本文為英文版的機器翻譯版本，如內容有任何歧義或不一致之處，概以英文版為準。 # 對沒有邊界閘道協定的 Cisco IOS 客戶閘道裝置的 AWS Site-to-Site VPN 連線進行故障診斷 當您對 Cisco 客戶閘道裝置的連線問題進行故障診斷時，請考量三件事：IKE、IPsec 和通道。您可依任何順序故障診斷這些區域，但建議您從 IKE 開始 (網路堆疊底部的)，一路向上。 ## IKE 使用下列 命令。回應顯示客戶閘道裝置的 IKE 設定正確。 ``` router# show crypto isakmp sa ``` ``` IPv4 Crypto ISAKMP SA dst src state conn-id slot status 174.78.144.73 205.251.233.121 QM_IDLE 2001 0 ACTIVE 174.78.144.73 205.251.233.122 QM_IDLE 2002 0 ACTIVE ``` 您應該會看到一或多行包含通道中所指定遠端閘道的 `src` 數值。`state` 應為 `QM_IDLE`，而 `status` 應為 `ACTIVE`。缺少項目或任何項目處於其他狀態，都表示 IKE 未正確設定。 如需進一步故障診斷，請執行下列命令來啟用提供診斷資訊的日誌訊息。 ``` router# term mon router# debug crypto isakmp ``` 使用下列命令停用除錯。 ``` router# no debug crypto isakmp ``` ## IPsec 使用下列 命令。回應顯示客戶閘道裝置的 IPsec 設定正確。 ``` router# show crypto ipsec sa ``` ``` interface: Tunnel1 Crypto map tag: Tunnel1-head-0, local addr 174.78.144.73 protected vrf: (none) local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0) remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0) current_peer 72.21.209.225 port 500 PERMIT, flags={origin_is_acl,} #pkts encaps: 149, #pkts encrypt: 149, #pkts digest: 149 #pkts decaps: 146, #pkts decrypt: 146, #pkts verify: 146 #pkts compressed: 0, #pkts decompressed: 0 #pkts not compressed: 0, #pkts compr. failed: 0 #pkts not decompressed: 0, #pkts decompress failed: 0 #send errors 0, #recv errors 0 local crypto endpt.: 174.78.144.73, remote crypto endpt.:205.251.233.121 path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet0 current outbound spi: 0xB8357C22(3090512930) inbound esp sas: spi: 0x6ADB173(112046451) transform: esp-aes esp-sha-hmac , in use settings ={Tunnel, } conn id: 1, flow_id: Motorola SEC 2.0:1, crypto map: Tunnel1-head-0 sa timing: remaining key lifetime (k/sec): (4467148/3189) IV size: 16 bytes replay detection support: Y replay window size: 128 Status: ACTIVE inbound ah sas: inbound pcp sas: outbound esp sas: spi: 0xB8357C22(3090512930) transform: esp-aes esp-sha-hmac , in use settings ={Tunnel, } conn id: 2, flow_id: Motorola SEC 2.0:2, crypto map: Tunnel1-head-0 sa timing: remaining key lifetime (k/sec): (4467148/3189) IV size: 16 bytes replay detection support: Y replay window size: 128 Status: ACTIVE outbound ah sas: outbound pcp sas: interface: Tunnel2 Crypto map tag: Tunnel2-head-0, local addr 205.251.233.122 protected vrf: (none) local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0) remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0) current_peer 72.21.209.193 port 500 PERMIT, flags={origin_is_acl,} #pkts encaps: 26, #pkts encrypt: 26, #pkts digest: 26 #pkts decaps: 24, #pkts decrypt: 24, #pkts verify: 24 #pkts compressed: 0, #pkts decompressed: 0 #pkts not compressed: 0, #pkts compr. failed: 0 #pkts not decompressed: 0, #pkts decompress failed: 0 #send errors 0, #recv errors 0 local crypto endpt.: 174.78.144.73, remote crypto endpt.:205.251.233.122 path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet0 current outbound spi: 0xF59A3FF6(4120526838) inbound esp sas: spi: 0xB6720137(3060924727) transform: esp-aes esp-sha-hmac , in use settings ={Tunnel, } conn id: 3, flow_id: Motorola SEC 2.0:3, crypto map: Tunnel2-head-0 sa timing: remaining key lifetime (k/sec): (4387273/3492) IV size: 16 bytes replay detection support: Y replay window size: 128 Status: ACTIVE inbound ah sas: inbound pcp sas: outbound esp sas: spi: 0xF59A3FF6(4120526838) transform: esp-aes esp-sha-hmac , in use settings ={Tunnel, } conn id: 4, flow_id: Motorola SEC 2.0:4, crypto map: Tunnel2-head-0 sa timing: remaining key lifetime (k/sec): (4387273/3492) IV size: 16 bytes replay detection support: Y replay window size: 128 Status: ACTIVE outbound ah sas: outbound pcp sas: ``` 對於每個通道界面，您應該都會同時看到 inbound `esp sas` 和 outbound `esp sas`。這假設列出 SA (例如，`spi: 0x48B456A6`)，狀態為 `ACTIVE`，而且 IPsec 設定正確。 如需進一步故障診斷，請使用下列命令啟用除錯。 ``` router# debug crypto ipsec ``` 使用下列命令停用除錯。 ``` router# no debug crypto ipsec ``` ## 通道 首先，請檢查您有沒有必要的防火牆規則。如需詳細資訊，請參閱[AWS Site-to-Site VPN 客戶閘道裝置的防火牆規則](FirewallRules.md)。 如果您的防火牆規則設定正確，則繼續使用下列命令來進行故障診斷。 ``` router# show interfaces tun1 ``` ``` Tunnel1 is up, line protocol is up Hardware is Tunnel Internet address is 169.254.249.18/30 MTU 17867 bytes, BW 100 Kbit/sec, DLY 50000 usec, reliability 255/255, txload 2/255, rxload 1/255 Encapsulation TUNNEL, loopback not set Keepalive not set Tunnel source 174.78.144.73, destination 205.251.233.121 Tunnel protocol/transport IPSEC/IP Tunnel TTL 255 Tunnel transport MTU 1427 bytes Tunnel transmit bandwidth 8000 (kbps) Tunnel receive bandwidth 8000 (kbps) Tunnel protection via IPSec (profile "ipsec-vpn-92df3bfb-0") Last input never, output never, output hang never Last clearing of "show interface" counters never Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: fifo Output queue: 0/0 (size/max) 5 minute input rate 0 bits/sec, 1 packets/sec 5 minute output rate 1000 bits/sec, 1 packets/sec 407 packets input, 30010 bytes, 0 no buffer Received 0 broadcasts, 0 runts, 0 giants, 0 throttles ``` 確定線路通訊協定已啟動。分別針對通道來源 IP 地址、來源界面和目標，檢查其是否與 IP 地址外客戶閘道裝置、界面和 IP 地址外虛擬私有閘道的通道組態相符。確定 `Tunnel protection through IPSec` 已存在。於這兩個通道界面上執行此命令。若要解決任何問題，請檢閱組態，並檢查與客戶閘道裝置的實體連接。 您也可以使用下列命令，將 `169.254.249.18` 換成虛擬私有閘道的內部 IP 地址。 ``` router# ping {{169.254.249.18}} df-bit size 1410 ``` ``` Type escape sequence to abort. Sending 5, 1410-byte ICMP Echos to 169.254.249.18, timeout is 2 seconds: Packet sent with the DF bit set !!!!! ``` 您應該會看見五個驚嘆號。 ### 路由 若要查看您的靜態路由表，請使用下列命令。 ``` router# sh ip route static ``` ``` 1.0.0.0/8 is variably subnetted S 10.0.0.0/16 is directly connected, Tunnel1 is directly connected, Tunnel2 ``` 您應可透過現有的兩個通道看到 VPC CIDR 的靜態路由。它若不存在，請如下所示新增靜態路由。 ``` router# ip route 10.0.0.0 255.255.0.0 Tunnel1 track 100 router# ip route 10.0.0.0 255.255.0.0 Tunnel2 track 200 ``` ### 檢查 SLA 監控 ``` router# show ip sla statistics 100 ``` ``` IPSLAs Latest Operation Statistics IPSLA operation id: 100 Latest RTT: 128 milliseconds Latest operation start time: *18:08:02.155 UTC Wed Jul 15 2012 Latest operation return code: OK Number of successes: 3 Number of failures: 0 Operation time to live: Forever ``` ``` router# show ip sla statistics 200 ``` ``` IPSLAs Latest Operation Statistics IPSLA operation id: 200 Latest RTT: 128 milliseconds Latest operation start time: *18:08:02.155 UTC Wed Jul 15 2012 Latest operation return code: OK Number of successes: 3 Number of failures: 0 Operation time to live: Forever ``` `Number of successes` 的值表示是否已順利設定 SLA 監控。 如需進一步故障診斷，請檢閱組態。