Title: IPSEC VPN [Print this page] Author: Levy Time: 2018-6-21 14:20 Title: IPSEC VPN IPSEC VPN tunnel cannot bring up Author: admin Time: 2018-6-21 14:20
• Ensure that the pre-shared keys match exactly
• Ensure that both ends use the same P1 and P2 proposal settings
• Ensure that you have allowed inbound and outbound traffic for all necessary network services, especially if services such as DNS or DHCP are having problems.
• Check that a static route has been configured properly to allow routing of VPN traffic.
• Ensure that your unit is in NAT/Route mode, rather than Transparent.
• Check your NAT settings, enabling NAT traversal in the Phase 1 configuration while disabling NAT in the security policy. You might need to pin the PAT/NAT session table, or use some of kind of NAT-T keepalive to avoid the expiration of your PAT/NAT translation.
• Ensure that both ends of the VPN tunnel are using Main mode, unless multiple dial-up tunnels are being used.
• If you have multiple dial-up IPsec VPNs, ensure that the Peer ID is configured properly
• and that clients have specified the correct Local ID.
• If you are using Perfect Forward Secrecy (PFS), ensure that it is used on both peers. You can use the diagnose vpn tunnel list command to troubleshoot this.
• Ensure that the Quick Mode selectors are correctly configured. If part of the setup currently uses firewall addresses or address groups, try changing it to either specify the IP addresses or use an expanded address range.
• If XAUTH is enabled, ensure that the settings are the same for both ends, and that the firewall unit is set to Enable as Server.
• Check IPsec VPN Maximum Transmission Unit (MTU) size. A 1500 byte MTU is going to exceed the overhead of the ESP-header, including the additional ip_header,etc. You can use the diagnose vpn tunnel list command to troubleshoot this.
• If your unit is behind a NAT device, such as a router, configure port forwarding for UDP ports 500 and 4500.
• Remove any Phase 1 or Phase 2 configurations that are not in use. If a duplicate instance of the VPN tunnel appears on the IPsec Monitor, reboot your unit to try and clear the entry.
If you are still unable to connect to the VPN tunnel, run the following diagnostic command in the CLI and send to Ruijie support.
Troubleshooting
RG-WALL#diagnose debug enable
RG-WALL#diagnose debug application ike -1
Welcome to Ruijie Community (https://community.ruijienetworks.com/)