Symptoms:
该问题在以下版本中已解决:
要在不升级的情况下临时解决此问题,请使用 REST API 从站点配置中删除证书条目。
注意:执行此操作后,将允许对 IPsec 服务执行任何配置更改。
Method – GET
URL(Header) - https:/NSXMGR_IP/api/4.0/edges/(edge-id)/ipsec/config
Output:-
<ipsec>
<version>20</version>
<enabled>true</enabled>
<disableEvent>false</disableEvent>
<logging>
<enable>true</enable>
<logLevel>warning</logLevel>
</logging>
<sites>
<site>
<enabled>true</enabled>
<name>Site1</name>
<localId>x.x.x.x</localId>
<localIp>x.x.x.x</localIp>
<peerId>x.x.x.x</peerId>
<peerIp>x.x.x.x</peerIp>
<encryptionAlgorithm>aes</encryptionAlgorithm>
<enablePfs>true</enablePfs>
<dhGroup>dh14</dhGroup>
<localSubnets>
<subnet>x.x.x.x/24</subnet>
</localSubnets>
<peerSubnets>
<subnet>x.x.x.x/24</subnet>
</peerSubnets>
<psk>******</psk>
<certificate>certificate-9</certificate> <===========================>Certificate is not validate for PSK, need to remove this certificate.
<authenticationMode>psk</authenticationMode>
</site>
</sites>
<global>
<psk>******</psk>
<caCertificates/>
<crlCertificates/>
</global>
</ipsec>
要删除证书,请使用 API 调用:
Method – PUT
URL(Header) - https://NSXMGR_IP/api/4.0/edges/(edge-id)/ipsec/config
Output:-
<ipsec>
<enabled>true</enabled>
<disableEvent>false</disableEvent>
<logging>
<enable>true</enable>
<logLevel>warning</logLevel>
</logging>
<sites>
<site>
<enabled>true</enabled>
<name>Site1</name>
<localId>x.x.x.x</localId>
<localIp>x.x.x.x</localIp>
<peerId>x.x.x.x</peerId>
<peerIp>x.x.x.x</peerIp>
<encryptionAlgorithm>aes</encryptionAlgorithm>
<enablePfs>true</enablePfs>
<dhGroup>dh14</dhGroup>
<localSubnets>
<subnet>x.x.x.x/24</subnet>
</localSubnets>
<peerSubnets>
<subnet>x.x.x.x/24</subnet>
</peerSubnets>
<psk>******</psk>
<authenticationMode>psk</authenticationMode>
</site>
</sites>
<global>
<psk>******</psk>
<caCertificates/>
<crlCertificates/>
</global>
</ipsec>