一、组网需求

如图所示，通过IPsec VPN（接口模式）将2个局域网连接起来，实现192.168.17.0/24与192.168.21.0/24两个网段的通信。  与Huawei（华为）防火墙进行IPsec VPN对接。

二、网络拓扑

   

三、配置要点

1、配置FortiGate防火墙

    1）基本上网配置

    2）配置IPsec VPN

2、配置Huawei（华为）防火墙

    1）基本上网配置

    2）配置IPsec VPN

说明：如果要删除IPSEC VPN第一阶段、第二阶段时，需要先删除被调用的路由与防火墙安全策略。

四、配置步骤

     1、配置FortiGate

     1) 基本上网配置

     


 
     
     
     

     2) 配置IPsec VPN

     进入：虚拟专网--IPSEC隧道--"新建"

    

     选择IPsec VPN自定义模板进行配置：

   

   IPsec 第一阶段配置：

   

   IPsec 第二阶段配置：

   

GUI配置所对应的命令行：

config vpn ipsec phase1-interface
    edit "to-branch"
        set interface "port2"
        set peertype any
        set net-device disable
        set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1
        set dpd on-idle
        set remote-gw 101.100.1.21
        set psksecret Fortinet123#
    next
end
config vpn ipsec phase2-interface
    edit "to-branch"
        set phase1name "to-branch"
        set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256
        set auto-negotiate enable
        set src-subnet 192.168.17.0 255.255.255.0      
        set dst-subnet 192.168.21.0 255.255.255.0
    next
end
// 不像和Cisco/PA/Juniper/山石，感兴趣流是全0，国内防火墙的主流都是明细感兴趣流的。Huawei（华为）通常都是写明细的感兴趣流，一种比较老的实现方式。（类似于fgt的策略模式VPN）

      3) 配置VPN相关的策略
      
     
     
     
    命令行：
    配置防火墙策略：

config firewall policy
    edit 1
        set name "TO-Internet-Policy"  // 内网用户上互联网的策略
        set srcintf "port1"
        set dstintf "port2"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
        set logtraffic all
        set logtraffic-start enable
        set nat enable
    next
    edit 2
        set name "vpn-to-branch-out"   // VPN out方向策略
        set srcintf "port1"
        set dstintf "to-branch"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
        set logtraffic all
        set logtraffic-start enable
    next
    edit 3
        set name "vpn-to-branch-in"   // VPN in方向策略
        set srcintf "to-branch"
        set dstintf "port1"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
        set logtraffic all
        set logtraffic-start enable
    next
end

    4）配置VPN业务网段的静态路由

    

    

    

     命令行：

config router static
    edit 1
        set gateway 202.100.1.192
        set device "port2"
    next
    edit 2
        set dst 192.168.21.0 255.255.255.0
        set device "to-branch"
    next
    edit 3
        set dst 192.168.21.0 255.255.255.0
        set distance 254
        set blackhole enable
    next
end

说明：相关VPN的路由配置中“黑洞路由的意义”：

你可能会遇到以下的VPN业务问题：通过VPN的SIP电话，时不时中断，无法向服务器成功注册 ？通过VPN的Radius认证无法经常会无法认证成功？ 通过VPN的AP注册到总部时不时会中断？持续的PRGT监控ping总部的服务器，时不时会显示中断？

VPN有时候会因为各种原因重新连接，比如互联网不稳定，PPPOE重新连接更换公网IP地址等，VPN tunnel此时会出现短暂的DOWN，而去往对方的VPN业务网段的路由也会短暂消失，此时VPN的业务流量（SIP注册请求/Radius/Capwap/ICMP）会因为查询到了默认路由而走向了  WAN1（Internet），从而产生了错误的UDP-NAT-Seesion，此时即便VPN tunnel再次UP，VPN业务网段的路由再次恢复，SIP等VPN旧的业务流量依旧会走到错误的Session上去，从而引起该业务异常。

排查思路：通过diagnose sniffer Huawei（华为） “port 5060”4 以及查看session （diagnose sys session list）去判断问题。
解决此类问题的办法有三种：
办法一：配置去往VPN业务网段的“黑洞路由”，管理距离为254，VPN正常的情况下此黑洞路由不生效，而当VPN中断的时候，黑洞路由浮起来并且生效，将VPN中断时候的VPN流量丢弃，避免将流量转发到互联网而产生错误的session。// 配置VPN的备份黑洞路由的意义在此。
办法二：配置源接口：LAN，目的接口：WAN1，源IP：本地内网网段，目的IP：对端内网网段，动作：丢包的策略。将此去往Internet的私网（无用的）流量丢弃掉，避免FGT产生这种错误的session，从而避免了UDP业务时不时中断的问题。
办法三：在全局下开启“set snat-route-change enable”，一旦路由发生变化，将相关的会话flag置位为“Dirty”，清除路由缓存并重新查找目的IP的下一跳地址，这样VPN隧道恢复的时候，流量也会相应的切换到VPN隧道里面来。
FGT # config system global
FGT (global) # set snat-route-change enable
FGT (global) # end 
三种方式任意选择一种即可。推荐使用黑洞路由方式。

----FortiGate的配置全部完成----   

  2、配置Huawei（华为）防火墙

   1) 基本上网配置

 

  默认路由：
  
  
#IP和路由部分#
#
interface GigabitEthernet0/0/0
undo shutdown
ip binding vpn-instance default
ip address 192.168.0.1 255.255.255.0
service-manage http permit
service-manage https permit
service-manage ping permit
service-manage ssh permit
service-manage snmp permit
service-manage telnet permit
service-manage netconf permit
#
interface GigabitEthernet1/0/0
undo shutdown
ip address 192.168.21.1 255.255.255.0
#
interface GigabitEthernet1/0/1
undo shutdown
ip address 101.100.1.21 255.255.255.0
service-manage http permit
service-manage https permit
service-manage ping permit
service-manage ssh permit
service-manage telnet permit
#
#
firewall zone trust
set priority 85
add interface GigabitEthernet0/0/0
add interface GigabitEthernet1/0/0
#
firewall zone untrust
set priority 5
add interface GigabitEthernet1/0/1
#
#
ip route-static 0.0.0.0 0.0.0.0 GigabitEthernet1/0/1 101.100.1.192
#

#网管部分#
 manager-user admin
  password Fortinet123#
  service-type web terminal telnet ssh
  level 15
  authentication-scheme admin_local

#

[USG6000V2]display ip routing-table
Route Flags: R - relay, D - download to fib
------------------------------------------------------------------------------
Routing Tables: Public
         Destinations : 7        Routes : 7

Destination/Mask    Proto   Pre  Cost      Flags NextHop         Interface

   0.0.0.0/0   Static  60   0           D   101.100.1.192   GigabitEthernet1/0/1
  101.100.1.0/24  Direct  0    0           D   101.100.1.21    GigabitEthernet1/0/1
   101.100.1.21/32  Direct  0    0           D   127.0.0.1       GigabitEthernet1/0/1
  127.0.0.0/8   Direct  0    0           D   127.0.0.1       InLoopBack0
  127.0.0.1/32  Direct  0    0           D   127.0.0.1       InLoopBack0
   192.168.21.0/24  Direct  0    0           D   192.168.21.1    GigabitEthernet1/0/0
   192.168.21.1/32  Direct  0    0           D   127.0.0.1       GigabitEthernet1/0/0

  策略：  
  
  

  NAT：
  
#
ip address-set Local_IP_Net_192.168.21.0/24 type object
address 0 192.168.21.0 mask 24
#
ip address-set Reomte_IP_Net_192.168.17.0/24 type object
address 0 192.168.17.0 mask 24
#
security-policy
default action permit
default policy logging
default session logging
rule name To_Internet_Policy
  policy logging
  session logging
  source-zone trust
  destination-zone untrust
  source-address address-set Local_IP_Net_192.168.21.0/24
  action permit
#
nat-policy
rule name GuideNat1591101288020
  source-zone trust
  egress-interface GigabitEthernet1/0/1
  action nat easy-ip
#

  以上配置可以实现内网PC上网正常。
  

 2) Huawei（华为）防火墙IPsec VPN的配置
  新建IPsec VPN策略
  
  
  
#
ike proposal 1
encryption-algorithm aes-256
dh group5
authentication-algorithm sha2-256
authentication-method pre-share
integrity-algorithm hmac-sha2-256
prf hmac-sha2-256
#
ike peer ike3616258621
pre-shared-key Fortinet123#
ike-proposal 1
local-id 101.100.1.21
remote-address 202.100.1.17
#
#
acl number 3000
rule 5 permit ip source 192.168.21.0 0.0.0.255 destination 192.168.17.0 0.0.0.255
#
ipsec proposal prop3616258621
esp authentication-algorithm sha2-256
esp encryption-algorithm aes-256
#
ipsec policy ipsec3616258986 1 isakmp
security acl 3000
pfs dh-group5
ike-peer ike3616258621
proposal prop3616258621
tunnel local applied-interface
alias to-fgt
sa duration time-based 43200
#
#
ike dpd type periodic
ike dpd idle-time 10
ike dpd retransmit-interval 5
#
interface GigabitEthernet1/0/1
ipsec policy ipsec3616258986
#

 IPsec VPN的策略配置：

需要移动到所有策略的最前面：

其实如果华为防火墙默认有一条默认的any到any全通的策略，默认的情况下这种IPsec VPN的流量是允许通过的，添加明细的策略可以进行精细化的管控。
#
security-policy
default action permit
default policy logging
default session logging

rule name to_fgt_vpn_out
  policy logging
  session logging
  source-zone trust
  destination-zone untrust
  source-address address-set Local_IP_Net_192.168.21.0/24
  destination-address address-set Reomte_IP_Net_192.168.17.0/24
  action permit

rule name to_fgt_vpn_in
  policy logging
  session logging
  source-zone untrust
  destination-zone trust
  source-address address-set Reomte_IP_Net_192.168.17.0/24
  destination-address address-set Local_IP_Net_192.168.21.0/24
  action permit

rule name To_Internet_Policy
  policy logging
  session logging
  source-zone trust
  destination-zone untrust
  source-address address-set Local_IP_Net_192.168.21.0/24
  action permit
#

  VPN的路由不需要的，Huawei（华为）并不产生VPN隧道接口，以及相应的VPN路由，因此不需要配置VPN的路由。
  上述配置完毕其实可以看到IPsec VPN已经可以协商成功了：
  
  
  但是此时你会发现业务是不通的：
  
  具体原因是什么呢？需要新增一个什么样的配置才可以让VPN的业务正常可通呢？
  原因是：Huawei（华为）防火墙是先SNAT，然后再IPsec VPN的，也就是说，如果按照我们之前配置的SNAT规则，VPN的流量192.168.21.100去访问192.168.17.100的流量会被SNAT成公网IP101.100.1.21到192.168.17.100，然后再进入到IPsec VPN流程，这个时候是无法匹配 感兴趣流的，因此流量将无法成功送到VPN隧道里面去。
 
 解决办法也很简单，就是再配置一个VPN流量bypass的SNAT规则，让VPN流量不做SNAT转换，然后将其放置到最前面，优先匹配即可。具体配置如下：
 
 
 最终效果如下：
 

#
nat-policy
rule name bypass_vpn_flow
  description bypass_vpn_flow
  source-zone trust
  destination-zone untrust
  source-address address-set Local_IP_Net_192.168.21.0/24
  destination-address address-set Reomte_IP_Net_192.168.17.0/24
  action no-nat
rule name GuideNat1591101288020
  source-zone trust
  egress-interface GigabitEthernet1/0/1
  action nat easy-ip
#

----Huawei（华为）防火墙的配置全部完成----

五、检查配置结果
    VPN状态查看：
    FGT的VPN状态查看：
    查看VPN监视器，观察状态： 进入"监视器"--"IPsec监测"
    
   路由状态查看：
   
命令行查看FGT状态：
FGVM04TM19005798 # get vpn ike gateway to-branch

vd: root/0
name: to-branch
version: 1
interface: port2 6
addr: 202.100.1.17:500 -> 101.100.1.21:500
created: 86547s ago
IKE SA  created: 1/2  established: 1/2  time: 480/480/480 ms
IPsec SA  created: 1/179  established: 1/3  time: 310/316/330 ms

  id/spi: 26411 b03db743c2827a76/5c073fe3c9d12358
  direction: initiator
  status: established 447-447s ago = 480ms
  proposal: aes-256-sha256
  key: 363eecef222915d7-442be5ef972ad222-38b82e08c1b0faf6-b198a87995d9c6ba
  lifetime/rekey: 86400/85652
  DPD sent/recv: 00000000/00000000

FGVM04TM19005798 # get vpn ipsec tunnel name to-branch

gateway
  name: 'to-branch'
  type: route-based
  local-gateway: 202.100.1.17:0 (static)
  remote-gateway: 101.100.1.21:0 (static)
  mode: ike-v1
  interface: 'port2' (6)
  rx  packets: 163715  bytes: 20300660  errors: 0
  tx  packets: 163848  bytes: 9830880  errors: 1681
  dpd: on-idle/negotiated  idle: 20000ms  retry: 3  count: 0
  selectors
    name: 'to-branch'
    auto-negotiate: enable
    mode: tunnel
    src: 0:192.168.17.0/255.255.255.0:0
    dst: 0:192.168.21.0/255.255.255.0:0
    SA
      lifetime/rekey: 43200/42401  
      mtu: 1438
      tx-esp-seq: 1ec
      replay: disabled
      qat: 0
      inbound
        spi: b00e5527
        enc:  aes-cb  2150c2647c6fcbb092f57dbbf4ce581386c083c41017ce17e2c56bf502f7ab68
        auth: sha256  13f77c8fa0795214f0f459ec918a552f5bb42a1af10cca29a6064824d5300e91
      outbound
        spi: 70c275f2
        enc:  aes-cb  cd0e173534a616e3a96fe55b5f089631776751b32eaf8a81149f58e83df5ed8c
        auth: sha256  d73ce348bfec3c4c2694f4cd734ce97ee8d156cd8c8f7593de733eb0a6454ba5


FGVM04TM19005798 # diagnose vpn ike gateway  list

vd: root/0
name: to-branch
version: 1
interface: port2 6
addr: 202.100.1.17:500 -> 101.100.1.21:500
created: 86585s ago
IKE SA: created 1/2  established 1/2  time 480/480/480 ms
IPsec SA: created 1/179  established 1/3  time 310/316/330 ms

  id/spi: 26411 b03db743c2827a76/5c073fe3c9d12358
  direction: initiator
  status: established 485-484s ago = 480ms
  proposal: aes256-sha256
  key: 363eecef222915d7-442be5ef972ad222-38b82e08c1b0faf6-b198a87995d9c6ba
  lifetime/rekey: 86400/85615
  DPD sent/recv: 00000000/00000000

FGVM04TM19005798 # diagnose vpn tunnel list
list all ipsec tunnel in vd 0
------------------------------------------------------
name=to-branch ver=1 serial=5 202.100.1.17:0->101.100.1.21:0 dst_mtu=1500
bound_if=6 lgwy=static/1 tun=intf/0 mode=auto/1 encap=none/512 options[0200]=frag-rfc  run_state=0 accept_traffic=1

proxyid_num=1 child_num=0 refcnt=15 ilast=0 olast=0 ad=/0
stat: rxp=163760 txp=163893 rxb=20306240 txb=9833580
dpd: mode=on-idle on=1 idle=20000ms retry=3 count=0 seqno=192
natt: mode=none draft=0 interval=0 remote_port=0
proxyid=to-branch proto=0 sa=1 ref=3 serial=13 auto-negotiate
  src: 0:192.168.17.0/255.255.255.0:0
  dst: 0:192.168.21.0/255.255.255.0:0
  SA:  ref=3 options=18225 type=00 soft=0 mtu=1438 expire=42355/0B replaywin=0
       seqno=219 esn=0 replaywin_lastseq=00000000 itn=0 qat=0
  life: type=01 bytes=0/0 timeout=42901/43200
  dec: spi=b00e5527 esp=aes key=32 2150c2647c6fcbb092f57dbbf4ce581386c083c41017ce17e2c56bf502f7ab68
       ah=sha256 key=32 13f77c8fa0795214f0f459ec918a552f5bb42a1af10cca29a6064824d5300e91
  enc: spi=70c275f2 esp=aes key=32 cd0e173534a616e3a96fe55b5f089631776751b32eaf8a81149f58e83df5ed8c
       ah=sha256 key=32 d73ce348bfec3c4c2694f4cd734ce97ee8d156cd8c8f7593de733eb0a6454ba5
  dec:pkts/bytes=533/31980, enc:pkts/bytes=536/66464
run_tally=1


FGVM04TM19005798 # get router info routing-table  all


Routing table for VRF=0
Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
       O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
       * - candidate default

S*      0.0.0.0/0 [10/0] via 202.100.1.192, port2
C       192.168.17.0/24 is directly connected, port1
S       192.168.21.0/24 [10/0] is directly connected, to-branch
C       192.168.91.0/24 is directly connected, port4
C       202.100.1.0/24 is directly connected, port2

FGT IKE debug 命令：
首先，sniffer抓包确认UDP 500/4500 双方通信是否正常       
diagnose sniffer packet any "host 101.100.1.21 and  ( port 500 or port 4500)" 4  //IP换成对方公网IP                                                               
UDP 500 或 UDP 4500 这两个端口是IPsec VPN协商协议IKE会使用的端口，一定要互通要通畅，否则VPN无法正常建立，确认互通正常在进行下一步定位
                                                                                  
然后，通过日志，debug app ike 确认问题是出在第一阶段还是第二阶段                                                                       
diagnose vpn ike log-filter dst-addr4 101.100.1.21  //IP换成对方公网IP                                                                
diagnose debug  application ike -1                                                               
diagnose debug  enable                                                                        
debug具体可参考IPsec VPN排错部分内容。

FortiGate侧业务测试：
FGVM04TM19005798 # execute ping-options source 192.168.17.1  // 在FGT测试IPsec-VPN的业务流量是否可通，需要携带源IP，由于VPN tunnel没有配置IP，必须携带源IP进行业务测试。

FGVM04TM19005798 # execute ping 192.168.21.1
PING 192.168.21.1 (192.168.21.1): 56 data bytes
64 bytes from 192.168.21.1: icmp_seq=0 ttl=255 time=77.6 ms
64 bytes from 192.168.21.1: icmp_seq=1 ttl=255 time=77.3 ms
64 bytes from 192.168.21.1: icmp_seq=2 ttl=255 time=77.1 ms
64 bytes from 192.168.21.1: icmp_seq=3 ttl=255 time=77.2 ms
64 bytes from 192.168.21.1: icmp_seq=4 ttl=255 time=77.3 ms

--- 192.168.21.1 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max = 77.1/77.3/77.6 ms

FGVM04TM19005798 #
FGVM04TM19005798 # execute ping 192.168.21.100
PING 192.168.21.100 (192.168.21.100): 56 data bytes
64 bytes from 192.168.21.100: icmp_seq=0 ttl=127 time=77.9 ms
64 bytes from 192.168.21.100: icmp_seq=1 ttl=127 time=77.4 ms
64 bytes from 192.168.21.100: icmp_seq=2 ttl=127 time=77.4 ms
64 bytes from 192.168.21.100: icmp_seq=3 ttl=127 time=79.2 ms
64 bytes from 192.168.21.100: icmp_seq=4 ttl=127 time=77.4 ms

--- 192.168.21.100 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max = 77.4/77.8/79.2 ms

FGVM04TM19005798 #

Huawei（华为）防火墙VPN业务状态：

Huawei（华为）防火墙VPN状态命令行状态查询：

[USG6000V2]display ike  sa verbose remote 202.100.1.17

Ike sa verbose information :
------------------------------------------------
Ike Sa phase   : 2
Establish Time : 2020-06-04 16:25:42
PortCfg Index  : 0x7
IKE Peer Name  : ike3616258621
Connection Id  : 16777397
Version        : v1
Flow VPN       :
Peer VPN       :
------------------------------------------------
Intiator Cookie         : 0xa69b873a87d304fe
Responder Cookie        : 0x6ad37be0793cdf52
Local Address           : 101.100.1.21
Remote Address          : 202.100.1.17
Encryption Algorithm    : AES-256
Authentication Algorithm: SHA2-256
Authentication Method   : Pre-Shared key
Flags                   : RD|A
------------------------------------------------

------------------------------------------------
Ike Sa phase   : 1
Establish Time : 2020-06-04 16:26:18
PortCfg Index  : 0x7
IKE Peer Name  : ike3616258621
Connection Id  : 16777398
Version        : v1
Flow VPN       :
Peer VPN       :
------------------------------------------------
Intiator Cookie         : 0x43b73db0767a82c2
Responder Cookie        : 0xe33f075c5823d1c9
Local Address           : 101.100.1.21
Remote Address          : 202.100.1.17
Encryption Algorithm    : AES-256
Authentication Algorithm: SHA2-256
Authentication Method   : Pre-Shared key
Remaining Duration      : 85575
Reference Counter       : 0
Flags                   : RD|A
------------------------------------------------

  Number of SA entries  : 2

  Number of SA entries of all cpu : 2

  Flag Description:
  RD--READY   ST--STAYALIVE   RL--REPLACED   FD--FADING   TO--TIMEOUT
  HRT--HEARTBEAT   LKG--LAST KNOWN GOOD SEQ NO.   BCK--BACKED UP
  M--ACTIVE   S--STANDBY   A--ALONE  NEG--NEGOTIATING

[USG6000V2]
[USG6000V2]display ipsec sa  remote  202.100.1.17

ipsec sa information:

===============================
Interface: GigabitEthernet1/0/1
===============================

  -----------------------------
  IPSec policy name: "ipsec3616258986"
  Sequence number  : 1
  Acl group        : 3000
  Acl rule         : 5
  Mode             : ISAKMP
  -----------------------------
    Connection ID     : 16777397
    Encapsulation mode: Tunnel
    Tunnel local      : 101.100.1.21
    Tunnel remote     : 202.100.1.17
    Flow source       : 192.168.21.0/255.255.255.0 0/0
    Flow destination  : 192.168.17.0/255.255.255.0 0/0

    [Outbound ESP SAs]
      SPI: 2953729319 (0xb00e5527)
      Proposal: ESP-ENCRYPT-AES-256 SHA2-256-128
      SA remaining key duration (kilobytes/sec): 0/42297
      Max sent sequence-number: 896
      UDP encapsulation used for NAT traversal: N
      SA encrypted packets (number/kilobytes): 895/52

    [Inbound ESP SAs]
      SPI: 1891792370 (0x70c275f2)
      Proposal: ESP-ENCRYPT-AES-256 SHA2-256-128
      SA remaining key duration (kilobytes/sec): 0/42297
      Max received sequence-number: 899
      UDP encapsulation used for NAT traversal: N
      SA decrypted packets (number/kilobytes): 898/52
      Anti-replay : Enable
      Anti-replay window size: 1024
[USG6000V2]


Huawei（华为） IPsec VPN排错指南链接:
https://support.huawei.com/enterprise/zh/doc/EDOC1000154804/6b793ff8

Huawei（华为）防火墙侧业务测试（VPN业务测试同样需要携带源IP进行ping的业务测试）：
[USG6000V2]ping  -a 192.168.21.1 192.168.17.1
  PING 192.168.17.1: 56  data bytes, press CTRL_C to break
    Reply from 192.168.17.1: bytes=56 Sequence=1 ttl=255 time=78 ms
    Reply from 192.168.17.1: bytes=56 Sequence=2 ttl=255 time=77 ms
    Reply from 192.168.17.1: bytes=56 Sequence=3 ttl=255 time=77 ms
    Reply from 192.168.17.1: bytes=56 Sequence=4 ttl=255 time=78 ms
    Reply from 192.168.17.1: bytes=56 Sequence=5 ttl=255 time=78 ms

  --- 192.168.17.1 ping statistics ---
    5 packet(s) transmitted
    5 packet(s) received
    0.00% packet loss
    round-trip min/avg/max = 77/77/78 ms

[USG6000V2]
[USG6000V2]ping  -a 192.168.21.1 192.168.17.100
  PING 192.168.17.100: 56  data bytes, press CTRL_C to break
    Reply from 192.168.17.100: bytes=56 Sequence=1 ttl=127 time=78 ms
    Reply from 192.168.17.100: bytes=56 Sequence=2 ttl=127 time=78 ms
    Reply from 192.168.17.100: bytes=56 Sequence=3 ttl=127 time=78 ms
    Reply from 192.168.17.100: bytes=56 Sequence=4 ttl=127 time=77 ms
    Reply from 192.168.17.100: bytes=56 Sequence=5 ttl=127 time=78 ms

  --- 192.168.17.100 ping statistics ---
    5 packet(s) transmitted
    5 packet(s) received
    0.00% packet loss
    round-trip min/avg/max = 77/77/78 ms

[USG6000V2]


FGT侧的192.168.17.100去访问Huawei（华为）侧的192.168.21.100过程：
 

抓包：
FGVM04TM19005798 # dia sni pa any "host 192.168.21.100 or host 101.100.1.21" 4 0 l
interfaces=[any]
2020-06-04 16:40:17.037032 port2 in 101.100.1.21 -> 202.100.1.17: ESP(spi=0xb00e5527,seq=0x4d3)
2020-06-04 16:40:17.037062 to-branch in 192.168.21.100 -> 192.168.17.100: icmp: echo request
2020-06-04 16:40:17.037087 port1 out 192.168.21.100 -> 192.168.17.100: icmp: echo request

2020-06-04 16:40:17.037348 port1 in 192.168.17.100 -> 192.168.21.100: icmp: echo reply
2020-06-04 16:40:17.037365 to-branch out 192.168.17.100 -> 192.168.21.100: icmp: echo reply
2020-06-04 16:40:17.037389 port2 out 202.100.1.17 -> 101.100.1.21: ESP(spi=0x70c275f2,seq=0x4d6)

一次ping的sniffer完整过程。

说明：关于sniffer抓VPN业务和ESP的包
抓取IPsec VPN的IKE协商包：
diagnose sniffer packet any "host 101.100.1.21 and (port 500 or port 4500)" 4

抓取IPsec VPN的ESP加密数据包：
diagnose sniffer packet any "host 101.100.1.21 and esp" 4

抓取IPsec VPN的明文业务数据包：
diagnose sniffer packet any "host 192.168.21.100 and icmp" 4

注意：由于存在IPsec VPN芯片加速，因此可能数据包会抓不完全，主要指“ESP数据和明文业务数据”抓不全，因此有时候需要将VPN隧道的NP加速关闭：
FortiGate1_BeiJing # config vpn ipsec phase1-interface        
FortiGate1_BeiJing (phase1-interface) # edit VPN                  
FortiGate1_BeiJing (BJ-OSPF-TO-SH) # set npu-offload disable                                                                        
FortiGate1_BeiJing (BJ-OSPF-TO-SH) # end
这个部分具体可以查看IPsec VPN排错的内容。

FGT/Huawei（华为）设备上会话状态查询：