Failure To Establish An Ipsec Tunnel; Acl Configuration Error - HP A6600 Configuration Manual

Failure to establish an IPsec tunnel

Symptom
The expected IPsec tunnel cannot be established.
Analysis
Sometimes an IPsec tunnel cannot be established, or there is no way to communicate in the presence of
an IPsec tunnel in an unstable network. According to examination results, however, ACLs of both parties
are configured correctly, and proposals are also matched.
In this case, the problem is usually caused by the reboot of one router after the IPsec tunnel is
established.
Solution
Use display ike sa to check whether both parties have established an SA in phase 1.
•
Use display ipsec sa policy to check whether the IPsec policy on the interface has established IPsec
•
SA.
If the two commands show that one party has an SA but the other does not, use reset ipsec sa to
•
clear the IPsec SA that has no corresponding SA, use reset ike sa to clear the IKE SA that has no
corresponding IKE SA, and trigger SA re-negotiation.

ACL configuration error

Symptom
ACL configuration error results in data flow blockage.
Analysis
When multiple routers create different IPsec tunnels early or late, a router may have multiple peers. If the
router is not configured with ACL rule, the peers send packets to it to set up different IPsec tunnels in
different protection granularity. Because the priorities of IPsec tunnels are determined by the order in
which they are established, a router cannot interoperate with other peers in fine granularity when its
outbound packets are first matched with an IPsec tunnel in coarse granularity.
Solution
When a router has multiple peers, configure ACLs on the router to distinguish different data flows, and
try to avoid configuring overlapping ACL rules for different peers. If it is unavoidable, the subrules in fine
granularity should be configured with higher preferences.
304