search

zhangke5959 / strongswan

支持国密sm1,sm2,sm3,sm4算法的ipsec vpn。
Other
99 stars 74 forks source link

IPsec SA: only UDP encapsulation is supported [ESP] failed to create SAD entry #23

Open bin-wang1 opened 1 year ago

bin-wang1 commented 1 year ago

配置为ikev1，但是出现了错误。请问是什么原因呢？ [IKE] initiating Main Mode IKE_SA vpn[1] to 172.12.1.12 [ENC] generating ID_PROT request 0 [ SA V V V ] [NET] sending packet: from 172.12.1.11[500] to 172.12.1.12[500] (140 bytes) [NET] received packet: from 172.12.1.12[500] to 172.12.1.11[500] (140 bytes) [ENC] parsed ID_PROT response 0 [ SA V V V ] [IKE] received XAuth vendor ID [IKE] received DPD vendor ID [IKE] received FRAGMENTATION vendor ID [CFG] selected proposal: IKE:SM4_CBC_128/HMAC_SM3/PRF_HMAC_SM3/CURVE_SM2 [ENC] generating ID_PROT request 0 [ KE No ] [NET] sending packet: from 172.12.1.11[500] to 172.12.1.12[500] (132 bytes) [NET] received packet: from 172.12.1.12[500] to 172.12.1.11[500] (193 bytes) [ENC] parsed ID_PROT response 0 [ KE No CERTREQ ] [IKE] received cert request for 'C=Country, O=Company, CN=root_CA' [IKE] sending cert request for "C=Country, O=Company, CN=root_CA" [IKE] authentication of '172.22.16.2' (myself) successful [IKE] sending end entity cert "C=Country, O=Company, CN=172.22.16.2" [ENC] generating ID_PROT request 0 [ ID CERT SIG CERTREQ N(INITIAL_CONTACT) ] [NET] sending packet: from 172.12.1.11[500] to 172.12.1.12[500] (652 bytes) [NET] received packet: from 172.12.1.12[500] to 172.12.1.11[500] (524 bytes) [ENC] parsed ID_PROT response 0 [ ID CERT SIG ] [IKE] received end entity cert "C=Country, O=Company, CN=client" [CFG] using certificate "C=Country, O=Company, CN=client" [CFG] using trusted ca certificate "C=Country, O=Company, CN=root_CA" [CFG] checking certificate status of "C=Country, O=Company, CN=client" [CFG] certificate status is not available [CFG] reached self-signed root ca with a path length of 0 [IKE] authentication of '172.22.16.4' with SM2_WITH_SM3 successful [IKE] IKE_SA vpn[1] established between 172.12.1.11[172.22.16.2]...172.12.1.12[172.22.16.4] [IKE] scheduling rekeying in 13712s [IKE] maximum IKE_SA lifetime 15152s [ENC] generating QUICK_MODE request 3675722089 [ HASH SA No KE ID ID ] [NET] sending packet: from 172.12.1.11[500] to 172.12.1.12[500] (252 bytes) [NET] received packet: from 172.12.1.12[500] to 172.12.1.11[500] (252 bytes) [ENC] parsed QUICK_MODE response 3675722089 [ HASH SA No KE ID ID ] [CFG] selected proposal: ESP:SM4_CBC_128/HMAC_SM3/CURVE_SM2/NO_EXT_SEQ [ESP] IPsec SA: only UDP encapsulation is supported [ESP] failed to create SAD entry [ESP] IPsec SA: only UDP encapsulation is supported [ESP] failed to create SAD entry [IKE] unable to install inbound and outbound IPsec SA (SAD) in kernel initiate failed: establishing CHILD_SA 'vpn_child' failed

mfc42d commented 1 year ago

我出现了相同的问题，请问楼上你的问题搞定没有

bin-wang1 commented 1 year ago

我出现了相同的问题，请问楼上你的问题搞定没有 没有呢

bin-wang1 commented 1 year ago

我出现了相同的问题，请问楼上你的问题搞定没有

朋友，你知道，他这个代码哪里用了SM2和SM3吗？我怎么没搞明白

whbwyj commented 1 year ago

请问怎么解决这个问题的？

bin-wang1 commented 1 year ago

没解决

---Original--- From: @.> Date: Wed, Aug 16, 2023 11:18 AM To: @.>; Cc: @.**@.>; Subject: Re: [zhangke5959/strongswan] IPsec SA: only UDP encapsulation issupported [ESP] failed to create SAD entry (Issue #23)

请问怎么解决这个问题的？

— Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you authored the thread.Message ID: @.***>

gmy2171 commented 8 months ago

设置为IKEV2