GPC 和 Fortinet 800C 之间的站点到站点 VPN答案

【问题标题】：site to site VPN between GPC and Fortinet 800CGPC 和 Fortinet 800C 之间的站点到站点 VPN
【发布时间】：2016-12-25 06:01:42
【问题描述】：

我有一个 VPN 站点到站点配置 Fortinet800C 和 Google Cloud VPN 作为链接：https://cloud.google.com/files/CloudVPNGuide-UsingCloudVPNwithFortinetFortiGate300C.pdf。
但这并不成功。日志看起来像这样一遍又一遍地重复：

16:43:36.240
sending packet: from 146.148.29.x[500] to 27.72.57.x[500] (640 bytes)
16:43:36.547
received packet: from 27.72.57.x[500] to 146.148.29.x[500] (360 bytes)
16:43:36.548
parsed IKE_SA_INIT request 0 [ SA KE No ]
16:43:36.548
27.72.57.x is initiating an IKE_SA
16:43:36.559
generating IKE_SA_INIT response 0 [ SA KE No N(MULT_AUTH) ]
16:43:36.559
sending packet: from 146.148.29.x[500] to 27.72.57.x[500] (384 bytes)
16:43:36.565
received packet: from 27.72.57.x[500] to 146.148.29.x[500] (360 bytes)
16:43:36.565
parsed IKE_SA_INIT response 0 [ SA KE No ]
16:43:36.571
authentication of '146.148.29.x' (myself) with pre-shared key
16:43:36.571
establishing CHILD_SA vpn_27.72.57.x{1}
16:43:36.571
generating IKE_AUTH request 1 [ IDi N(INIT_CONTACT) IDr AUTH SA TSi TSr N(EAP_ONLY) ]
16:43:36.572
sending packet: from 146.148.29.x[500] to 27.72.57.x[500] (316 bytes)
16:43:36.885
received packet: from 27.72.57.x[500] to 146.148.29.x[500] (204 bytes)
16:43:36.886
parsed IKE_AUTH request 1 [ IDi AUTH N(MSG_ID_SYN_SUP) SA TSi TSr ]
16:43:36.886
looking for peer configs matching 146.148.29.x[%any]...27.72.57.x[192.168.0.x]
16:43:36.886
no matching peer config found
16:43:36.886
generating IKE_AUTH response 1 [ N(AUTH_FAILED) ]
16:43:36.886
sending packet: from 146.148.29.x[500] to 27.72.57.x[500] (76 bytes)
16:43:36.891
received packet: from 27.72.57.x[500] to 146.148.29.x[500] (124 bytes)
16:43:36.891
parsed IKE_AUTH response 1 [ IDr AUTH N(TS_UNACCEPT) ]
16:43:36.891
authentication of '192.168.0.x' with pre-shared key successful
16:43:36.891
constraint check failed: identity '27.72.57.x' required
16:43:36.891
selected peer config 'vpn_27.72.57.x' inacceptable: constraint checking failed
16:43:36.891
no alternative config found
16:43:36.891
generating INFORMATIONAL request 2 [ N(AUTH_FAILED) ]
16:43:36.891
sending packet: from 146.148.29.x[500] to 27.72.57.x[500] (76 bytes)
16:43:37.887
received packet: from 27.72.57.x[500] to 146.148.29.x[500] (360 bytes)
16:43:37.888
parsed IKE_SA_INIT request 0 [ SA KE No ]
16:43:37.888
27.72.57.140 is initiating an IKE_SA
16:43:37.900
generating IKE_SA_INIT response 0 [ SA KE No N(MULT_AUTH) ]

如果有人能发现我的错误，我将不胜感激。谢谢。

【问题讨论】：

标签： google-compute-engine google-cloud-platform google-cloud-endpoints vpn

【解决方案1】：

我的猜测是云 VPN 和 Fortinet 设备未配置为相同的 IKE 版本。请检查一下。

另外，请尝试查看云控制台中显示的 VPN 状态消息，或在命令行中使用“gcloud compute vpn-tunnels describe”。

【讨论】：

【解决方案2】：

双方的第 1 阶段设置中的一项或多项似乎不匹配。如果不查看实际配置，我无法确定。但一般情况下，检查预共享密钥、认证和加密算法、DH 组、远程网关的IP 和连接的出接口。这些因素必须匹配。此外，如果您在一端启用了 NAT-Traversal，则也必须在另一端启用它。

【讨论】：

【解决方案3】：

我同意前面的答案。日志说，第一阶段无法建立。所以参数不相等。

似乎 psi（预共享密钥）是相等的： "使用预共享密钥验证 '192.168.0.x' 成功"

【讨论】：

这并不能真正回答问题。如果您有其他问题，可以点击进行提问。要在此问题有新答案时收到通知，您可以follow this question。一旦你有足够的reputation，你也可以add a bounty 来引起对这个问题的更多关注。 - From Review