D-Link DFL-800-AV-12 User Manual - Page 239
Management Interface Failure with VPN
View all D-Link DFL-800-AV-12 manuals
Add to My Manuals
Save this manual to your list of manuals |
Page 239 highlights
9.2.7. VPN Troubleshooting Chapter 9. VPN IPsec Tunnel -----------L2TP_IPSec IPsec_Tun1 Local Net 214.237.225.43 192.168.0.0/24 Remote Net -----------84.13.193.179 172.16.1.0/24 Remote GW 84.13.193.179 82.242.91.203 To examine the first IKE negotiation phase of tunnel setup use: > ipsecstat -ike To get complete details of tunnel setup use: > ipsecstat -u -v The ikesnoop console command A common problem with setting up IPsec is a proposal list that is unacceptable to the device at the other end of the tunnel. The ikesnoop command can show up problems with the proposal list by showing the details of the negotiations that take place. ikesnoop verbose Once this command is issued, an ICMP ping can be then sent to the D-Link Firewall from the other end of the tunnel. This will cause ikesnoop verbose to output details of the tunnel setup. Incompatibilities in the proposal lists for IKE and/or IPsec can often cause problems which show up in this output. If there are multiple tunnels in a setup or mutiple clients on a single tunnel then the output from ikesnoop verbose can be overwhelming. It is therefore better to specify that the output come from a single tunnel by specifying the client's IP address: ikesnoop verbose Management Interface Failure with VPN If any VPN tunnel is set up and then the management interface no longer operates then it is likely to be a problem with the management traffic being routed back through the VPN tunnel instead of the correct interface. This happens when a route is established in the main routing table which routes any traffic for all-nets through the VPN tunnel. If the management interface is not reached by the VPN tunnel then the administrator needs to create a specific route that routes management interface traffic leaving the D-Link Firewall back to the management subnet. When any VPN tunnel is defined, an all-nets route is automatically defined in the routing table so the administrator should always set up a specific route for the management interface to be correctly routed. 239