D-Link NetDefendOS User Manual page 772

Remember that multiple networks will generate multiple IPsec SAs, one SA per network (or
host if that option is used). The defined network size is also important in that it must be
exactly the same size on both sides, as will be mentioned again later in the symptoms
section.
There are also some settings on the IPsec tunnel's IKE tab that can be involved in a
no-proposal chosen issue. For example, PFS (for IPsec phase) or DH Group (for the IKE phase).
2. Incorrect pre-shared key
A problem with the pre-shared key on either side has caused the tunnel negotiation to fail. This is
perhaps the easiest of all the error messages to troubleshoot since it can be only one thing, and
that is incorrect pre-shared key. Double-check that the pre-shared key is of the same type
(Passphrase or Hex-key) and correctly added on both sides of the tunnel.
Another reason for why NetDefendOS detects that the pre-shared key is incorrect could be
because the wrong tunnel is triggering during tunnel negotiations. IPsec tunnels are processed
from the top to the bottom of the NetDefendOS tunnel list and are initially matched against the
remote gateway. An example is if there is a roaming tunnel that uses all-nets as its remote
gateway. This tunnel will trigger before the intended tunnel if it is placed above it in the
NetDefendOS tunnel list.
For example, consider the following IPsec tunnel definitions:
Name
VPN-1
VPN-2
L2TP
VPN-3
Since the tunnel L2TP in the above table is above the tunnel VPN-3, a match will trigger before
VPN-3 because of the all-nets remote gateway (all-nets will match any network). Since these two
tunnels use different pre-shared keys, NetDefendOS will generate an "Incorrect pre-shared key"
error message.
The problem is solved if we reorder the list and move VPN-3 above L2TP. The gateway office3gw
will be then matched correctly and VPN-3 will be the tunnel selected by NetDefendOS.
3. Ike_invalid_payload, Ike_invalid_cookie
In this case the IPsec engine in NetDefendOS receives an IPsec IKE packet but is unable to match
it against an existing IKE.
If a VPN tunnel is only established on one side, this can be the resulting error message when
traffic arrives from a tunnel that does not exist. An example would be if, for some reason, the
tunnel has only gone down from the initiator side but the terminator still sees it as up. It then
tries to send packets through the tunnel but when they arrive at the initiator it will drop them
since no matching tunnel can be found.
Simply remove the tunnel from the side that believes it is still up to solve the immediate
problem. An investigation as to why the tunnel only went down from one side is recommended.
It could be that DPD is only used on one side. Another possible cause could be that even though
it has received a DELETE packet, it has not deleted/removed the tunnel.
4. Payload_Malformed
Local Network
lannet
lannet
ip_wan
lannet
772
Remote Network
office1net
office2net
all-nets
office3net
Chapter 9: VPN
Remote Gateway
office1gw
office2gw
all-nets
office3gw