User Manual - Configuration Guide (Volume 3)
Versatile Routing Platform Chapter 5
Configuration of IKE
5-8
Problem 1: Invalid user ID information
Troubleshooting: please follow the steps below.
User ID information is the data for the user originating IPSec communication to identify
itself. In practical applications we can use user ID to establish diff erent security path for
protecting different data streams. At present we use the user IP address to identify the
user.
got NOTIFY of type INVALID_ID_INFORMATION
or
drop message from A.B.C.D due to notification type INVALI D_ ID_INFORMATION
Check whether ACL contents in cryptomap configured at interfaces of both ends ar e
compatible. It is recommended for the user to configure ACL of both ends to m irror
each other.
Problem 2: Unmatched policy
Troubleshooting: please follow the steps below.
Enable the debug ike error command, you can see the debugging information.
got NOTIFY of type NO_PROPOSAL_CHOSEN
or
drop message from A.B.C.D due to notification type NO_PRO PO SAL_CHOSEN
Both parties of negotiation have no matched policy. Check the protocol used by
cryptomap configured on interfaces of both parties to see whether the encryption
algorithm and authentication algorithm are the same.
Problem 3: Unable to establish security channel
Troubleshooting: please follow the steps below.
Check whether the network is stable and the security chann el is established correctly.
Sometimes there is a security channel but there is no way to com municate, and ACL of
both parties are checked to be configured correctly, and there is also matched policy. In
this case, the problem is usually cased by the restart of one router after the securit y
channel is established.
Solution:
1) Use the command show crypto ike sa to check whether both part ies have
established SA of Phase 1.
2) Use the command show crypto ipsec sa map to check whether the cryptomap
on interface has established IPSec SA.
3) If the above two results show that one party has SA but the other does not, then
use the command clear crypto ike sa to clear SA with error and re-originate
negotiation.