ASA作为响应程序，而不是发起者。

Question

我正在尝试在使用pfSense 5.2.1和ASA 5512 (版本9.1软件)之间建立一个IKEv2 2/IPSec。

当pfSense启动连接时，一切正常。当ASA启动连接时，SA出现，但是CHILD_SA由于ASA声称它找不到匹配的策略而失败。这种情况每天晚上都会发生，在CHILD_SA过期之后，所以我必须每天早上从pfSense手动重新启动隧道。

Cisco的配置如下所示：

object network Victoria-network
 subnet 192.168.244.0 255.255.255.0
 description Victoria office subnet
object network NOC-network
 subnet 192.168.242.0 255.255.255.0
 description NOC management subnet

nat (INSIDE,OUTSIDE) source static NOC-network NOC-network destination static Victoria-network Victoria-network no-proxy-arp route-lookup

access-list OUTSIDE_cryptomap extended permit ip 192.168.242.0 255.255.255.0 object Victoria-network 

crypto ipsec ikev2 ipsec-proposal AES256-SHA256
 protocol esp encryption aes-256
 protocol esp integrity sha-512

crypto map OUTSIDE_map 1 match address OUTSIDE_cryptomap
crypto map OUTSIDE_map 1 set pfs group14
crypto map OUTSIDE_map 1 set peer 1.2.3.4 
crypto map OUTSIDE_map 1 set ikev2 ipsec-proposal AES256-SHA256
crypto map OUTSIDE_map interface OUTSIDE
crypto ca trustpool policy

crypto ikev2 policy 2
 encryption aes-256
 integrity sha512
 group 14
 prf sha512
 lifetime seconds 3600

crypto ikev2 enable OUTSIDE

group-policy GroupPolicy_1.2.3.4 internal
group-policy GroupPolicy_1.2.3.4 attributes
 vpn-tunnel-protocol ikev2

tunnel-group 1.2.3.4 type ipsec-l2l
tunnel-group 1.2.3.4 general-attributes
 default-group-policy GroupPolicy_1.2.3.4
tunnel-group 1.2.3.4 ipsec-attributes
 ikev2 remote-authentication pre-shared-key *****
 ikev2 local-authentication pre-shared-key *****

strongSwan配置如下所示：

conn con1
    fragmentation = yes
    keyexchange = ikev2
    reauth = yes
    forceencaps = no
    rekey = yes
    reqid = 1
    installpolicy = yes
    type = tunnel
    dpdaction = restart
    dpddelay = 10s
    dpdtimeout = 60s
    auto = route
    left = 1.2.3.4
    right = 9.8.7.6
    leftid = 1.2.3.4
    ikelifetime = 28800s
    lifetime = 3600s
    rightsubnet = 192.168.242.0/24
    leftsubnet = 192.168.244.0/24
    ike = aes256-sha512-modp2048!
    esp = aes256-sha512-modp2048,aes256gcm128-sha512-modp2048!
    leftauth = psk
    rightauth = psk
    rightid = 9.8.7.6

完全披露:我可能是可悲的不合格的这项任务。尽管如此，到目前为止，我已经成功地得到了一个JuniperNS5-GT，FortiateFG-60B，和一个pfSense 2.1的隧道隧道到这个ASA，所以我必须做正确的事情！如有任何协助，将不胜感激。

Answer 1

当第二阶段SA生命周期设置不匹配时，我也看到了类似的行为。您可能需要尝试匹配您的第一阶段和第二阶段的终身设置。

这是ASA上的第一阶段生命期配置：

  crypto ikev2 policy 2
  lifetime seconds 3600

这是您使用StrongSwan进行的第一阶段生命期配置：

 ikelifetime = 28800s

ASA阶段2的生存期默认为28800秒。您可以在全局或每个密码映射实例上显式地配置第二阶段的生存期。您可以按照以下方式配置后者：

 crypto map OUTSIDE_map 1 set security-association lifetime seconds 28800

使用StrongSwan的第二阶段生命期配置：

 lifetime = 3600s

尝试将StrongSwan生存期值更改为28800，以匹配ASA默认值。