Table 79 Sample Ike Key Exchange Logs - Nortel BCM50e Configuration

296 Appendix K Log descriptions

Table 79 Sample IKE key exchange logs

Log Message
Send <Symbol> Mode request to
<IP>Send <Symbol> Mode
request to <IP>
Recv <Symbol> Mode request
from <IP>Recv <Symbol> Mode
request from <IP>
Recv:<Symbol>
Phase 1 IKE SA process done
Start Phase 2: Quick Mode
!! IKE Negotiation is in
process
!! Duplicate requests with
the same cookie
!! No proposal chosen
!! Verifying Local ID
failed!! Verifying Remote ID
failed
!! Local / remote IPs of
incoming request conflict
with rule <#d>
!! Invalid IP <IP start>/<IP
end>
!! Remote IP <IP start> / <IP
end> conflicts
N0115789
Description
The Business Secure Router has started negotiation
with the peer.
The Business Secure Router has received an IKE
negotiation request from the peer.
IKE uses the ISAKMP protocol (refer to RFC2408 –
ISAKMP) to transmit data. Each ISAKMP packet
contains payloads of different types that show in the
log (see Table 81).
Phase 1 negotiation is finished.
Phase 2 negotiation is beginning using Quick Mode.
The Business Secure Router has begun negotiation
with the peer for the connection already, but the IKE
key exchange is not finished yet.
The Business Secure Router has received multiple
requests from the same peer but it is still processing
the first IKE packet from that peer.
The parameters configured for Phase 1 or Phase 2
negotiations do not match. Check all protocols and
settings for these phases. For example, one party is
using 3DES encryption, but the other party is using
DES encryption, so the connection fails.
During IKE Phase 2 negotiation, both parties
exchange policy details, including local and remote
IP address ranges. If these ranges differ, the
connection fails.
If the security gateway is 0.0.0.0, the Business
Secure Router uses the peer Local Addr as its
Remote Addr. If this IP (range) conflicts with a
previously configured rule then the connection is not
allowed.
The Local IP Addr range for the peer is invalid.
If the security gateway is 0.0.0.0, the Business
Secure Router uses Local Addr for the peer as its
Remote Addr. If a peer Local Addr range conflicts
with other connections, the Business Secure Router
does not accept VPN connection requests from this
peer.