Troubleshooting HP-UX IPSec

Troubleshooting Scenarios

Symptoms

Link errors (unable to connect) and ipsec_report -sadshows no IPSec/QM SAs.

Solution

Determine if ISAKMP/MM SA negotiations are succeeding. Run the following commands:

ipsec_report -mad

ipsec_report -audit file

Check for Main Mode processing failed, MM negotiation timeout error messages in the log file.

Additional Information

If HP-UX IPSec is configured to encrypt/authenticate but failing, it will appear as a connection error (unable to connect or connection timed out) to the user.

If users are consistently getting connection errors for traffic that should use HP-UX IPSec for encryption or authentication, check for IPSec/QM SAs using the following commands:

ipsec_report -sad ipsec_report -host

Determine if IPSec is successfully creating the ISAKMP/MM SA. Check for ISAKMP/MM SAs using the following command:

ipsec_report -mad

If there is no ISAKMP/MM SA, HP-UX IPSec may have created an ISAKMP/MM SA but deleted it when the IPSec/QM SA negotiation failed. Check the audit log for failed attempts to establish ISAKMP/MM SAs using the following command:

ipsec_report -audit /var/adm/ipsec/auditdateinfo.log

Check the log file for IKMPD Main Mode processing failed error entries such as the following:

Msg: 31 From: IKMPD LVL: ERROR Date: Wed Oct 31 11:44:10 2001

Event: Main Mode processing failed

Also check the log file for MM negotiation timeout error entries such as the following:

Chapter 5

173