H3C MSR Series Troubleshooting Manual page 24

*Nov 7 09:23:15:524 2014 ROUTER IKE/7/DEBUG: exchange state machine(I): finished step
2, advancing...
//Phase 1 negotiation finished.
.....................
*Nov 7 09:23:21:801 2014 ROUTER IKE/7/DEBUG: send message:
//The device sent the first packet for the phase 2 negotiation.
*Nov 7 09:23:21:902 2014 ROUTER IKE/7/DEBUG:
*Nov 7 09:23:22:002 2014 ROUTER IKE/7/DEBUG:
.....................
*Nov 7 09:23:22:506 2014 ROUTER IKE/7/DEBUG: exchange state machine(I): finished step
0, advancing...
*Nov 7 09:23:22:606 2014 ROUTER IKE/7/DEBUG: received message:
//The device received a reply packet from the peer.
*Nov 7 09:23:22:657 2014 ROUTER IKE/7/DEBUG:
*Nov 7 09:23:22:757 2014 ROUTER IKE/7/DEBUG:
.....................
*Nov 7 09:23:24:571 2014 ROUTER IKE/7/DEBUG: validate payload NOTIFY
*Nov 7 09:23:24:621 2014 ROUTER IKE/7/DEBUG:
*Nov 7 09:23:24:722 2014 ROUTER IKE/7/DEBUG:
*Nov 7 09:23:24:822 2014 ROUTER IKE/7/DEBUG:
*Nov 7 09:23:24:873 2014 ROUTER IKE/7/DEBUG:
//The device received a reply packet of the INVALID_ID_INFORMATION type. The negotiation
failed.
*Nov 7 09:23:24:973 2014 ROUTER IKE/7/DEBUG: exchange setup(R): 9c16530
*Nov 7 09:23:25:024 2014 ROUTER IKE/7/DEBUG: exchange check: checking for required
INFO
*Nov 7 09:23:25:124 2014 ROUTER IKE/7/DEBUG: got NOTIFY of type
INVALID_ID_INFORMATION
The previous debugging information shows that packet exchanges were normal in phase 1
negotiation. In phase 2 negotiation, however, the initiator received an
INVALID_ID_INFORMATION packet from the peer. This packet resulted in the IPsec SA
negotiation failure. We need to identify why the peer device (the receiver) sent such a packet.
On the receiver, display IKE debugging information by using the debugging ike all
2.
command. The key debugging information is as follows:
*Nov 6 17:03:05:527 2014 ROUTER IKE/7/Event: IKE thread 366519722672 processes a job.
*Nov 6 17:03:05:527 2014 ROUTER IKE/7/Packet: Begin a new phase 1 negotiation as
responder.
*Nov 6 17:03:05:527 2014 ROUTER IKE/7/Event: Responder created an SA for peer 10.1.1.1,
local port 500, remote port 500.
*Nov 6 17:03:05:527 2014 ROUTER IKE/7/Event: Set IKE SA state to IKE_P1_STATE_INIT.
*Nov 6 17:03:05:527 2014 ROUTER IKE/7/Packet: Received ISAKMP Security Association
Payload.
//The device received the first negotiation packet from the peer.
.........
*Nov 6 17:03:05:527 2014 ROUTER IKE/7/Packet: The profile 1 is matched.
ICOOKIE: 0xb8a20d7c014806fa
RCOOKIE: 0x67a9145eb46c41d9
ICOOKIE: 0xb8a20d7c014806fa
RCOOKIE: 0x67a9145eb46c41d9
DOI: IPSEC
PROTO: IPSEC_ESP
SPI_SZ: 4
MSG_TYPE: INVALID_ID_INFORMATION
22