D-Link DFL-260-IPS-12 Product Manual - Page 438
IPsec Troubleshooting Commands, Warning: Be careful using the -num=all option
View all D-Link DFL-260-IPS-12 manuals
Add to My Manuals
Save this manual to your list of manuals |
Page 438 highlights
9.7.3. IPsec Troubleshooting Commands Chapter 9. VPN If certificates have been used in a VPN solution then the following should be looked at as a source of potential problems: • Check that the correct certificates have been used for the right purposes. • Check that the certificate .cer and .key files have the same filename. For example, my_cert.key and my_cert.cer. • Check that the certificates have not expired. Certificates have a specific lifetime and when this expires they cannot be used and new certificates must be issued. • Check that the NetDefendOS date and time is set correctly. If the system time and date is wrong then certificates can appear as being expired when, in fact, they are not. • Consider time-zone issues with newly generated certificates. The NetDefend Firewall's time zone may not be the same as the CA server's time zone and the certificate may not yet be valid in the local zone. • Disable CRL (revocation list) checking to see if CA server access could be the problem. CA Server issues are discussed further in Section 9.6, "CA Server Access". 9.7.3. IPsec Troubleshooting Commands A number of commands can be used to diagnose IPsec tunnels: The ipsecstat console command ipsecstat can be used to show that IPsec tunnels have correctly established. A representative example of output is: gw-world:/> ipsecstat --- IPsec SAs: Displaying one line per SA-bundle IPsec Tunnel -----------L2TP_IPSec IPsec_Tun1 Local Net 214.237.225.43 192.168.0.0/24 Remote Net -----------84.13.193.179 172.16.1.0/24 Remote GW 84.13.193.179 82.242.91.203 To examine the first IKE negotiation phase of tunnel setup use: gw-world:/> ipsecstat -ike To get complete details of tunnel setup use: gw-world:/> ipsecstat -u -v Warning: Be careful using the -num=all option When using any IPsec related commands, if there are large numbers of tunnels then avoid using the -num=all option since this will generate correspondingly large amounts of output. For example, with a large number of tunnels avoid using: gw-world:/> ipsecstat -num=all 438