Amazon Virtual Private Cloud
网络管理员指南
AWS 服务或AWS文档中描述的功能,可能因地区/位置而异。点 击 Getting Started with Amazon AWS to see specific differences applicable to the China (Beijing) Region.

排查 Yamaha 客户网关连接性问题

排查 Yamaha 客户网关连接性问题时,您需要考虑四个方面:IKE、IPsec、隧道和 BGP。您可以按任何次序对这些方面进行故障排除,不过我们建议您从 IKE 开始 (位于网络堆栈的底部) 并依次向上排除。

IKE

使用以下命令。响应显示带正确配置的 IKE 的客户网关。

Copy
# show ipsec sa gateway 1
sgw  flags local-id                      remote-id        # of sa
--------------------------------------------------------------------------
1    U K   YOUR_LOCAL_NETWORK_ADDRESS     72.21.209.225    i:2 s:1 r:1

您应该可以看到包含隧道中所指定远程网关的“remote-id”的行。您可以通过忽略隧道号,列出所有的安全关联 (SA)。

如需进一步排查问题,请运行下面的命令,启用可提供诊断信息的 DEBUG 级日志消息。

Copy
# syslog debug on # ipsec ike log message-info payload-info key-info

如需取消记录项,请使用下面的命令。

Copy
# no ipsec ike log # no syslog debug on

IPsec

使用以下命令。响应显示正确配置的 IPsec 的客户网关。

Copy
# show ipsec sa gateway 1 detail
SA[1] Duration: 10675s
Local ID: YOUR_LOCAL_NETWORK_ADDRESS
Remote ID: 72.21.209.225
Protocol: IKE
Algorithm: AES-CBC, SHA-1, MODP 1024bit

SPI: 6b ce fd 8a d5 30 9b 02 0c f3 87 52 4a 87 6e 77 
Key: ** ** ** ** **  (confidential)   ** ** ** ** **
----------------------------------------------------
SA[2] Duration: 1719s
Local ID: YOUR_LOCAL_NETWORK_ADDRESS
Remote ID: 72.21.209.225
Direction: send
Protocol: ESP (Mode: tunnel)
Algorithm: AES-CBC (for Auth.: HMAC-SHA)
SPI: a6 67 47 47 
Key: ** ** ** ** **  (confidential)   ** ** ** ** **
----------------------------------------------------
SA[3] Duration: 1719s
Local ID: YOUR_LOCAL_NETWORK_ADDRESS
Remote ID: 72.21.209.225
Direction: receive
Protocol: ESP (Mode: tunnel)
Algorithm: AES-CBC (for Auth.: HMAC-SHA)
SPI: 6b 98 69 2b 
Key: ** ** ** ** **  (confidential)   ** ** ** ** **
----------------------------------------------------
SA[4] Duration: 10681s
Local ID: YOUR_LOCAL_NETWORK_ADDRESS
Remote ID: 72.21.209.225
Protocol: IKE
Algorithm: AES-CBC, SHA-1, MODP 1024bit
SPI: e8 45 55 38 90 45 3f 67 a8 74 ca 71 ba bb 75 ee 
Key: ** ** ** ** **  (confidential)   ** ** ** ** **
----------------------------------------------------

对于每个隧道接口,您应该可以看到“receive sas”“send sas”

如需进一步排除故障,请使用下面的命令启用调试。

Copy
# syslog debug on # ipsec ike log message-info payload-info key-info

使用下面的命令禁用调试。

Copy
# no ipsec ike log # no syslog debug on

隧道

首先,检查必要的防火墙规则是否已布置到位。有关规则列表请查看 在 Internet 和客户网关之间配置防火墙

如果您的防火墙规则设置正确,则请使用下面的命令继续排除故障。

Copy
# show status tunnel 1
TUNNEL[1]: 
Description: 
  Interface type: IPsec
  Current status is Online.
  from 2011/08/15 18:19:45.
  5 hours 7 minutes 58 seconds  connection.
  Received:    (IPv4) 3933 packets [244941 octets]
               (IPv6) 0 packet [0 octet]
  Transmitted: (IPv4) 3933 packets [241407 octets]
               (IPv6) 0 packet [0 octet]

确保当前状态为联机。另外,请确保“接口类型”为 IPsec。确保在两个隧道接口上运行命令。如需在此解决任何问题,请核查配置。

BGP

使用以下命令。

Copy
# show status bgp neighbor
BGP neighbor is 169.254.255.1, remote AS 7224, local AS 65000, external link
  BGP version 0, remote router ID 0.0.0.0
  BGP state = Active
  Last read 00:00:00, hold time is 0, keepalive interval is 0 seconds
  Received 0 messages, 0 notifications, 0 in queue
  Sent 0 messages, 0 notifications, 0 in queue
  Connection established 0; dropped 0
  Last reset never
Local host: unspecified
Foreign host: 169.254.255.1, Foreign port: 0

BGP neighbor is 169.254.255.5, remote AS 7224, local AS 65000, external link
  BGP version 0, remote router ID 0.0.0.0
  BGP state = Active
  Last read 00:00:00, hold time is 0, keepalive interval is 0 seconds
  Received 0 messages, 0 notifications, 0 in queue
  Sent 0 messages, 0 notifications, 0 in queue
  Connection established 0; dropped 0
  Last reset never
Local host: unspecified
Foreign host: 169.254.255.5, Foreign port:

此处,两个邻系统均已列出。对于各个系统,您应该可以看到BGP 状态值为活动。

若 BGP 对等体已运行,请验证您的客户网关路由器正在向 VPC 通告默认路由 (0.0.0.0/0)。

Copy
# show status bgp neighbor 169.254.255.1 advertised-routes
Total routes: 1
*: valid route
  Network            Next Hop        Metric LocPrf Path
* default            0.0.0.0              0        IGP

另外,请确保您正在从虚拟专用网关接收对应于您的 VPC 的前缀。

Copy
# show ip route
Destination         Gateway          Interface       Kind  Additional Info.
default             ***.***.***.***   LAN3(DHCP)    static  
10.0.0.0/16         169.254.255.1    TUNNEL[1]       BGP  path=10124

如需进一步排查问题,请核查配置。

虚拟专用网关连接

确保您的虚拟专用网关已连接到 VPC。您的整合团队借助 AWS 管理控制台进行这项操作。

如果您有问题或需要进一步的协助,请使用 Amazon VPC forum