跳到內容
多雲網路

IPsec

CE 會向 F5 區域邊緣節點建立 IPsec 隧道。若隧道中斷，無論本地狀態看起來多健康，該站台都將與全球網路隔離。

ipsec-status

Section titled “ipsec-status”
Terminal window
{"command":["ipsec-status"]}
Security Associations (2 up, 0 connecting):
ver.ny8-nyc.ves-io.<uuid>.tenant.int.ves.io[8]: ESTABLISHED 70 minutes ago, 10.0.1.4[ver.mcn-ce-ha-eastus01.<tenant>.<uuid>.tenant.int.ves.io]...<public-ip>[ver.ny8-nyc.ves-io.<uuid>.tenant.int.ves.io]
ver.ny8-nyc.ves-io.<uuid>.tenant.int.ves.io{9}:  INSTALLED, TUNNEL, reqid 65542, ESP in UDP SPIs: ffff1700_i ffffce10_o
ver.ny8-nyc.ves-io.<uuid>.tenant.int.ves.io{9}:   10.0.1.4/32 === <public-ip>/32
ver.dc12-ash.ves-io.<uuid>.tenant.int.ves.io[7]: ESTABLISHED 70 minutes ago, 10.0.1.4[ver.mcn-ce-ha-eastus01.<tenant>.<uuid>.tenant.int.ves.io]...<public-ip>[ver.dc12-ash.ves-io.<uuid>.tenant.int.ves.io]
ver.dc12-ash.ves-io.<uuid>.tenant.int.ves.io{8}:  INSTALLED, TUNNEL, reqid 65541, ESP in UDP SPIs: ffff1160_i ffff1e70_o
ver.dc12-ash.ves-io.<uuid>.tenant.int.ves.io{8}:   10.0.1.4/32 === <public-ip>/32

第一行即為答案：Security Associations (2 up, 0 connecting)。任何處於 connecting 狀態的項目，代表該隧道正在嘗試連線但持續失敗。

每個 SA 都會標示其終止的區域邊緣節點名稱——ny8-nyc、dc12-ash 為 F5 POP 代碼——因此這也告訴您該站台歸屬於哪些邊緣節點。

ESTABLISHED 後帶有存活時間，接著顯示 INSTALLED, TUNNEL，代表一個健康的配對：前者為 IKE 會話，後者為實際承載流量的子 SA。IKE 會話已建立但無對應子 SA 安裝的情況，才是值得關注的故障。

ipsec-statusall

Section titled “ipsec-statusall”

相同資訊，另加每個 SA 的位元組與封包計數器、重新協商計時器，以及協商後的演算法。

Terminal window
{"command":["ipsec-statusall"]}
Status of IKE charon daemon (strongSwan 5.9.13, Linux 5.14.0-687.20.1.el9_8.x86_64, x86_64):
  uptime: 78 minutes, since Aug 03 15:12:39 2026
  malloc: sbrk 3428352, mmap 0, used 2019536, free 1408816
  worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled: 20
  loaded plugins: charon aes des rc2 sha2 sha1 mgf1 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs12 pgp dnskey sshkey pem openssl pkcs8 fips-prf gmp curve25519 xcbc cmac hmac kdf gcm drbg attr kernel-pb kernel-netlink resolve socket-default stroke vici updown xauth-generic error-notify counters
Listening IP addresses:
  10.0.2.4
  10.0.3.4
  100.64.255.1
  10.0.1.4
  169.254.100.1
  169.254.10.13
  169.254.254.103
Connections:
ver.dc12-ash.ves-io.<uuid>.tenant.int.ves.io:  10.0.1.4[4500]...<public-ip>[4500]  IKEv1/2, dpddelay=3s
ver.dc12-ash.ves-io.<uuid>.tenant.int.ves.io:   local:  [ver.mcn-ce-ha-eastus01.<tenant>.<uuid>.tenant.int.ves.io] uses any authentication
ver.dc12-ash.ves-io.<uuid>.tenant.int.ves.io:    cert:  "O=Volterra, OU=ves-system, CN=ike"
ver.dc12-ash.ves-io.<uuid>.tenant.int.ves.io:   remote: [ver.dc12-ash.ves-io.<uuid>.tenant.int.ves.io] uses any authentication
ver.dc12-ash.ves-io.<uuid>.tenant.int.ves.io:   child:  dynamic === 0.0.0.0/0 TUNNEL, dpdaction=start
ver.ny8-nyc.ves-io.<uuid>.tenant.int.ves.io:  10.0.1.4[4500]...<public-ip>[4500]  IKEv1/2, dpddelay=3s
ver.ny8-nyc.ves-io.<uuid>.tenant.int.ves.io:   local:  [ver.mcn-ce-ha-eastus01.<tenant>.<uuid>.tenant.int.ves.io] uses any authentication
ver.ny8-nyc.ves-io.<uuid>.tenant.int.ves.io:    cert:  "O=Volterra, OU=ves-system, CN=ike"
ver.ny8-nyc.ves-io.<uuid>.tenant.int.ves.io:   remote: [ver.ny8-nyc.ves-io.<uuid>.tenant.int.ves.io] uses any authentication
ver.ny8-nyc.ves-io.<uuid>.tenant.int.ves.io:   child:  dynamic === 0.0.0.0/0 TUNNEL, dpdaction=start
Security Associations (2 up, 0 connecting):
ver.ny8-nyc.ves-io.<uuid>.tenant.int.ves.io[8]: ESTABLISHED 70 minutes ago, 10.0.1.4[ver.mcn-ce-ha-eastus01.<tenant>.<uuid>.tenant.int.ves.io]...<public-ip>[ver.ny8-nyc.ves-io.<uuid>.tenant.int.ves.io]
ver.ny8-nyc.ves-io.<uuid>.tenant.int.ves.io[8]: IKEv2 SPIs: 82b18316b81c76c1_i* 4a79a978d19b3304_r, any reauthentication in 2 hours
ver.ny8-nyc.ves-io.<uuid>.tenant.int.ves.io[8]: IKE proposal: AES_GCM_16_128/PRF_HMAC_SHA2_256/MODP_3072
ver.ny8-nyc.ves-io.<uuid>.tenant.int.ves.io{9}:  INSTALLED, TUNNEL, reqid 65542, ESP in UDP SPIs: ffff1700_i ffffce10_o
ver.ny8-nyc.ves-io.<uuid>.tenant.int.ves.io{9}:  AES_GCM_16_128, 0 bytes_i, 0 bytes_o, rekeying disabled
ver.ny8-nyc.ves-io.<uuid>.tenant.int.ves.io{9}:   10.0.1.4/32 === <public-ip>/32
ver.dc12-ash.ves-io.<uuid>.tenant.int.ves.io[7]: ESTABLISHED 70 minutes ago, 10.0.1.4[ver.mcn-ce-ha-eastus01.<tenant>.<uuid>.tenant.int.ves.io]...<public-ip>[ver.dc12-ash.ves-io.<uuid>.tenant.int.ves.io]
ver.dc12-ash.ves-io.<uuid>.tenant.int.ves.io[7]: IKEv2 SPIs: 7ec7d8a8178881fb_i* e683f63a81425ff5_r, any reauthentication in 2 hours
ver.dc12-ash.ves-io.<uuid>.tenant.int.ves.io[7]: IKE proposal: AES_GCM_16_128/PRF_HMAC_SHA2_256/MODP_3072
ver.dc12-ash.ves-io.<uuid>.tenant.int.ves.io{8}:  INSTALLED, TUNNEL, reqid 65541, ESP in UDP SPIs: ffff1160_i ffff1e70_o
ver.dc12-ash.ves-io.<uuid>.tenant.int.ves.io{8}:  AES_GCM_16_128, 0 bytes_i, 0 bytes_o, rekeying disabled
ver.dc12-ash.ves-io.<uuid>.tenant.int.ves.io{8}:   10.0.1.4/32 === <public-ip>/32

使用此指令可區分「隧道已上線」與「隧道正在承載流量」的差異。一條建立數小時但位元組數接近零的隧道，代表其已上線但未使用，這通常意味著問題出在路由而非隧道本身。