Scribd Logo
Upload

Welcome to Scribd!

  • 42 views

    5.1 7-IPSec-Troubleshooting

    Uploaded by

    amit_post2000
    The document discusses troubleshooting techniques for site-to-site IPSec VPNs. It describes using debug commands to analyze Phase 1 and Phase 2 negotiations and intentionally misconfiguring parameters like encryption, hash algorithms, and transform sets to trigger failures. Show commands are also recommended to check the status of ISAKMP SAs, IPsec SAs, pre-shared keys, crypto maps, and ACLs to isolate issues.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    5.1 7-IPSec-Troubleshooting

    Uploaded by

    amit_post2000
    42 views9 pages
    The document discusses troubleshooting techniques for site-to-site IPSec VPNs. It describes using debug commands to analyze Phase 1 and Phase 2 negotiations and intentionally misconfiguring parameters like encryption, hash algorithms, and transform sets to trigger failures. Show commands are also recommended to check the status of ISAKMP SAs, IPsec SAs, pre-shared keys, crypto maps, and ACLs to isolate issues.

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    The document discusses troubleshooting techniques for site-to-site IPSec VPNs. It describes using debug commands to analyze Phase 1 and Phase 2 negotiations and intentionally misconfiguring parameters like encryption, hash algorithms, and transform sets to trigger failures. Show commands are also recommended to check the status of ISAKMP SAs, IPsec SAs, pre-shared keys, crypto maps, and ACLs to isolate issues.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    42 views9 pages

    5.1 7-IPSec-Troubleshooting

    Uploaded by

    amit_post2000
    The document discusses troubleshooting techniques for site-to-site IPSec VPNs. It describes using debug commands to analyze Phase 1 and Phase 2 negotiations and intentionally misconfiguring parameters like encryption, hash algorithms, and transform sets to trigger failures. Show commands are also recommended to check the status of ISAKMP SAs, IPsec SAs, pre-shared keys, crypto maps, and ACLs to isolate issues.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    You are on page 1of 9

    Site-to-Site IPSec VPN Troubleshoot:

    Troubleshooting VPN using debug commands. Start with the debug crypto isakmp command
    and walk through a successful ISAKMP SA creation. After issue, the clear crypto session
    command and ping a host from one side to the other side.
    R3# Debug crypto isakmp

    1 | P a g e Created by Ahmad Ali E-Mail: [email protected] , Mobile: 056 430 3717


    2 | P a g e Created by Ahmad Ali E-Mail: [email protected] , Mobile: 056 430 3717
    3 | P a g e Created by Ahmad Ali E-Mail: [email protected] , Mobile: 056 430 3717
    Troubleshooting Phase 1:
    Let us Make some changes to the ISAKMP policy on the remote peer and clear the crypto
    session by issuing the clear crypto session command. When do the debug after we clear the
    session, the changes I made should be reflected.

    Mismatch Encryption in the ISAKMP Policy:


    R3(config)#crypto isakmp policy 5
    R3(config-isakmp)#authentication pre-share
    R3(config-isakmp)#encryption aes
    R3(config-isakmp)#group 2
    R3(config-isakmp)#hash sha
    R3(config-isakmp)#lifetime 86400
    R3(config-isakmp)#exit
    R3(config)#crypto isakmp key cisco123 address 192.168.23.3
    R3# debug crypto isakmp

    Mismatch Hash Algorithm in the ISAKMP Policy:


    R3(config)#crypto isakmp policy 5
    R3(config-isakmp)#authentication pre-share
    R3(config-isakmp)#encryption 3des
    R3(config-isakmp)#group 2
    R3(config-isakmp)#hash md5
    R3(config-isakmp)#lifetime 86400
    R3(config-isakmp)#exit
    R3(config)#crypto isakmp key cisco123 address 192.168.23.3
    R3# debug crypto isakmp

    4 | P a g e Created by Ahmad Ali E-Mail: [email protected] , Mobile: 056 430 3717


    Mismatch Diffie-Hellman Group in ISAKMP Policy:
    R3(config)#crypto isakmp policy 5
    R3(config-isakmp)#authentication pre-share
    R3(config-isakmp)#encryption 3des
    R3(config-isakmp)#group 5
    R3(config-isakmp)#hash sha
    R3(config-isakmp)#lifetime 86400
    R3(config)#crypto isakmp key cisco123 address 192.168.23.3
    R3# debug crypto isakmp

    Mismatch Authentication Type in ISAKMP Policy:


    R3(config)#crypto isakmp policy 5
    R3(config-isakmp)# authentication rsa-sig
    R3(config-isakmp)#encryption 3des
    R3(config-isakmp)#group 2
    R3(config-isakmp)#hash sha
    R3(config-isakmp)#lifetime 86400
    R3(config)#crypto isakmp key cisco123 address 192.168.23.3
    R3# debug crypto isakmp

    Pre-Shared Keys are wrong:


    R3(config)#crypto isakmp key cisco12 address 192.168.23.3
    R3# debug crypto isakmp

    5 | P a g e Created by Ahmad Ali E-Mail: [email protected] , Mobile: 056 430 3717


    Troubleshooting Phase 2:
    Let us jump into Phase 2 troubleshooting. Going to alter IPSec, transform set to let it fail on
    Phase 2. By changing the transform set, Main Mode exchange complete and Phase 2 start.
    I changed the responder transform-set to esp-3des instead of esp-aes like the one the peer is
    configured to this router and I am using debug crypto ipsec to generate the following output.

    Mismatch Transform-Set Attribute:


    R1(config)# crypto ipsec transform-set TSET esp-3des esp-md5-hmac
    R1(cfg-crypto-trans)#crypto ipsec security-association lifetime seconds 3600
    R3#debug crypto ipsec

    Wrong ACL in the Crypto Map:


    Now let us put the wrong ACL in the crypto map or do not put the one that matches traffic for
    the traffic going from one side to the other. On the responder, it will clearly state that the proxy
    IDs are what were not supported:
    R1(config)#crypto map CMAP 10 ipsec-isakmp
    R1(config-crypto-map)#match address VPN
    R1(config-crypto-map)#set peer 192.168.23.3
    R1(config-crypto-map)#set transform-set TSET
    R3#debug crypto ipsec

    6 | P a g e Created by Ahmad Ali E-Mail: [email protected] , Mobile: 056 430 3717


    Show Commands to Troubleshooting VPN:
    This command shows the Internet Security Association Management Protocol (ISAKMP) security
    associations (SAs) built between peers. This command displays the details for the IKE Phase 1
    tunnel including the current status.

    This command, displays the encryption algorithm, hash algorithm, authentication method, and
    Diffie-Hellman group configured on the device.

    This command will give a quick list of all IKE and IPSec SA sessions. Using the commands can
    easily verify whether an IPSec tunnel is active, down, or still negotiating.

    7 | P a g e Created by Ahmad Ali E-Mail: [email protected] , Mobile: 056 430 3717


    This command shows IPsec SAs built between peers. The encrypted tunnel is built between
    peers for traffic that goes between. Two ESP SAs built inbound and outbound. This command
    displays the details for the IKE Phase 2 tunnel.

    This command verify and display Phase 1 Preshared Key.

    8 | P a g e Created by Ahmad Ali E-Mail: [email protected] , Mobile: 056 430 3717


    This command displays the details of a crypto map, where it is applied, transform set, ACLs
    involved, and who the peer address and security association lifetime details.

    This command verify and check crypto ACLs for hit counts.

    Verify for mirrored crypto ACLs on each side.

    9 | P a g e Created by Ahmad Ali E-Mail: [email protected] , Mobile: 056 430 3717

    You might also like