gcloud vpn隧道日志抱怨"MAC不匹配“。怎么修？

Question

我正在尝试将部署在Gcloud上的应用程序连接到我的客户端本地局域网(根据客户的请求通过VPN )，这样我和我的客户端就可以在Gcloud上的服务器和他们的服务器之间传输文件。

但是，我们正在运行设置VPN隧道的问题。以下是规格说明：

1. 我已经建立了一个高可用性(HA) VPN，我正在使用动态路由.
2. 我的gcloud VPN网关的IP是78.211.79.182，对等网关(也就是客户端网关)的IP是41.233.612.86。(当然，这些不是真正的IP。只是为了方便阅读下面的日志。)
3. 我已经创建了IKEv2预共享密钥，并将密钥共享给我的客户端，因此他们正在使用它来配置他们的网关。

从我的Gcloud网关的日志中，我可以看到发生了一个错误：

D 2020-07-26T13:46:23.854055402Z remote host is behind NAT 
D 2020-07-26T13:46:23.854099553Z authentication of '78.211.79.182' (myself) with pre-shared key 
I 2020-07-26T13:46:23.854167373Z establishing CHILD_SA vpn_41.233.612.86{1} 
D 2020-07-26T13:46:23.854285679Z generating IKE_AUTH request 1 [ IDi AUTH SA TSi TSr N(EAP_ONLY) ] 
D 2020-07-26T13:46:23.854821679Z sending packet: from 78.211.79.182[4500] to 41.233.612.86[4500] (320 bytes) 
D 2020-07-26T13:46:23.865825884Z received packet: from 41.233.612.86[4500] to 78.211.79.182[4500] (240 bytes) 
D 2020-07-26T13:46:23.866158710Z parsed IKE_AUTH response 1 [ IDr AUTH N(ESP_TFC_PAD_N) N(NON_FIRST_FRAG) SA TSi TSr ] 
D 2020-07-26T13:46:23.866219472Z tried 1 shared key for '78.211.79.182' - '41.233.612.86', but MAC mismatched 
D 2020-07-26T13:46:23.866341774Z generating INFORMATIONAL request 2 [ N(AUTH_FAILED) ] 
D 2020-07-26T13:46:23.866434696Z sending packet: from 78.211.79.182[4500] to 41.233.612.86[4500] (80 bytes) 
D 2020-07-26T13:46:26.830704780Z creating acquire job for policy with reqid {1} 
I 2020-07-26T13:46:26.830879885Z initiating IKE_SA vpn_41.233.612.86[38] to 41.233.612.86 
D 2020-07-26T13:46:26.835746125Z generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) ] 
D 2020-07-26T13:46:26.836731673Z sending packet: from 78.211.79.182[500] to 41.233.612.86[500] (892 bytes) 
D 2020-07-26T13:46:26.847907232Z received packet: from 41.233.612.86[500] to 78.211.79.182[500] (464 bytes) 
D 2020-07-26T13:46:26.848248731Z parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ] 
D 2020-07-26T13:46:26.853647299Z local host is behind NAT, sending keep alives 
D 2020-07-26T13:46:26.853693084Z remote host is behind NAT 
D 2020-07-26T13:46:26.853740121Z authentication of '78.211.79.182' (myself) with pre-shared key 
I 2020-07-26T13:46:26.853804324Z establishing CHILD_SA vpn_41.233.612.86{1} 
D 2020-07-26T13:46:26.853950401Z generating IKE_AUTH request 1 [ IDi AUTH SA TSi TSr N(EAP_ONLY) ] 
D 2020-07-26T13:46:26.854595024Z sending packet: from 78.211.79.182[4500] to 41.233.612.86[4500] (320 bytes) 
D 2020-07-26T13:46:26.865979158Z received packet: from 41.233.612.86[4500] to 78.211.79.182[4500] (240 bytes) 
D 2020-07-26T13:46:26.866316701Z parsed IKE_AUTH response 1 [ IDr AUTH N(ESP_TFC_PAD_N) N(NON_FIRST_FRAG) SA TSi TSr ] 
D 2020-07-26T13:46:26.866381716Z tried 1 shared key for '78.211.79.182' - '41.233.612.86', but MAC mismatched 
D 2020-07-26T13:46:26.866505332Z generating INFORMATIONAL request 2 [ N(AUTH_FAILED) ] 
D 2020-07-26T13:46:26.866615565Z sending packet: from 78.211.79.182[4500] to 41.233.612.86[4500] (80 bytes) 
D 2020-07-26T13:46:29.830755043Z creating acquire job for policy with reqid {1} 
I 2020-07-26T13:46:29.830930845Z initiating IKE_SA vpn_41.233.612.86[39] to 41.233.612.86 
D 2020-07-26T13:46:29.835922517Z generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) ] 
D 2020-07-26T13:46:29.836919895Z sending packet: from 78.211.79.182[500] to 41.233.612.86[500] (892 bytes) 
D 2020-07-26T13:46:29.848359165Z received packet: from 41.233.612.86[500] to 78.211.79.182[500] (464 bytes) 
D 2020-07-26T13:46:29.848683121Z parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ] 
D 2020-07-26T13:46:29.853828481Z local host is behind NAT, sending keep alives 
D 2020-07-26T13:46:29.853841851Z remote host is behind NAT 

vpn隧道设置失败。我有两个问题：

1. 日志上写着：

D 2020-07-26T13:46:26.853647299Z local host is behind NAT, sending keep alives
D 2020-07-26T13:46:26.853693084Z remote host is behind NAT 

这有问题吗？或者这是我不需要担心的正常行为？

1. 日志上写着：

    D 2020-07-26T13:46:23.866219472Z tried 1 shared key for '78.211.79.182' - '41.233.612.86', but MAC mismatched

这是什么意思？如何配置以解决此问题？这是我应该在我的gcloud vpn配置上更改的东西，还是我应该建议我的客户端对它们的设置进行修改的东西呢？

Answer 1

云VPN只支持通过UDP封装纳特穿越( NAT )的一对一NAT。不支持一对多的NAT和基于端口的地址转换。换句话说，云VPN无法连接到共享单个外部IP address.Details的多个对等VPN网关，因此可以找到UDP封装。

当使用一对一NAT时，您的本地VPN网关必须使用NAT设备的相同外部IP地址来标识自己:标识类型必须是ID_IPV4_ADDR (RFC 7815)。并非所有Cisco设备都支持将设备标识设置为与设备使用的IP地址不同的IP地址(其内部地址)。例如，Cisco ASA设备不支持为它们的身份分配不同(外部) IP地址。因此，Cisco ASA设备不能配置为对云VPN使用一对一的NAT .对于Juniper设备，您可以使用security网关名字本地标识内公共的_IP地址设置设备的标识，其中名字是您的VPN网关名，公共的_IP地址是您的外部IP地址。有关更多细节，请参阅这篇Juniper TechLibrary文章。

此外，我在您共享的日志中注意到

D 2020-07-26T13:46:23.854285679Z generating IKE_AUTH request 1 [ IDi AUTH SA TSi TSr N(EAP_ONLY) ]
D 2020-07-26T13:46:23.866158710Z parsed IKE_AUTH response 1 [ IDr AUTH N(ESP_TFC_PAD_N) N(NON_FIRST_FRAG) SA TSi TSr ]

根据上面讨论的信息，这个问题的解决方案是配置or网关以使用其公共IP地址来标识自己，而不是使用内部地址或任何其他地址。因为GCP端将只期待来自在GCP配置中配置的对等IP的答复。