D-Link DFL-1660 User Manual page 387

Troubleshooting IPsec Tunnels
• Check that the correct certificates have been used.
• Check that the certificate .cer and .key files have the same filename. For example, my_cert.key
and my_cert.cer.
• Check that the certificates have not expired.
• Check that the NetDefendOS date and time is set correctly and consider time-zone issues with
newly generated certificates (the time of generation may not be the same as the CA server's
system time).
• Disable CRL (revocation list) checking to see if CA server access could be the problem. CA
Server issues are discussed further in Section 9.6, "CA Server Access".
Troubleshooting IPsec Tunnels
A number of commands can be used to diagnose IPsec tunnels:
The ipsecstat console command
ipsecstat can be used to show that IPsec tunnels have correctly established. A representative
example of output is:
> ipsecstat
--- IPsec SAs:
Displaying one line per SA-bundle
IPsec Tunnel
------------
L2TP_IPSec
IPsec_Tun1
To examine the first IKE negotiation phase of tunnel setup use:
> ipsecstat -ike
To get complete details of tunnel setup use:
> ipsecstat -u -v
The ikesnoop console command
A common problem with setting up IPsec is a list of proposed algorithms that is unacceptable to the
device at the other end of the tunnel. The ikesnoop command is a useful tool for diagnosing
incompatible algorithm proposal lists by showing the details of negotiations during tunnel setup.
The basic form of this command is:
ikesnoop -on -verbose
Once issued, an ICMP ping can then be sent to the NetDefend Firewall from the remote end of the
tunnel. This will cause ikesnoop to output details of the tunnel setup negotiation to the console and
any algorithm proposal list incompatibilities can be seen.
If there are multiple tunnels in a setup or multiple clients on a single tunnel then the output from
verbose option can be overwhelming. It is therefore better to specify that the output comes from a
Local Net
--------------
214.237.225.43
192.168.0.0/24
387
Remote Net
------------
84.13.193.179
172.16.1.0/24
Chapter 9. VPN
Remote GW
-------------
84.13.193.179
82.242.91.203