ZyXEL P-202H Plus User Guide - Page 317
P-202H Plus v2 User's Guide, IPSec Log, Sample IPSec Logs During Packet Transmission,
View all ZyXEL P-202H Plus manuals
Add to My Manuals
Save this manual to your list of manuals |
Page 317 highlights
P-202H Plus v2 User's Guide Table 106 Sample IKE Key Exchange Logs LOG MESSAGE DESCRIPTION !! No proposal chosen The parameters configured for Phase 1 or Phase 2 negotiations don't match. Please check all protocols and settings for these phases. For example, one party may be using 3DES encryption, but the other party is using DES encryption, so the connection will fail. !! Verifying Local ID failed !! Verifying Remote ID failed During IKE Phase 2 negotiation, both parties exchange policy details, including local and remote IP address ranges. If these ranges differ, then the connection fails. !! Local / remote IPs of incoming request conflict with rule If the security gateway is "0.0.0.0", the ZyXEL Device will use the peer's "Local Addr" as its "Remote Addr". If this IP (range) conflicts with a previously configured rule then the connection is not allowed. !! Invalid IP / The peer's "Local IP Addr" range is invalid. !! Remote IP / conflicts If the security gateway is "0.0.0.0", the ZyXEL Device will use the peer's "Local Addr" as its "Remote Addr". If a peer's "Local Addr" range conflicts with other connections, then the ZyXEL Device will not accept VPN connection requests from this peer. !! Active connection allowed exceeded The ZyXEL Device limits the number of simultaneous Phase 2 SA negotiations. The IKE key exchange process fails if this limit is exceeded. !! IKE Packet Retransmit The ZyXEL Device did not receive a response from the peer and so retransmits the last packet sent. !! Failed to send IKE Packet The ZyXEL Device cannot send IKE packets due to a network error. !! Too many errors! Deleting SA The ZyXEL Device deletes an SA when too many errors occur. The following table shows sample log messages during packet transmission. Table 107 Sample IPSec Logs During Packet Transmission LOG MESSAGE !! WAN IP changed to !! Cannot find Phase 2 SA !! Discard REPLAY packet !! Inbound packet authentication failed !! Inbound packet decryption failed Rule idle time out, disconnect DESCRIPTION If the ZyXEL Device's WAN IP changes, all configured "My IP Addr" are changed to b "0.0.0.0".. If this field is configured as 0.0.0.0, then the ZyXEL Device will use the current ZyXEL Device WAN IP address (static or dynamic) to set up the VPN tunnel. The ZyXEL Device cannot find a phase 2 SA that corresponds with the SPI of an inbound packet (from the peer); the packet is dropped. If the ZyXEL Device receives a packet with the wrong sequence number it will discard it. The authentication configuration settings are incorrect. Please check them. The decryption configuration settings are incorrect. Please check them. If an SA has no packets transmitted for a period of time (configurable via CI command), the ZyXEL Device drops the connection. Chapter 35 IPSec Log 316