350 8: 20:11:08.372768 50.50.50.1.500 > 200.200.200.1.500: udp 350 9: 20:11:12.049054 50.50.50.1.500 > 200.200.200.1.500: udp 350 10: 20:11:19.902602 50.50.50.1.500 > 200.200.200.1.500: udp 350 11: 20:11:34.855165 50.50.50.1.500 > 200.200.200.1.500: udp 350 12: 20:12:05.874619 50.50.50.1.500 > 200.200.200.1.500: udp 350 13: 20:13:03.844560 50.50.50.1.500 > 200.200.200.1.500: udp 350 14: 20:14:07.601424 50.50.50.1.500 > 200.200.200.1.500: udp 350 15: 20:14:09.416100 50.50.50.1.500 > 200.200.200.1.500: udp 350 16: 20:14:13.375362 50.50.50.1.500 > 200.200.200.1.500: udp 350 17: 20:14:20.878998 50.50.50.1.500 > 200.200.200.1.500: udp 350 18: 20:14:36.066463 50.50.50.1.500 > 200.200.200.1.500: udp 350 19: 20:15:06.633298 50.50.50.1.500 > 200.200.200.1.500: udp 350 20: 20:16:04.577377 50.50.50.1.500 > 200.200.200.1.500: udp 350 21: 20:17:08.808857 50.50.50.1.500 > 200.200.200.1.500: udp 350 Таблица маршрутизации ASA: ciscoasa# show route Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2, V - VPN i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2 ia - IS-IS inter area, * - candidate default, U - per-user static route o - ODR, P - periodic downloaded static route, + - replicated route
Gateway of last resort is 100.100.100.2 to network 0.0.0.0 S* 0.0.0.0 0.0.0.0 [1/0] via 100.100.100.2, ISP1
C 10.14.252.0 255.255.255.0 is directly connected, TU-10
L 10.14.252.2 255.255.255.255 is directly connected, TU-10
C 100.100.100.0 255.255.255.0 is directly connected, ISP1
L 100.100.100.1 255.255.255.255 is directly connected, ISP1
C 200.200.200.0 255.255.255.0 is directly connected, ISP2
L 200.200.200.1 255.255.255.255 is directly connected, ISP2 Есть идеи, что произошло?

[MHM Cisco World]

Обходной путь Используйте два маршрута по умолчанию, по одному через каждого интернет-провайдера, и отслеживайте как прохождение, так и потерю трафика. MHM

[MHM Cisco World]

Я не думаю, что это сработает, потому что Asa всегда использует ISP1 для достижения 50.50.50.1 MHM

[mikiNet]

Я тоже так думал, но предпочел спросить, может быть, кто-нибудь знает обходной путь... Я подумал, что, возможно, есть какая-то настройка, такая как IKE Peer Identification или что-то еще, которая четко отличает эти два туннеля друг от друга... хотя я думаю, что в данном случае речь идет в основном о проблеме маршрутизации.

[MHM Cisco World]

Проверьте, удалив маршрут по умолчанию к isp1, и используйте новый маршрут к isp2. Вы увидите, что туннель 2 работает, а туннель 1 не работает. Примечание: при выполнении вышеуказанных действий необходимо очистить криптографическую безопасность в маршрутизаторе MHM

[mikiNet]

Что вы имеете в виду под «
и падением трафика»? Я добавил второй статический маршрут по умолчанию, и сейчас оба туннеля работают.

[MHM Cisco World]

Ну, та же причина, по которой туннель 2 может вызвать падение трафика, а именно маршрутизация. Но сейчас мы решаем первую проблему, когда оба туннеля работают. Теперь нам нужно сделать так, чтобы трафик выходил и входил через один и тот же туннель, т. е. решить проблему асимметричной маршрутизации. Я предпочитаю использовать bgp и разделить сеть, подключенную к asa внутри Пусть первая часть проходит через vti1, а вторая — через vti2. MHM

[mikiNet]

Я буду использовать BGP. Но основная проблема решена! Спасибо!

[mikiNet]

ciscoasa# show crypto ikev2 sa IKEv2 SAs: Session-id:3, Status:UP-ACTIVE, IKE count:1, CHILD count:1 Tunnel-id Local Remote Status Role
349156077 200.200.200.1/500 50.50.50.1/500 READY INITIATOR Encr: AES-CBC, keysize: 256, Hash: SHA512, DH Grp:19, Auth sign: PSK, Auth verify: PSK Life/Active Time: 86400/12 sec
Child sa: local selector 0.0.0.0/0 - 255.255.255.255/65535 remote selector 0.0.0.0/0 - 255.255.255.255/65535 ESP spi in/out: 0x39ddab5b/0x8caaeaef Второй туннель работает, основной не работает
![]
Так что проблема определенно в маршрутизации... но может быть, можно заставить обратный трафик проходить через интерфейс, откуда он приходит?