MSR2600 IKEv2移动端手机无法连接上
- 0关注
- 0收藏，58浏览
问题描述：
我在MSR2600上按照03-H3C MSR系列路由器 IPsec 数字证书认证典型配置举例-新华三集团-H3C
配好，用手机配置连不上。
这个问题在哪里？
另外现在windows的IKEv2不支持psk,有办法解决吗？
组网及组网描述：
我在MSR2600上按照03-H3C MSR系列路由器 IPsec 数字证书认证典型配置举例-新华三集团-H3C
配好，用手机配置连不上。debug结果如下
Received packet from 116.228.y.y source port 59109 destination port 500.
*Aug 14 14:39:29:130 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
I-SPI: c6fad459d0865f02
R-SPI: 0000000000000000
Message ID: 0
Exchange type: SA_INIT
Flags: REQUEST, INITIATOR
Next payload: SA, Length: 1072.
*Aug 14 14:39:29:130 2026 Off-hub3 IKEV2/7/FSM: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
(Tunnel ID 1578): (R) Current State: IDLE.
*Aug 14 14:39:29:130 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Payload contents:
*Aug 14 14:39:29:130 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
SA Next payload: KE, Length: 408.
*Aug 14 14:39:29:130 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Last proposal: 0x2, Length: 200.
*Aug 14 14:39:29:130 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Proposal: 1, Protocol: IKE, SPI size: 0, Transform number: 21.
*Aug 14 14:39:29:130 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Last transform: 0x3, Length: 12.
*Aug 14 14:39:29:130 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Type: ENCR, Transform ID: AES-CTR.
*Aug 14 14:39:29:130 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Key length: 256.
*Aug 14 14:39:29:130 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Last transform: 0x3, Length: 12.
*Aug 14 14:39:29:130 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Type: ENCR, Transform ID: AES-CBC.
*Aug 14 14:39:29:130 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Key length: 256.
*Aug 14 14:39:29:130 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Last transform: 0x3, Length: 12.
*Aug 14 14:39:29:130 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Type: ENCR, Transform ID: AES-CTR.
*Aug 14 14:39:29:130 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Key length: 192.
*Aug 14 14:39:29:130 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Last transform: 0x3, Length: 12.
*Aug 14 14:39:29:130 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Type: ENCR, Transform ID: AES-CBC.
*Aug 14 14:39:29:130 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Key length: 192.
*Aug 14 14:39:29:130 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Last transform: 0x3, Length: 12.
*Aug 14 14:39:29:130 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Type: ENCR, Transform ID: AES-CTR.
*Aug 14 14:39:29:130 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Key length: 128.
*Aug 14 14:39:29:130 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Last transform: 0x3, Length: 12.
*Aug 14 14:39:29:131 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Type: ENCR, Transform ID: AES-CBC.
*Aug 14 14:39:29:131 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Key length: 128.
*Aug 14 14:39:29:131 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Last transform: 0x3, Length: 8.
*Aug 14 14:39:29:131 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Type: INTEG, Transform ID: AUTH-HMAC-SHA512-256.
*Aug 14 14:39:29:131 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Last transform: 0x3, Length: 8.
*Aug 14 14:39:29:131 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Type: INTEG, Transform ID: AUTH-HMAC-SHA384-192.
*Aug 14 14:39:29:131 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Last transform: 0x3, Length: 8.
*Aug 14 14:39:29:131 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Type: INTEG, Transform ID: AUTH-HMAC-SHA256-128.
*Aug 14 14:39:29:131 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Last transform: 0x3, Length: 8.
*Aug 14 14:39:29:131 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Type: INTEG, Transform ID: AUTH-AES-XCBC-96.
*Aug 14 14:39:29:131 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Last transform: 0x3, Length: 8.
*Aug 14 14:39:29:131 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Type: INTEG, Transform ID: AUTH-AES-CMAC-96.
*Aug 14 14:39:29:131 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Last transform: 0x3, Length: 8.
*Aug 14 14:39:29:131 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Type: D-H, Transform ID: 4096-bit MODP/Group 16.
*Aug 14 14:39:29:131 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Last transform: 0x3, Length: 8.
*Aug 14 14:39:29:131 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Type: D-H, Transform ID: Unknown.
*Aug 14 14:39:29:131 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Last transform: 0x3, Length: 8.
*Aug 14 14:39:29:131 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Type: D-H, Transform ID: 3072-bit MODP/Group 15.
*Aug 14 14:39:29:131 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Last transform: 0x3, Length: 8.
*Aug 14 14:39:29:131 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Type: D-H, Transform ID: 2048-bit MODP/Group 14.
*Aug 14 14:39:29:131 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Last transform: 0x3, Length: 8.
*Aug 14 14:39:29:131 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Type: PRF, Transform ID: PRF-HMAC-SHA1.
*Aug 14 14:39:29:131 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Last transform: 0x3, Length: 8.
*Aug 14 14:39:29:132 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Type: PRF, Transform ID: PRF-AES128-XCBC.
*Aug 14 14:39:29:132 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Last transform: 0x3, Length: 8.
*Aug 14 14:39:29:132 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Type: PRF, Transform ID: PRF-HMAC-SHA256.
*Aug 14 14:39:29:132 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Last transform: 0x3, Length: 8.
*Aug 14 14:39:29:132 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Type: PRF, Transform ID: PRF-HMAC-SHA384.
*Aug 14 14:39:29:132 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Last transform: 0x3, Length: 8.
*Aug 14 14:39:29:132 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Type: PRF, Transform ID: PRF-HMAC-SHA512.
*Aug 14 14:39:29:132 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Last transform: 0, Length: 8.
*Aug 14 14:39:29:132 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Type: PRF, Transform ID: PRF-AES128-CMAC.
*Aug 14 14:39:29:132 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Last proposal: 0, Length: 204.
*Aug 14 14:39:29:132 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Proposal: 2, Protocol: IKE, SPI size: 0, Transform number: 20.
*Aug 14 14:39:29:132 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Last transform: 0x3, Length: 8.
*Aug 14 14:39:29:132 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Type: ENCR, Transform ID: Unknown.
*Aug 14 14:39:29:132 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Last transform: 0x3, Length: 12.
*Aug 14 14:39:29:132 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Type: ENCR, Transform ID: AES-GCM-16.
*Aug 14 14:39:29:132 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Key length: 256.
*Aug 14 14:39:29:132 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Last transform: 0x3, Length: 12.
*Aug 14 14:39:29:132 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Type: ENCR, Transform ID: AES-GCM-12.
*Aug 14 14:39:29:132 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Key length: 256.
*Aug 14 14:39:29:132 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Last transform: 0x3, Length: 12.
*Aug 14 14:39:29:132 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Type: ENCR, Transform ID: AES-GCM-8.
*Aug 14 14:39:29:133 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Key length: 256.
*Aug 14 14:39:29:133 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Last transform: 0x3, Length: 12.
*Aug 14 14:39:29:133 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Type: ENCR, Transform ID: AES-GCM-16.
*Aug 14 14:39:29:133 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Key length: 192.
*Aug 14 14:39:29:133 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Last transform: 0x3, Length: 12.
*Aug 14 14:39:29:133 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Type: ENCR, Transform ID: AES-GCM-12.
*Aug 14 14:39:29:133 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Key length: 192.
*Aug 14 14:39:29:133 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Last transform: 0x3, Length: 12.
*Aug 14 14:39:29:133 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Type: ENCR, Transform ID: AES-GCM-8.
*Aug 14 14:39:29:133 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Key length: 192.
*Aug 14 14:39:29:133 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Last transform: 0x3, Length: 12.
*Aug 14 14:39:29:133 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Type: ENCR, Transform ID: AES-GCM-16.
*Aug 14 14:39:29:133 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Key length: 128.
*Aug 14 14:39:29:133 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Last transform: 0x3, Length: 12.
*Aug 14 14:39:29:133 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Type: ENCR, Transform ID: AES-GCM-12.
*Aug 14 14:39:29:133 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Key length: 128.
*Aug 14 14:39:29:134 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Last transform: 0x3, Length: 12.
*Aug 14 14:39:29:134 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Type: ENCR, Transform ID: AES-GCM-8.
*Aug 14 14:39:29:134 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Key length: 128.
*Aug 14 14:39:29:134 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Last transform: 0x3, Length: 8.
*Aug 14 14:39:29:134 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Type: D-H, Transform ID: 4096-bit MODP/Group 16.
*Aug 14 14:39:29:134 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Last transform: 0x3, Length: 8.
*Aug 14 14:39:29:134 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Type: D-H, Transform ID: Unknown.
*Aug 14 14:39:29:134 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Last transform: 0x3, Length: 8.
*Aug 14 14:39:29:134 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Type: D-H, Transform ID: 3072-bit MODP/Group 15.
*Aug 14 14:39:29:134 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Last transform: 0x3, Length: 8.
*Aug 14 14:39:29:134 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Type: D-H, Transform ID: 2048-bit MODP/Group 14.
*Aug 14 14:39:29:134 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Last transform: 0x3, Length: 8.
*Aug 14 14:39:29:134 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Type: PRF, Transform ID: PRF-HMAC-SHA1.
*Aug 14 14:39:29:134 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Last transform: 0x3, Length: 8.
*Aug 14 14:39:29:134 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Type: PRF, Transform ID: PRF-AES128-XCBC.
*Aug 14 14:39:29:134 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Last transform: 0x3, Length: 8.
*Aug 14 14:39:29:134 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Type: PRF, Transform ID: PRF-HMAC-SHA256.
*Aug 14 14:39:29:134 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Last transform: 0x3, Length: 8.
*Aug 14 14:39:29:134 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Type: PRF, Transform ID: PRF-HMAC-SHA384.
*Aug 14 14:39:29:135 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Last transform: 0x3, Length: 8.
*Aug 14 14:39:29:135 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Type: PRF, Transform ID: PRF-HMAC-SHA512.
*Aug 14 14:39:29:135 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Last transform: 0, Length: 8.
*Aug 14 14:39:29:135 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Type: PRF, Transform ID: PRF-AES128-CMAC.
*Aug 14 14:39:29:135 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
KE Next payload: NONCE, Length: 520, DH: 4096-bit MODP/Group 16.
*Aug 14 14:39:29:135 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
NONCE Next payload: NOTIFY, Length: 36.
*Aug 14 14:39:29:135 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
NOTIFY Next payload: NOTIFY, Length: 28, Type: NAT_DETECTION_SOURCE_IP, Protocol: NO PROTOCOL, SPI size: 0.
*Aug 14 14:39:29:135 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
NOTIFY Next payload: NOTIFY, Length: 28, Type: NAT_DETECTION_DESTINATION_IP, Protocol: NO PROTOCOL, SPI size: 0.
*Aug 14 14:39:29:135 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
NOTIFY Next payload: NOTIFY, Length: 8, Type: Unknown, Protocol: NO PROTOCOL, SPI size: 0.
*Aug 14 14:39:29:135 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
NOTIFY Next payload: NO_PAYLOAD, Length: 16, Type: Unknown, Protocol: NO PROTOCOL, SPI size: 0.
*Aug 14 14:39:29:135 2026 Off-hub3 IKEV2/7/PACKET: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Request has message id 0, expected from (0 ~ 0).
*Aug 14 14:39:29:135 2026 Off-hub3 IKEV2/7/FSM: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Search policy with vrf 0, local address 58.34.x.x.
*Aug 14 14:39:29:135 2026 Off-hub3 IKEV2/7/FSM: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Policy 10 matched.
*Aug 14 14:39:29:135 2026 Off-hub3 IKEV2/7/FSM: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Process SA payload.
*Aug 14 14:39:29:135 2026 Off-hub3 IKEV2/7/FSM: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Process KE payload.
*Aug 14 14:39:29:135 2026 Off-hub3 IKEV2/7/ERROR: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
Parse KE payload failed.
*Aug 14 14:39:29:136 2026 Off-hub3 IKEV2/7/FSM: vrf = 0, src = 58.34.x.x, dst = 116.228.y.y/59109
(Tunnel ID 1578): IKE SA deleted.
这个问题在哪里？
另外现在windows的IKEv2不支持psk,有办法解决吗？
从debug看设备仅收到500端口首包，未完成IKE_SA_INIT交互，按以下顺序排查：
1. 基础连通性&端口检查
手机侧测试公网ping设备58.34.x.x，确认UDP 500/4500端口放通（NAT场景必须开4500）：
display ipsec policy // 确认IKEv2策略绑定到公网接口
display firewall session table verbose destination-port 500 // 看会话是否建立
2. NAT穿越配置
手机基本都在NAT后，必须开启IKEv2 NAT穿越：
ikev2 profile 名称
nat-keepalive 10
ipsec policy 名称 序号 isakmp
ikev2-profile 名称
3. 证书匹配检查
确认设备证书包含SAN（主题备用名称），手机端导入根CA证书，IKEv2对端ID和证书SAN一致：
display pki certificate local // 查看本地证书SAN/主题
display ikev2 profile // 确认identity local配置与证书匹配
4. 算法兼容性
手机默认加密/完整性算法可能和设备不匹配，调整为通用组合：
ikev2 proposal 名称
encryption aes-cbc-256 aes-cbc-128
integrity sha256 sha1
group modp2048 modp1024
5. 详细debug定位
收集完整IKEv2交互debug：
terminal debugging
debugging ikev2 all
二、Windows IKEv2不支持PSK的解决办法
Windows原生IKEv2客户端默认仅支持证书认证，要使用PSK有两种方案：
1. 修改Windows注册表强制启用PSK（适用于Win10 1809+、Win11）
注册表路径：HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan\Parameters
新建DWORD值DisableIKENameEkuCheck，数值设为1，重启电脑后即可在VPN属性里配置预共享密钥。
2. 设备侧调整为证书认证
沿用你当前的数字证书配置，Windows导入根证书+用户证书即可原生适配，稳定性比PSK更高。
我改了注册表，属性里没有PSK可配
MSR2600 IKEv2 手机终端报错 Parse KE payload failed 深度排错
debug 关键报错：
plaintext
IKEV2/7/ERROR: Parse KE payload failed.
(Tunnel ID 1578): IKE SA deleted.
现象：手机 SA_INIT 报文可以到达路由器，IKE 第一阶段密钥交换 KE 载荷解析直接失败，IKE SA 直接删除，协商直接终止。
抓包可以看到手机发起 SA_INIT，携带大量加密套件、DH 组（Group16 4096、Group15 3072、Group14 2048），路由器收到之后解析 KE 载荷失败，路由器没有回复任何 IKEv2 响应包。
根因说明
MSR2600 老版本 Comware，IKEv2 不支持 Group16 (4096‑bit MODP) DH 组，手机客户端优先发送 Group16；MSR 无法解析 4096bit 的 KE 密钥交换载荷，直接报Parse KE payload failed，销毁 IKE SA，协商直接失败。
iPhone / 安卓原生 IKEv2 客户端优先发送大 DH 组 4096 (Group16)，MSR2600 部分版本 IKEv2 不支持 Group16，出现该典型报错。
注意：你是数字证书认证 IKEv2，不是 PSK，认证本身没问题，是 DH 密钥交换组不兼容。
官方典型约束：MSR2600 IKEv2 支持 DH：Group14 (2048)、Group5；Group15 (3072)/Group16 (4096) 部分版本 IKEv2 不支持。手机客户端把 Group16 放最前面，MSR 无法处理，直接丢弃整个报文，不会向下兼容降级匹配后面的 Group14。
不要怀疑证书：SA_INIT 阶段还没有走到证书校验，还没到证书认证环节就已经 KE 解析失败。
修复操作（二选一，优先方案 1）
方案 1：IKEv2 提议删掉不支持的 DH 组，只保留 Group14（2048bit）【推荐】
修改 IKEv2 安全提议，DH 组只配置 group14，不要配置 group15/group16。
shell
#查看现有IKEv2提议
display ikev2 proposal
system‑view
ikev2 proposal 你的提议名字
encryption‑algorithm aes‑256‑cbc aes‑128‑cbc
integrity‑algorithm sha2‑256 sha2‑128
prf‑algorithm sha2‑256
dh group14 #只保留group14，删除group15、group16！！！
quit
#应用到IKEv2策略
ikev2 policy 你的策略名
proposal 你的提议名字
...
手机客户端收到服务器的 SA 回应，会降级使用 Group14 进行密钥交换。
⚠️注意：IKEv2 是服务器回应客户端的套件子集；客户端优先发 Group16，如果路由器提议不包含 Group16，路由器回复 SA 只会通告 Group14，手机会接受回退。
方案 2：升级 MSR2600 固件版本
新版本 Comware 修复 IKEv2 对 Group15/16 DH 组支持。
如果硬件版本允许，升级到最新稳定版本，即可原生支持 Group16，不用修改提议。
额外证书移动端注意点（解决 KE 之后还要处理）
你使用数字证书 IKEv2：
手机需要导入根 CA 证书，必须安装到系统【受信任根证书存储】，不能仅安装在描述文件，否则证书校验失败。
路由器证书的subject‑alt‑name 必须填写公网 IP 或者域名，手机 IKEv2 会校验证书 SAN，没有 SAN 会拒绝连接。
UDP 500、4500 端口必须放行；NAT‑T，手机 4G 网络会触发 NAT‑T 4500 端口。
排错验证命令
bash
debugging ikev2 all
terminal debugging
terminal monitor
#手机发起连接，观察不再出现 Parse KE payload failed。
display ikev2 sa
第二个问题：Windows 原生 IKEv2 不支持 PSK 预共享密钥
Windows 自带 IKEv2 栈原生不支持 PSK 认证，仅支持证书认证，微软没有实现 IKEv2 PSK，注册表也无法开启该能力。
可行方案（按工程优先级）
方案 A：IKEv2 证书认证（最标准，推荐）
Windows、手机全部使用 IKEv2 证书认证，MSR2600 当前就是这套方案。
Windows 导入根 CA + 用户证书，系统自带 IKEv2 直接拨号，不需要第三方软件。
方案 B：Windows 使用第三方 IPsec/IKEv2 客户端（保留 PSK）
SecoClient（H3C 官方客户端）：支持 IKEv2‑PSK，Windows、安卓、iOS 都支持，适配 MSR 系列。
strongSwan（开源）Windows 客户端，支持 IKEv2 PSK。
缺点：需要终端安装软件，不能用 Windows 自带系统 VPN。
方案 C：改用 IKEv1 野蛮模式 + PSK（Windows 原生支持 L2TP‑over‑IPsec PSK）
Windows 原生没有 IKEv1 的 IPsec 站点到客户端，但是支持 L2TP over IKEv1‑PSK。
MSR 配置 L2TP over IPsec，预共享密钥，Windows 自带 VPN 即可拨号。
⚠️缺点：IKEv1，安全性弱于 IKEv2。
❌不可行：修改注册表开启 Windows IKEv2 PSK
网上流传注册表方法，Windows 原生 IKEv2 没有 PSK 实现，注册表无效，不要尝试。
综合建议
移动端故障：优先修改 IKEv2 提议，DH 仅保留 group14，解决Parse KE payload failed；后续处理手机证书导入 SAN 问题。
Windows 接入：
追求原生系统 VPN：统一走 IKEv2 证书认证；
一定要 PSK：部署 H3C SecoClient 第三方客户端。
补充踩坑小结
Parse KE payload failed 不是证书问题，IKE SA_INIT 阶段还没有处理证书，是 DH 组不兼容，MSR 老版本 IKEv2 无法解析 4096bit DH 载荷。
Windows 原生 IKEv2 无 PSK，无注册表开关，只能证书 / 第三方客户端 / L2TP‑over‑IPsec。
编辑答案
亲~登录后才可以操作哦!
确定你的邮箱还未认证，请认证邮箱或绑定手机后进行当前操作
举报
×
侵犯我的权益
×
侵犯了我企业的权益
×
- 1. 您举报的内容是什么？（请在邮件中列出您举报的内容和链接地址）
- 2. 您是谁？（身份证明材料，可以是身份证或护照等证件）
- 3. 是哪家企业？（营业执照，单位登记证明等证件）
- 4. 您与该企业的关系是？（您是企业法人或被授权人，需提供企业委托授权书）
抄袭了我的内容
×
原文链接或出处
诽谤我
×
- 1. 您举报的内容以及侵犯了您什么权益？（请在邮件中列出您举报的内容、链接地址，并给出简短的说明）
- 2. 您是谁？（身份证明材料，可以是身份证或护照等证件）
对根叔社区有害的内容
×
不规范转载
×
举报说明
我改了注册表，属性里没有PSK可配