對與 Cisco IOS 客戶閘道裝置的 AWS Site-to-Site VPN 連線進行故障診斷

焦點模式

對與 Cisco IOS 客戶閘道裝置的 AWS Site-to-Site VPN 連線進行故障診斷 - AWS Site-to-Site VPN

當您對 Cisco 客戶閘道裝置的連線問題進行故障診斷時，請考量四件事：IKE、IPsec、通道和 BGP。您可依任何順序故障診斷這些區域，但建議您從 IKE 開始 (網路堆疊底部的)，一路向上。

IKE

使用下列命令。回應顯示客戶閘道裝置的 IKE 設定正確。


router# show crypto isakmp sa


IPv4 Crypto ISAKMP SA
dst             src             state          conn-id slot status
192.168.37.160  72.21.209.193   QM_IDLE           2001    0 ACTIVE
192.168.37.160  72.21.209.225   QM_IDLE           2002    0 ACTIVE

您應該會看到一或多行包含通道中所指定遠端閘道的 src 數值。state 應為 QM_IDLE，而 status 應為 ACTIVE。缺少項目或任何項目處於其他狀態，都表示 IKE 未正確設定。

如需進一步故障診斷，請執行下列命令來啟用提供診斷資訊的日誌訊息。


router# term mon
router# debug crypto isakmp

使用下列命令停用除錯。


router# no debug crypto isakmp

IPsec

使用下列命令。回應顯示客戶閘道裝置的 IPsec 設定正確。


router# show crypto ipsec sa


interface: Tunnel1
    Crypto map tag: Tunnel1-head-0, local addr 192.168.37.160

    protected vrf: (none)
    local  ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
    remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
    current_peer 72.21.209.225 port 500
     PERMIT, flags={origin_is_acl,}
     #pkts encaps: 149, #pkts encrypt: 149, #pkts digest: 149
     #pkts decaps: 146, #pkts decrypt: 146, #pkts verify: 146
     #pkts compressed: 0, #pkts decompressed: 0
     #pkts not compressed: 0, #pkts compr. failed: 0
     #pkts not decompressed: 0, #pkts decompress failed: 0
     #send errors 0, #recv errors 0

     local crypto endpt.: 174.78.144.73, remote crypto endpt.: 72.21.209.225
     path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet0
     current outbound spi: 0xB8357C22(3090512930)

     inbound esp sas:
      spi: 0x6ADB173(112046451)
       transform: esp-aes esp-sha-hmac ,
       in use settings ={Tunnel, }
       conn id: 1, flow_id: Motorola SEC 2.0:1, crypto map: Tunnel1-head-0
       sa timing: remaining key lifetime (k/sec): (4467148/3189)
       IV size: 16 bytes
       replay detection support: Y  replay window size: 128
       Status: ACTIVE

     inbound ah sas:

     inbound pcp sas:

     outbound esp sas:
      spi: 0xB8357C22(3090512930)
       transform: esp-aes esp-sha-hmac ,
       in use settings ={Tunnel, }
       conn id: 2, flow_id: Motorola SEC 2.0:2, crypto map: Tunnel1-head-0
       sa timing: remaining key lifetime (k/sec): (4467148/3189)
       IV size: 16 bytes
       replay detection support: Y  replay window size: 128
       Status: ACTIVE

     outbound ah sas:

     outbound pcp sas:

interface: Tunnel2
     Crypto map tag: Tunnel2-head-0, local addr 174.78.144.73

     protected vrf: (none)
     local  ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
     remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
     current_peer 72.21.209.193 port 500
      PERMIT, flags={origin_is_acl,}
     #pkts encaps: 26, #pkts encrypt: 26, #pkts digest: 26
     #pkts decaps: 24, #pkts decrypt: 24, #pkts verify: 24
     #pkts compressed: 0, #pkts decompressed: 0
     #pkts not compressed: 0, #pkts compr. failed: 0
     #pkts not decompressed: 0, #pkts decompress failed: 0
     #send errors 0, #recv errors 0

     local crypto endpt.: 174.78.144.73, remote crypto endpt.: 72.21.209.193
     path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet0
     current outbound spi: 0xF59A3FF6(4120526838)

     inbound esp sas:
      spi: 0xB6720137(3060924727)
       transform: esp-aes esp-sha-hmac ,
       in use settings ={Tunnel, }
       conn id: 3, flow_id: Motorola SEC 2.0:3, crypto map: Tunnel2-head-0
       sa timing: remaining key lifetime (k/sec): (4387273/3492)
       IV size: 16 bytes
       replay detection support: Y  replay window size: 128
       Status: ACTIVE

     inbound ah sas:

     inbound pcp sas:

     outbound esp sas:
      spi: 0xF59A3FF6(4120526838)
       transform: esp-aes esp-sha-hmac ,
       in use settings ={Tunnel, }
       conn id: 4, flow_id: Motorola SEC 2.0:4, crypto map: Tunnel2-head-0
       sa timing: remaining key lifetime (k/sec): (4387273/3492)
       IV size: 16 bytes
       replay detection support: Y  replay window size: 128
       Status: ACTIVE

     outbound ah sas:

     outbound pcp sas:

對於每個通道界面，您應該都會同時看到 inbound esp sas 和 outbound esp sas。假設列出 SA (例如，spi: 0xF95D2F3C)，而且 Status 為 ACTIVE，則 IPsec 設定正確。

如需進一步故障診斷，請使用下列命令啟用除錯。


router# debug crypto ipsec

使用下列命令停用除錯。


router# no debug crypto ipsec

通道

首先，請檢查您有沒有必要的防火牆規則。如需詳細資訊，請參閱AWS Site-to-Site VPN 客戶閘道裝置的防火牆規則。

如果您的防火牆規則設定正確，則繼續使用下列命令來進行故障診斷。


router# show interfaces tun1


Tunnel1 is up, line protocol is up 
  Hardware is Tunnel
  Internet address is 169.254.255.2/30
  MTU 17867 bytes, BW 100 Kbit/sec, DLY 50000 usec, 
    reliability 255/255, txload 2/255, rxload 1/255
  Encapsulation TUNNEL, loopback not set
  Keepalive not set
  Tunnel source 174.78.144.73, destination 72.21.209.225
  Tunnel protocol/transport IPSEC/IP
  Tunnel TTL 255
  Tunnel transport MTU 1427 bytes
  Tunnel transmit bandwidth 8000 (kbps)
  Tunnel receive bandwidth 8000 (kbps)
  Tunnel protection via IPSec (profile "ipsec-vpn-92df3bfb-0")
  Last input never, output never, output hang never
  Last clearing of "show interface" counters never
  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
  Queueing strategy: fifo
  Output queue: 0/0 (size/max)
  5 minute input rate 0 bits/sec, 1 packets/sec
  5 minute output rate 1000 bits/sec, 1 packets/sec
    407 packets input, 30010 bytes, 0 no buffer
    Received 0 broadcasts, 0 runts, 0 giants, 0 throttles

確定 line protocol 已啟動。分別針對通道來源 IP 地址、來源界面和目標，檢查其是否與 IP 地址外客戶閘道裝置、界面和 IP 地址外虛擬私有閘道的通道組態相符。確定 Tunnel protection via IPSec 已存在。於這兩個通道界面上執行此命令。若要解決任何問題，請檢閱組態，並檢查與客戶閘道裝置的實體連接。

同時也使用下列命令，將 169.254.255.1 換成虛擬私有閘道的內部 IP 地址。


router# ping 169.254.255.1 df-bit size 1410


Type escape sequence to abort.
Sending 5, 1410-byte ICMP Echos to 169.254.255.1, timeout is 2 seconds:
Packet sent with the DF bit set
!!!!!

您應該會看見五個驚嘆號。

如需進一步故障診斷，請檢閱組態。

BGP

使用下列命令。


router# show ip bgp summary


BGP router identifier 192.168.37.160, local AS number 65000
BGP table version is 8, main routing table version 8
2 network entries using 312 bytes of memory
2 path entries using 136 bytes of memory
3/1 BGP path/bestpath attribute entries using 444 bytes of memory
1 BGP AS-PATH entries using 24 bytes of memory
0 BGP route-map cache entries using 0 bytes of memory
0 BGP filter-list cache entries using 0 bytes of memory
Bitfield cache entries: current 1 (at peak 2) using 32 bytes of memory
BGP using 948 total bytes of memory
BGP activity 4/1 prefixes, 4/1 paths, scan interval 15 secs

Neighbor        V    AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
169.254.255.1   4  7224     363     323        8    0    0 00:54:21        1
169.254.255.5   4  7224     364     323        8    0    0 00:00:24        1

應會列出兩個鄰近項目。每一個都應該會看到 State/PfxRcd 的數值為 1。

如果 BGP 對等互連已啟動，請確認您的客戶閘道裝置是否向 VPC 公告預設路由 (0.0.0.0/0)。


router# show bgp all neighbors 169.254.255.1 advertised-routes


For address family: IPv4 Unicast
BGP table version is 3, local router ID is 174.78.144.73
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
     r RIB-failure, S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete

Originating default network 0.0.0.0

Network             Next Hop            Metric   LocPrf Weight Path
*> 10.120.0.0/16    169.254.255.1          100        0   7224    i

Total number of prefixes 1

此外，確定您會從虛擬私有閘道收到對應至您 VPC 的字首。


router# show ip route bgp


	10.0.0.0/16 is subnetted, 1 subnets
B       10.255.0.0 [20/0] via 169.254.255.1, 00:00:20

如需進一步故障診斷，請檢閱組態。

您的瀏覽器已停用或無法使用 Javascript。

您必須啟用 Javascript，才能使用 AWS 文件。請參閱您的瀏覽器說明頁以取得說明。

文件慣用形式

Cisco ASA

沒有 BGP 的 Cisco IOS

在本頁面

選取您的 Cookie 偏好設定

自訂 Cookie 偏好設定

必要

效能

功能

廣告

無法儲存 Cookie 偏好設定

對與 Cisco IOS 客戶閘道裝置的 AWS Site-to-Site VPN 連線進行故障診斷

IKE

IPsec

通道

BGP

在本頁面

此頁面是否有幫助？

下一個主題：

上一個主題：

需要協助？