怎样解决ROS ipsec vpn的policy下sa－src－address不支持域名？
如果是pppoe拨号建立ipsec vpn，就会遇到每次pppoe重新拨号后ip ipsec policy下sa－src－address无法同步更新，ip ipsec policy下sa－src－address即使设置为域名，在点ok或应用按钮后，都会自动解析到地址，这样就造成不能建立SA的问题，手动改起来累得很，想通过脚本来解决，但下面的脚本在shell里面运行没有问题，在scheduler里面做后没有效果，感觉执行过程中有问题－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－
:do [ /ip ipsec policy print ]
:global sa-src-address [ /ip ipsec policy get 1 sa-src-address ]
:if ( $sa-src-address != $ns-ip ) do={
:do [ /ip ipsec policy set 1 sa-src-address=$ns-ip ]
:do [ /ip ipsec installed-sa flush sa-type=all ]
:log info "IPSEC: sa-src-address syn-update success!!!"
}else={
:log info "IPSEC: sa-src-address is same with ns-ip"
}
（其中$ns-ip是全局变量，是我DDNS的域名地址，在其它脚本里定义过的）
－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－
估计是第一句引起的，有哪些兄弟帮下忙，讨论讨论。 杂就没人啊？！ 终于自己搞定！
:global peer-item [ /ip ipsec peer find address=*.*.*.*/32:500 ]
:global policy-item [ /ip ipsec policy find sa-dst-address=*.*.*.* ]
:global sa-src-address [ /ip ipsec policy get $policy-item sa-src-address ]
:global pppoe-address [:pick $ddns-ip 0 [:find $ddns-ip "/"] ]
:if ( $sa-src-address != $pppoe-address ) do={
:do [ /ip ipsec peer disable $peer-item ]
:log info "IPSEC peer disabled by administrator!"
:do [ /ip ipsec policy set $policy-item sa-src-address=$pppoe-address ]
:do [ /ip ipsec installed-sa flush sa-type=all ]
:log info "IPSEC: sa-src-address syn-update successfully!!!"
:delay 2
:do [ /ip ipsec peer enable $peer-item ]
:log info "IPSEC peer enable successfully by administrator! NOW START ESTABLISH 'remote-peer' and 'ipsec sa'!!!"
}else={
:log info "IPSEC: sa-src-address is same with pppoe-address"
} 看来用ipsec vpn的比较少啊！ 学习了，强烈支持 挖坟啊，这么老的帖子都顶上来了
页:
[1]