Ipsec Troubleshooting - Secure Computing SG300 User Manual

IPSec Troubleshooting

Symptom: IPSec is not running and is enabled.
Possible Cause: The SG unit has not been assigned a default gateway.
Solution: Ensure the SG unit has a default gateway by configuring the Internet
connection on the Connect to Internet page or assigning a default gateway on the IP
Configuration page.
Symptom: Tunnel is always down even though IPSec is running and the tunnel is
enabled.
Possible Cause: The tunnel is using Manual Keying and the encryption and/or
authentication keys are incorrect.
The tunnel is using Manual Keying and the SG unit's and/or remote party's keys do
not correspond to the Cipher and Hash specified.
Solution: Configure a correct set of encryption and/or authentication keys. Select
the appropriate Cipher and Hash that the key have been generated from, or change
the keys used to use the selected Cipher and Hash.
Symptom: Tunnel is always Negotiating Phase 1.
Possible Cause: The remote party does not have an Internet IP address (a No route
to host message is reported in the system log).
The remote party has IPSec disabled (a Connection refused message is reported in
the system log).
The remote party does not have a tunnel configured correctly because:
o The tunnel has not been configured.
o The Phase 1 proposals do not match.
o The secrets do not match.
o The RSA key signatures have been incorrectly configured.
o The Distinguished Name of the remote party has not be configured correctly.
o The Endpoint IDs do not match.
o The remote IP address or DNS hostname has been incorrectly entered.
o The certificates do not authenticate correctly against the CA certificate.
Solution: Ensure that the tunnel settings for the SG unit and the remote party are
configured correctly. Also ensure that both have IPSec enabled and have Internet IP
addresses. Check that the CA has signed the certificates.
Symptom: Tunnel is always Negotiating Phase 2
Possible Cause: The Phase 2 proposals set for the SG unit and the remote party do
not match.
The local and remote subnets do not match.
Virtual Private Networking
234