teratail
回答率
85.30%
質問するログイン新規登録
トップに関する質問Amazon Linux 2よりL2TP/IPSecを使用して、VPN接続したい。

編集履歴

質問編集履歴

6

ipsec status

2020/08/17 02:53

投稿

hrsi
hrsi

スコア20

title CHANGED
File without changes
body CHANGED
@@ -45,12 +45,9 @@
45
45
  leftid=xxx.yyy.xxx.AAA
46
46
  right=ZZZ.YYY.XXX.CCC
47
47
  # rightid=SSS.TTT.UUU.VVV```
48
+ ```
48
49
 
49
- ご存知の方、教えてください。
50
-
51
- 追記
52
-
53
- ipsec status結果
50
+ ipsec status
54
51
  ```
55
52
  000 using kernel interface: netkey
56
53
  000 interface lo/lo ::1@500

5

ipsec status結果

2020/08/17 02:53

投稿

hrsi
hrsi

スコア20

title CHANGED
File without changes
body CHANGED
@@ -50,9 +50,8 @@
50
50
 
51
51
  追記
52
52
 
53
- ```ここに言語を入力
53
+ ipsec status結果
54
-
54
+ ```
55
-
56
55
  000 using kernel interface: netkey
57
56
  000 interface lo/lo ::1@500
58
57
  000 interface lo/lo 127.0.0.1@4500

4

修正

2020/08/17 02:51

投稿

hrsi
hrsi

スコア20

title CHANGED
File without changes
body CHANGED
@@ -49,7 +49,10 @@
49
49
  ご存知の方、教えてください。
50
50
 
51
51
  追記
52
+
52
- ```
53
+ ```ここに言語を入力
54
+
55
+
53
56
  000 using kernel interface: netkey
54
57
  000 interface lo/lo ::1@500
55
58
  000 interface lo/lo 127.0.0.1@4500

3

ipsec status

2020/08/17 02:49

投稿

hrsi
hrsi

スコア20

title CHANGED
File without changes
body CHANGED
@@ -49,7 +49,7 @@
49
49
  ご存知の方、教えてください。
50
50
 
51
51
  追記
52
- ```ipsec status
52
+ ```
53
53
  000 using kernel interface: netkey
54
54
  000 interface lo/lo ::1@500
55
55
  000 interface lo/lo 127.0.0.1@4500

2

ipsec status追加

2020/08/17 02:48

投稿

hrsi
hrsi

スコア20

title CHANGED
File without changes
body CHANGED
@@ -46,4 +46,131 @@
46
46
  right=ZZZ.YYY.XXX.CCC
47
47
  # rightid=SSS.TTT.UUU.VVV```
48
48
 
49
- ご存知の方、教えてください。
49
+ ご存知の方、教えてください。
50
+
51
+ 追記
52
+ ```ipsec status
53
+ 000 using kernel interface: netkey
54
+ 000 interface lo/lo ::1@500
55
+ 000 interface lo/lo 127.0.0.1@4500
56
+ 000 interface lo/lo 127.0.0.1@500
57
+ 000 interface eth0/eth0 172.31.32.76@4500
58
+ 000 interface eth0/eth0 172.31.32.76@500
59
+ 000
60
+ 000
61
+ 000 fips mode=disabled;
62
+ 000 SElinux=disabled
63
+ 000 seccomp=disabled
64
+ 000
65
+ 000 config setup options:
66
+ 000
67
+ 000 configdir=/etc, configfile=/etc/ipsec.conf, secrets=/etc/ipsec.secrets, ipsecdir=/etc/ipsec.d
68
+ 000 nssdir=/etc/ipsec.d, dumpdir=/run/pluto, statsbin=unset
69
+ 000 dnssec-rootkey-file=/var/lib/unbound/root.key, dnssec-trusted=<unset>
70
+ 000 sbindir=/usr/sbin, libexecdir=/usr/libexec/ipsec
71
+ 000 pluto_version=3.25, pluto_vendorid=OE-Libreswan-3.25
72
+ 000 nhelpers=-1, uniqueids=yes, dnssec-enable=yes, perpeerlog=no, logappend=yes, logip=yes, shuntlifetime=900s, xfrmlifetime=300s
73
+ 000 ddos-cookies-threshold=50000, ddos-max-halfopen=25000, ddos-mode=auto
74
+ 000 ikeport=500, ikebuf=0, msg_errqueue=yes, strictcrlpolicy=no, crlcheckinterval=0, listen=<any>, nflog-all=0
75
+ 000 ocsp-enable=no, ocsp-strict=no, ocsp-timeout=2, ocsp-uri=<unset>
76
+ 000 ocsp-trust-name=<unset>
77
+ 000 ocsp-cache-size=1000, ocsp-cache-min-age=3600, ocsp-cache-max-age=86400, ocsp-method=get
78
+ 000 secctx-attr-type=32001
79
+ 000 debug:
80
+ 000
81
+ 000 nat-traversal=yes, keep-alive=20, nat-ikeport=4500
82
+ 000 virtual-private (%priv):
83
+ 000 - allowed subnets: 10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, 25.0.0.0/8, 100.64.0.0/10, fd00::/8, fe80::/10
84
+ 000
85
+ 000 ESP algorithms supported:
86
+ 000
87
+ 000 algorithm ESP encrypt: id=3, name=ESP_3DES, ivlen=8, keysizemin=192, keysizemax=192
88
+ 000 algorithm ESP encrypt: id=6, name=ESP_CAST, ivlen=8, keysizemin=128, keysizemax=128
89
+ 000 algorithm ESP encrypt: id=11, name=ESP_NULL, ivlen=0, keysizemin=0, keysizemax=0
90
+ 000 algorithm ESP encrypt: id=12, name=ESP_AES, ivlen=8, keysizemin=128, keysizemax=256
91
+ 000 algorithm ESP encrypt: id=13, name=ESP_AES_CTR, ivlen=8, keysizemin=128, keysizemax=256
92
+ 000 algorithm ESP encrypt: id=14, name=ESP_AES_CCM_A, ivlen=8, keysizemin=128, keysizemax=256
93
+ 000 algorithm ESP encrypt: id=15, name=ESP_AES_CCM_B, ivlen=8, keysizemin=128, keysizemax=256
94
+ 000 algorithm ESP encrypt: id=16, name=ESP_AES_CCM_C, ivlen=8, keysizemin=128, keysizemax=256
95
+ 000 algorithm ESP encrypt: id=18, name=ESP_AES_GCM_A, ivlen=8, keysizemin=128, keysizemax=256
96
+ 000 algorithm ESP encrypt: id=19, name=ESP_AES_GCM_B, ivlen=8, keysizemin=128, keysizemax=256
97
+ 000 algorithm ESP encrypt: id=20, name=ESP_AES_GCM_C, ivlen=8, keysizemin=128, keysizemax=256
98
+ 000 algorithm ESP encrypt: id=22, name=ESP_CAMELLIA, ivlen=8, keysizemin=128, keysizemax=256
99
+ 000 algorithm ESP encrypt: id=23, name=ESP_NULL_AUTH_AES_GMAC, ivlen=8, keysizemin=128, keysizemax=256
100
+ 000 algorithm ESP encrypt: id=252, name=ESP_SERPENT, ivlen=8, keysizemin=128, keysizemax=256
101
+ 000 algorithm ESP encrypt: id=253, name=ESP_TWOFISH, ivlen=8, keysizemin=128, keysizemax=256
102
+ 000 algorithm AH/ESP auth: id=1, name=AUTH_ALGORITHM_HMAC_MD5, keysizemin=128, keysizemax=128
103
+ 000 algorithm AH/ESP auth: id=2, name=AUTH_ALGORITHM_HMAC_SHA1, keysizemin=160, keysizemax=160
104
+ 000 algorithm AH/ESP auth: id=5, name=AUTH_ALGORITHM_HMAC_SHA2_256, keysizemin=256, keysizemax=256
105
+ 000 algorithm AH/ESP auth: id=6, name=AUTH_ALGORITHM_HMAC_SHA2_384, keysizemin=384, keysizemax=384
106
+ 000 algorithm AH/ESP auth: id=7, name=AUTH_ALGORITHM_HMAC_SHA2_512, keysizemin=512, keysizemax=512
107
+ 000 algorithm AH/ESP auth: id=8, name=AUTH_ALGORITHM_HMAC_RIPEMD, keysizemin=160, keysizemax=160
108
+ 000 algorithm AH/ESP auth: id=9, name=AUTH_ALGORITHM_AES_XCBC, keysizemin=128, keysizemax=128
109
+ 000 algorithm AH/ESP auth: id=250, name=AUTH_ALGORITHM_AES_CMAC_96, keysizemin=128, keysizemax=128
110
+ 000 algorithm AH/ESP auth: id=251, name=AUTH_ALGORITHM_NULL_KAME, keysizemin=0, keysizemax=0
111
+ 000
112
+ 000 IKE algorithms supported:
113
+ 000
114
+ 000 algorithm IKE encrypt: v1id=5, v1name=OAKLEY_3DES_CBC, v2id=3, v2name=3DES, blocksize=8, keydeflen=192
115
+ 000 algorithm IKE encrypt: v1id=8, v1name=OAKLEY_CAMELLIA_CBC, v2id=23, v2name=CAMELLIA_CBC, blocksize=16, keydeflen=128
116
+ 000 algorithm IKE encrypt: v1id=-1, v1name=n/a, v2id=20, v2name=AES_GCM_C, blocksize=16, keydeflen=128
117
+ 000 algorithm IKE encrypt: v1id=-1, v1name=n/a, v2id=19, v2name=AES_GCM_B, blocksize=16, keydeflen=128
118
+ 000 algorithm IKE encrypt: v1id=-1, v1name=n/a, v2id=18, v2name=AES_GCM_A, blocksize=16, keydeflen=128
119
+ 000 algorithm IKE encrypt: v1id=13, v1name=OAKLEY_AES_CTR, v2id=13, v2name=AES_CTR, blocksize=16, keydeflen=128
120
+ 000 algorithm IKE encrypt: v1id=7, v1name=OAKLEY_AES_CBC, v2id=12, v2name=AES_CBC, blocksize=16, keydeflen=128
121
+ 000 algorithm IKE encrypt: v1id=65004, v1name=OAKLEY_SERPENT_CBC, v2id=65004, v2name=SERPENT_CBC, blocksize=16, keydeflen=128
122
+ 000 algorithm IKE encrypt: v1id=65005, v1name=OAKLEY_TWOFISH_CBC, v2id=65005, v2name=TWOFISH_CBC, blocksize=16, keydeflen=128
123
+ 000 algorithm IKE encrypt: v1id=65289, v1name=OAKLEY_TWOFISH_CBC_SSH, v2id=65289, v2name=TWOFISH_CBC_SSH, blocksize=16, keydeflen=128
124
+ 000 algorithm IKE PRF: name=HMAC_MD5, hashlen=16
125
+ 000 algorithm IKE PRF: name=HMAC_SHA1, hashlen=20
126
+ 000 algorithm IKE PRF: name=HMAC_SHA2_256, hashlen=32
127
+ 000 algorithm IKE PRF: name=HMAC_SHA2_384, hashlen=48
128
+ 000 algorithm IKE PRF: name=HMAC_SHA2_512, hashlen=64
129
+ 000 algorithm IKE PRF: name=AES_XCBC, hashlen=16
130
+ 000 algorithm IKE DH Key Exchange: name=MODP1024, bits=1024
131
+ 000 algorithm IKE DH Key Exchange: name=MODP1536, bits=1536
132
+ 000 algorithm IKE DH Key Exchange: name=MODP2048, bits=2048
133
+ 000 algorithm IKE DH Key Exchange: name=MODP3072, bits=3072
134
+ 000 algorithm IKE DH Key Exchange: name=MODP4096, bits=4096
135
+ 000 algorithm IKE DH Key Exchange: name=MODP6144, bits=6144
136
+ 000 algorithm IKE DH Key Exchange: name=MODP8192, bits=8192
137
+ 000 algorithm IKE DH Key Exchange: name=DH19, bits=512
138
+ 000 algorithm IKE DH Key Exchange: name=DH20, bits=768
139
+ 000 algorithm IKE DH Key Exchange: name=DH21, bits=1056
140
+ 000 algorithm IKE DH Key Exchange: name=DH22, bits=1024
141
+ 000 algorithm IKE DH Key Exchange: name=DH23, bits=2048
142
+ 000 algorithm IKE DH Key Exchange: name=DH24, bits=2048
143
+ 000
144
+ 000 stats db_ops: {curr_cnt, total_cnt, maxsz} :context={0,0,0} trans={0,0,0} attrs={0,0,0}
145
+ 000
146
+ 000 Connection list:
147
+ 000
148
+ 000 "L2TP": 172.31.32.76[zz.178.yy.xx]---172.31.32.1...222.228.xxx.yyy<222.228.220.xxx>; unrouted; eroute owner: #0
149
+ 000 "L2TP": oriented; my_ip=unset; their_ip=unset; my_updown=ipsec _updown;
150
+ 000 "L2TP": xauth us:none, xauth them:none, my_username=[any]; their_username=[any]
151
+ 000 "L2TP": our auth:secret, their auth:secret
152
+ 000 "L2TP": modecfg info: us:none, them:none, modecfg policy:push, dns:unset, domains:unset, banner:unset, cat:unset;
153
+ 000 "L2TP": labeled_ipsec:no;
154
+ 000 "L2TP": policy_label:unset;
155
+ 000 "L2TP": ike_life: 28800s; ipsec_life: 3600s; replay_window: 32; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 3;
156
+ 000 "L2TP": retransmit-interval: 500ms; retransmit-timeout: 60s;
157
+ 000 "L2TP": initial-contact:no; cisco-unity:no; fake-strongswan:no; send-vendorid:no; send-no-esp-tfc:no;
158
+ 000 "L2TP": policy: PSK+ENCRYPT+UP+IKEV1_ALLOW+IKEV2_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO;
159
+ 000 "L2TP": conn_prio: 32,32; interface: eth0; metric: 0; mtu: unset; sa_prio:auto; sa_tfc:none;
160
+ 000 "L2TP": nflog-group: unset; mark: unset; vti-iface:unset; vti-routing:no; vti-shared:no; nic-offload:auto;
161
+ 000 "L2TP": our idtype: ID_IPV4_ADDR; our id=54.178.40.74; their idtype: ID_IPV4_ADDR; their id=222.228.220.222
162
+ 000 "L2TP": dpd: action:clear; delay:30; timeout:120; nat-t: encaps:yes; nat_keepalive:yes; ikev1_natt:both
163
+ 000 "L2TP": newest ISAKMP SA: #0; newest IPsec SA: #0;
164
+ 000
165
+ 000 Total IPsec connections: loaded 1, active 0
166
+ 000
167
+ 000 State Information: DDoS cookies not required, Accepting new IKE connections
168
+ 000 IKE SAs: total(1), half-open(1), open(0), authenticated(0), anonymous(0)
169
+ 000 IPsec SAs: total(0), authenticated(0), anonymous(0)
170
+ 000
171
+ 000 #2: "L2TP":500 STATE_MAIN_I1 (sent MI1, expecting MR1); EVENT_v1_RETRANSMIT in 16s; nodpd; idle; import:admin initiate
172
+ 000 #2: pending Phase 2 for "L2TP"
173
+ 000
174
+ 000 Bare Shunt list:
175
+ 000
176
+ ```

1

内容修正

2020/08/17 02:47

投稿

hrsi
hrsi

スコア20

title CHANGED
File without changes
body CHANGED
@@ -12,7 +12,12 @@
12
12
  010 "L2TP" #1: STATE_MAIN_I1: retransmission; will wait 0.5 seconds for response
13
13
  010 "L2TP" #1: STATE_MAIN_I1: retransmission; will wait 1 seconds for response
14
14
  010 "L2TP" #1: STATE_MAIN_I1: retransmission; will wait 2 seconds for response
15
- 010 "L2TP" #1: STATE_MAIN_I1: retransmission; will wait 4 seconds for respons
15
+ 010 "L2TP" #1: STATE_MAIN_I1: retransmission; will wait 4 seconds for response
16
+ 010 "L2TP" #1: STATE_MAIN_I1: retransmission; will wait 8 seconds for response
17
+ 010 "L2TP" #1: STATE_MAIN_I1: retransmission; will wait 16 seconds for response
18
+ 010 "L2TP" #1: STATE_MAIN_I1: retransmission; will wait 32 seconds for response
19
+ 031 "L2TP" #1: STATE_MAIN_I1: 60 second timeout exceeded after 7 retransmits. No response (or no acceptable response) to our first IKEv1 message
20
+ 000 "L2TP" #1: starting keying attempt 2 of at most 3, but releasing whack
16
21
  ```
17
22
 
18
23
  となりました。コマンドが止まらない。