networking auth_error ai_generated true

IPsec：与对端203.0.113.5的IKE SA认证失败，预共享密钥不匹配

IPsec: IKE SA authentication failed with peer 203.0.113.5, pre-shared key mismatch

ID: networking/ipsec-ike-sa-authentication-failure

其他格式: JSON · Markdown 中文 · English
92%修复率
88%置信度
1证据数
2023-09-12首次发现

版本兼容性

版本状态引入弃用备注
strongSwan 5.9.8 active — — —
Libreswan 4.12 active — — —
Linux kernel 6.2 (XFRM) active — — —

根因分析

互联网密钥交换（IKE）安全关联无法建立，因为本地设备配置的预共享密钥（PSK）与远程对端的PSK不匹配，导致第一阶段协商期间认证失败。

English

The Internet Key Exchange (IKE) security association could not be established because the pre-shared key (PSK) configured on the local device does not match the PSK on the remote peer, causing authentication failure during Phase 1 negotiation.

generic

官方文档

https://docs.strongswan.org/docs/5.9/config/ipsecSecrets.html

解决方案

  1. cat /etc/ipsec.secrets | grep 203.0.113.5
  2. In ipsec.conf, change 'authby=secret' to 'authby=rsasig' and configure certificates.

无效尝试

常见但无效的做法:

  1. Restarting strongSwan or Libreswan to clear the error. 95% 失败

    Does not change the PSK configuration; the same mismatch persists after restart, and authentication will fail again.

  2. Modifying the IKE proposal to use different algorithms in hopes of bypassing the error. 85% 失败

    The authentication failure is due to PSK mismatch, not algorithm incompatibility; changing proposals does not affect PSK validation.