案例说明

172.19.101.0/24 -- | 172.19.101.216 | === | x.x.x.x | -- 172.31.0.1
  服务器网段            服务器地址             Client        virtual IP

Server状态

[root@cyrilcao ~]# swanctl -l
aircraft: #13, ESTABLISHED, IKEv2, 97a8aff3e617a82b_i 9013e260d471472d_r*
  local  '101.133.141.237' @ 172.19.101.216[4500]
  remote '81.68.119.92' @ 81.68.119.92[4500] [172.31.0.1]
  AES_CBC-256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048
  established 389s ago, rekeying in 13414s
  ra-sa: #1, reqid 1, INSTALLED, TUNNEL-in-UDP, ESP:AES_CBC-256/HMAC_SHA1_96
    installed 389s ago, rekeying in 6448s, expires in 7531s
    in  c6c07c84,   1092 bytes,    13 packets,   106s ago
    out c28b5740,   1092 bytes,    13 packets,   106s ago
    local  172.19.101.0/24
    remote 172.31.0.1/32
    

[root@cyrilcao ~]# swanctl -L
aircraft: IKEv2, no reauthentication, rekeying every 14400s, dpd delay 30s
  local:  172.19.101.216
  remote: %any
  local pre-shared key authentication:
    id: 101.133.141.237
  remote pre-shared key authentication:
    id: 81.68.119.92
  ra-sa: TUNNEL, rekeying every 7200s, dpd action is clear
    local:  172.19.101.0/24
    remote: dynamic


[root@cyrilcao ~]# ip route show table 220
172.31.0.1 via 172.19.111.253 dev eth0 proto static src 172.19.101.216

[root@cyrilcao ~]# ping 172.31.0.1
PING 172.31.0.1 (172.31.0.1) 56(84) bytes of data.
64 bytes from 172.31.0.1: icmp_seq=1 ttl=64 time=6.49 ms
64 bytes from 172.31.0.1: icmp_seq=2 ttl=64 time=6.52 ms

Client状态

[root@VM-4-13-centos ~]# swanctl -l
home: #12, ESTABLISHED, IKEv2, 97a8aff3e617a82b_i* 9013e260d471472d_r
  local  '81.68.119.92' @ 10.0.4.13[4500] [172.31.0.1]
  remote '101.133.141.237' @ 101.133.141.237[4500]
  AES_CBC-256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048
  established 1070s ago, rekeying in 13257s
  home: #1, reqid 1, INSTALLED, TUNNEL-in-UDP, ESP:AES_CBC-256/HMAC_SHA1_96
    installed 1070s ago, rekeying in 5942s, expires in 6850s
    in  c28b5740,   1260 bytes,    15 packets,   206s ago
    out c6c07c84,   1260 bytes,    15 packets,   206s ago
    local  172.31.0.1/32
    remote 172.19.101.0/24

[root@VM-4-13-centos ~]# swanctl -L
home: IKEv2, no reauthentication, rekeying every 14400s, dpd delay 30s
  local:  10.0.4.13
  remote: 101.133.141.237
  local pre-shared key authentication:
    id: 81.68.119.92
  remote pre-shared key authentication:
    id: 101.133.141.237
  home: TUNNEL, rekeying every 7200s, dpd action is clear
    local:  dynamic
    remote: 172.19.101.0/24
    
[root@VM-4-13-centos ~]# ip route show table 220
172.19.101.0/24 via 10.0.4.1 dev eth0 proto static src 172.31.0.1

[root@VM-4-13-centos ~]# ping 172.19.101.216
PING 172.19.101.216 (172.19.101.216) 56(84) bytes of data.
64 bytes from 172.19.101.216: icmp_seq=1 ttl=64 time=6.48 ms
64 bytes from 172.19.101.216: icmp_seq=2 ttl=64 time=6.56 ms
64 bytes from 172.19.101.216: icmp_seq=3 ttl=64 time=6.55 ms

该本文由 cyrilcao 创作或转载，
采用 知识共享署名 3.0，可自由转载、引用，但需署名作者且注明文章出处。