已建立OpenSwan IPsec隧道到Azure网关，但无法连接

Question

我目前正在尝试建立一个IPsec隧道之间的我的内部中心和虚拟专用网在Azure。我在一个上设置OpenSwan 2.6.23，我的盒子在NAT后面。

ipsec.conf

config setup
    nat_traversal=yes
    protostack=netkey
    interfaces=%defaultroute
    klipsdebug=none
    plutodebug=none

conn to-azure
    authby=secret
    auto=start
    type=tunnel

    left=10.0.210.22
    leftid=<my-public-ip>
    leftnexthop=%defaultroute
    leftsubnet=10.0.210.0/24

    right=<azure-gateway-public-ip>
    rightsubnet=10.13.0.0/16
    rightnexthop=%defaultroute

    ike=aes256-sha1-modp1024
    ikev2=insist
    phase2=esp
    phase2alg=aes256-sha1
    pfs=no

ipsec.secrets

<my-public-ip> <azure-gateway-public-ip>: PSK "supersecurepassword"

这就是我在启动ipsec时收到的信息，据我所知，它表明隧道已经建立。

000 "to-azure": 10.0.210.0/24===10.0.210.22<10.0.210.22>[<my-public-ip>,+S=C]---10.0.210.3...10.0.210.3---<azure-gateway-public-ip><<azure-gateway-public-ip>>[+S=C]===10.13.0.0/16; erouted; eroute owner: #2
000 "to-azure":     myip=unset; hisip=unset;
000 "to-azure":   ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0
000 "to-azure":   policy: PSK+ENCRYPT+TUNNEL+UP+!IKEv1+IKEv2ALLOW+IKEv2Init+lKOD+rKOD; prio: 24,16; interface: eth0;
000 "to-azure":   newest ISAKMP SA: #1; newest IPsec SA: #2;
000 "to-azure":   IKE algorithms wanted: AES_CBC(7)_256-SHA1(2)-MODP1024(2); flags=-strict
000 "to-azure":   IKE algorithms found:  AES_CBC(7)_256-SHA1(2)_160-2,
000 "to-azure":   IKE algorithm newest: _256-SHA1-MODP1024
000 "to-azure":   ESP algorithms wanted: AES(12)_256-SHA1(2); flags=-strict
000 "to-azure":   ESP algorithms loaded: AES(12)_256-SHA1(2)_160
000 "to-azure":   ESP algorithm newest: AES_256-HMAC_SHA1; pfsgroup=<N/A>
000
000 #2: "to-azure":500 STATE_PARENT_I3 (PARENT SA established); EVENT_SA_REPLACE in 27760s; newest IPSEC; eroute owner; nodpd; idle; import:admin initiate
000 #1: "to-azure":500 STATE_PARENT_I3 (PARENT SA established); EVENT_SA_REPLACE in 3484s; newest ISAKMP; nodpd; idle; import:admin initiate
000

但是，当我检查auth.logs时，它显示如下：

added connection description "to-azure"
listening for IKE messages
NAT-Traversal: Trying new style NAT-T
NAT-Traversal: ESPINUDP(1) setup failed for new style NAT-T family IPv4 (errno=19)
NAT-Traversal: Trying old style NAT-T
adding interface eth0/eth0 10.0.210.22:500
adding interface eth0/eth0 10.0.210.22:4500
adding interface lo/lo 127.0.0.1:500
adding interface lo/lo 127.0.0.1:4500
adding interface lo/lo ::1:500
loading secrets from "/etc/ipsec.secrets"
"to-azure" #1: initiating v2 parent SA
"to-azure" #1: transition from state STATE_IKEv2_START to state STATE_PARENT_I1
"to-azure" #1: STATE_PARENT_I1: sent v2I1, expected v2R1
"to-azure" #2: transition from state STATE_PARENT_I1 to state STATE_PARENT_I2
"to-azure" #2: STATE_PARENT_I2: sent v2I2, expected v2R2 {auth=IKEv2 cipher=aes_256 integ=sha1 prf=oakley_sha group=modp1024}
packet from <azure-gateway-public-ip>: IKEv2 mode peer ID is ID_IPV4_ADDR: '<azure-gateway-public-ip>'
"to-azure" #2: transition from state STATE_PARENT_I2 to state STATE_PARENT_I3
"to-azure" #2: negotiated tunnel [10.0.210.0,10.0.210.255] -> [10.13.0.0,10.13.255.255]
"to-azure" #2: STATE_PARENT_I3: PARENT SA established tunnel mode {ESP=>0xeebf6740 <0x4d67c332 xfrm=AES_256-HMAC_SHA1 NATOA=none NATD=none DPD=none}
| releasing whack for #2 (sock=-1)
| releasing whack for #1 (sock=-1)
packet from <azure-gateway-public-ip>: received packet that was neither (I)nitiator or (R)esponder, msgid=0

ipsec验证显示一切正常，OE被禁用。为什么我仍然无法接收来自Azure实例的数据包？

Answer 1

我在我的CentOS上试用了你的CentOS文件。对我来说很管用。安装在我的盒子上的libreswan版本是3.15。

若要解决此问题，请执行以下步骤：

验证VPN连接是否已正确建立。请尝试从Azure VPN网关获取日志。下面是一个很好的指南：逐步:捕获Azure资源管理器(ARM) VNET网关诊断日志

如果连接已正确建立，则请确保已在Linux盒上启用路由功能，并已将适当的路由条目广告到本地网络。