ipsec无法连接

cryamethy

今日发现多台设备的ipsec突然无法连接上，日志显示如下：
Aug 9 08:00:17
00[DMN] Starting IKE charon daemon (strongSwan 5.8.4, Linux 5.10.118, x86_64)

Aug 9 08:00:17
00[CFG] loading ca certificates from '/etc/ipsec.d/cacerts'

Aug 9 08:00:17
00[CFG] loading aa certificates from '/etc/ipsec.d/aacerts'

Aug 9 08:00:17
00[CFG] loading ocsp signer certificates from '/etc/ipsec.d/ocspcerts'

Aug 9 08:00:17
00[CFG] loading attribute certificates from '/etc/ipsec.d/acerts'

Aug 9 08:00:17
00[CFG] loading crls from '/etc/ipsec.d/crls'

Aug 9 08:00:17
00[CFG] loading secrets from '/etc/ipsec.secrets'

Aug 9 08:00:17
00[CFG] expanding file expression '/etc/ipsec.secrets.d/*' failed

Aug 9 08:00:17
00[LIB] loaded plugins: charon aes des blowfish rc2 sha2 sha1 md5 random nonce x509 revocation constraints pubkey pkcs1 pgp dnskey sshkey pem fips-prf gmp xcbc hmac attr kernel-netlink resolve socket-default connmark stroke updown xauth-generic

Aug 9 08:00:17
00[LIB] dropped capabilities, running as uid 0, gid 0

Aug 9 08:00:17
00[JOB] spawning 16 worker threads

Aug 9 08:00:32
12[CFG] received stroke: add connection 'vpn-1'

Aug 9 08:00:32
17[LIB] resolving 'homezyc.3322.org' failed: Name or service not known

Aug 9 08:00:32
12[CFG] added configuration 'vpn-1'

Aug 9 08:00:32
14[CFG] rereading secrets

Aug 9 08:00:32
14[CFG] loading secrets from '/etc/ipsec.secrets'

Aug 9 08:00:32
14[CFG] loading secrets from '/etc/ipsec.secrets.d/vpn-1'

Aug 9 08:00:32
14[CFG] loaded IKE secret for 175.4.119.201 homezyc.3322.org

Aug 9 08:00:32
14[CFG] rereading ca certificates from '/etc/ipsec.d/cacerts'

Aug 9 08:00:32
14[CFG] rereading aa certificates from '/etc/ipsec.d/aacerts'

Aug 9 08:00:32
14[CFG] rereading ocsp signer certificates from '/etc/ipsec.d/ocspcerts'

Aug 9 08:00:32
14[CFG] rereading attribute certificates from '/etc/ipsec.d/acerts'

Aug 9 08:00:32
14[CFG] rereading crls from '/etc/ipsec.d/crls'

Aug 9 08:00:32
16[CFG] received stroke: terminate 'vpn-1'

Aug 9 08:00:32
16[CFG] no IKE_SA named 'vpn-1' found

Aug 9 08:00:32
05[CFG] received stroke: initiate 'vpn-1'

Aug 9 08:00:32
17[LIB] resolving 'homezyc.3322.org' failed: Name or service not known

Aug 9 08:00:32
05[IKE] unable to resolve homezyc.3322.org, initiate aborted

Aug 9 08:00:32
05[MGR] tried to checkin and delete nonexistent IKE_SA

Aug 9 09:00:41
14[CFG] received stroke: delete connection 'vpn-1'

Aug 9 09:00:41
14[CFG] deleted connection 'vpn-1'

Aug 9 09:00:41
12[CFG] rereading secrets

Aug 9 09:00:41
12[CFG] loading secrets from '/etc/ipsec.secrets'

Aug 9 09:00:41
12[CFG] expanding file expression '/etc/ipsec.secrets.d/*' failed

Aug 9 09:00:41
12[CFG] rereading ca certificates from '/etc/ipsec.d/cacerts'

Aug 9 09:00:41
12[CFG] rereading aa certificates from '/etc/ipsec.d/aacerts'

Aug 9 09:00:41
12[CFG] rereading ocsp signer certificates from '/etc/ipsec.d/ocspcerts'

Aug 9 09:00:41
12[CFG] rereading attribute certificates from '/etc/ipsec.d/acerts'

Aug 9 09:00:41
12[CFG] rereading crls from '/etc/ipsec.d/crls'

Aug 9 09:00:41
06[CFG] received stroke: terminate 'vpn-1'

Aug 9 09:00:41
06[CFG] no IKE_SA named 'vpn-1' found

Aug 9 09:00:44
05[CFG] received stroke: add connection 'vpn-1'

Aug 9 09:00:44
07[CFG] rereading secrets

Aug 9 09:00:44
07[CFG] loading secrets from '/etc/ipsec.secrets'

Aug 9 09:00:44
07[CFG] loading secrets from '/etc/ipsec.secrets.d/vpn-1'

Aug 9 09:00:44
07[CFG] loaded IKE secret for 175.4.119.201 homezyc.3322.org

Aug 9 09:00:44
07[CFG] rereading ca certificates from '/etc/ipsec.d/cacerts'

Aug 9 09:00:44
07[CFG] rereading aa certificates from '/etc/ipsec.d/aacerts'

Aug 9 09:00:44
07[CFG] rereading ocsp signer certificates from '/etc/ipsec.d/ocspcerts'

Aug 9 09:00:44
07[CFG] rereading attribute certificates from '/etc/ipsec.d/acerts'

Aug 9 09:00:44
07[CFG] rereading crls from '/etc/ipsec.d/crls'

Aug 9 09:00:44
09[CFG] received stroke: terminate 'vpn-1'

Aug 9 09:00:44
09[CFG] no IKE_SA named 'vpn-1' found

Aug 9 09:00:44
15[CFG] received stroke: initiate 'vpn-1'

Aug 9 09:00:44
15[CFG] no config named 'vpn-1'

Aug 9 09:00:44
05[CFG] added configuration 'vpn-1'

爱快技术支持01

楼主您好，两端ipsec均为爱快设备吗？可以先检查下两端ipsec名称是否存在中文，建议修改为英文和数字符，需要具体排查的话请联系咱们技术提供两端远程看下
==========================================================================
如回复您这边还有需要协助可联系爱快技术工程师爱快已开通快速服务码通道，使用服务码可通过多渠道（爱快路由官网、微信小程序爱快微云、手机APP爱快e云，微信公众号爱快智能网络）进行技术咨询可以快速解决您的问题，具体操作步骤请看以下帮助链接
新内核版本测试固件帖：https://bbs.ikuai8.com/thread-129069-1-1.html
文本教程：http://ikuai9.com:555/s/fu36pp
视频教程：http://ikuai9.com:555/s/t0katu

cryamethy

爱快技术支持01 发表于 2022-8-9 09:25
楼主您好，两端ipsec均为爱快设备吗？可以先检查下两端ipsec名称是否存在中文，建议修改为英文和数字符，需 ...

没有中文名，都是数字字母以及下划线，两端均为爱快设备