Chapter 51 Troubleshooting

I cannot set up an IPSec VPN tunnel to another device.

If the IPSec tunnel does not build properly, the problem is likely a configuration error at one of the IPSec routers. Log into both ZyXEL IPSec routers and check the settings in each field methodically and slowly. Make sure both the ZyWALL and remote IPSec router have the same security settings for the VPN tunnel. It may help to display the settings for both routers side-by-side.

Here are some general suggestions. See also Chapter 23 on page 375.

•The system log can often help to identify a configuration problem.

•If you enable NAT traversal, the remote IPSec device must also have NAT traversal enabled.

•The ZyWALL and remote IPSec router must use the same authentication method to establish the IKE SA.

•Both routers must use the same negotiation mode.

•Both routers must use the same encryption algorithm, authentication algorithm, and DH key group.

•When using manual keys, the ZyWALL and remote IPSec router must use the same encryption key and authentication key.

•When using pre-shared keys, the ZyWALL and the remote IPSec router must use the same pre-shared key.

•The ZyWALL’s local and peer ID type and content must match the remote IPSec router’s peer and local ID type and content, respectively.

•The ZyWALL and remote IPSec router must use the same active protocol.

•The ZyWALL and remote IPSec router must use the same encapsulation.

•The ZyWALL and remote IPSec router must use the same SPI.

•If the sites are/were previously connected using a leased line or ISDN router, physically disconnect these devices from the network before testing your new VPN connection. The old route may have been learnt by RIP and would take priority over the new VPN connection.

•To test whether or not a tunnel is working, ping from a computer at one site to a computer at the other.

Before doing so, ensure that both computers have Internet access (via the IPSec routers).

•It is also helpful to have a way to look at the packets that are being sent and received by the ZyWALL and remote IPSec router (for example, by using a packet sniffer).

Check the configuration for the following ZyWALL features.

•The ZyWALL does not put IPSec SAs in the routing table. You must create a policy route for each VPN tunnel. See Chapter 13 on page 281.

 

767

ZyWALL USG 50 User’s Guide