Table of Contents
Advertisement
6. To display the IPSec policy, enter:
7. To display the IKE SA state and counters, enter:
8. To display the IPSEC SA statistics, enter:
9. To display the statistics for connections that are occurring through the firewall, enter:
The following are some additional commands that can be useful for debugging static VPN:
• debug crypto ike—enables IKE negotiation debug
• debug crypto ipsec—enables IPSec policy-related debug
• debug crypto ca—enables PKI debug
• debug dhcp-client—enables DHCP client debug messages (for VPN ABOT)
Troubleshooting Dynamic VPN Peer to Peer over IP-IP
tunnels
This section describes how to troubleshoot dynamic routing over IP-IP encapsulated
tunnels.
The following list provides prerequisites and notes for configuring Dynamic IP-IP VPNs:
• The Secure Router requires that the IP-IP tunnel be created manually to enable routing
over VPN.
• Periodic DPD must be enabled on both peers.
• An IP address must be assigned to the IP-IP tunnel to make it a layer 3 interface.
• The tunnel interface must always be configured as crypto untrusted.
Troubleshooting
The following is a sample configuration:
crypto
ike policy toNVR 4.4.4.1
local-id key-id 12345
local-address 0.0.0.0
key avaya123
show crypto ipsec policy all detail
Be sure that the peer IP is properly configured, the network to be protected is
properly configured, and IPSec proposal properties match on the peers.
show crypto ike sa all
show crypto ipsec sa all
show firewall connections all
Verify that traffic is passing across the policies you have configured.
Troubleshooting Dynamic VPN Peer to Peer over IP-IP tunnels
August 2013
217
Advertisement
Table of Contents
Troubleshooting
