Eicon Networks SHIVA 1100, Administrator'S Manual, Page: 90 / 136

IPSec
90 System Administrator’s Guide
Enable/disable
One or more tunnel can be enabled or disabled by checking the checkbox to the right
of the tunnel, and clicking Enable or Disable under the Tunnel List menu.
Delete
One or more tunnel can be enabled or disabled by checking the checkbox to the right
of the tunnel, and clicking Delete under the Tunnel List menu.
NAT traversal support
NAT Traversal allows tunnels to be established when the IPSec endpoints reside
behind NAT devices. If any NAT devices are detected, the NAT Traversal feature is
automatically used. It cannot be configured manually on the Shiva VPN Gateway.
Dynamic DNS Support
Internet Service Providers generally charge higher fees for static IP addresses than
for dynamic IP addresses when connecting to the Internet. The Shiva VPN Gateway
can reduce costs since it allows tunnels to be established with both IPSec endpoints
having dynamic IP addresses. The two endpoints must, however, be Shiva VPN
Gateways and at least one end must have dynamic DNS enabled. The Shiva VPN
Gateway supports a number of dynamic DNS providers. When configuring the tunnel,
select the DNS hostname address type for the IPSec endpoint that has dynamic DNS
supported and enable Dead Peer Detection. If the IP address of the Shiva VPN
Gateway's DNS hostname changes, the tunnel will automatically renegotiate and
establish the tunnel.
Troubleshooting
Symptom: IPSec is not running and is enabled.
Possible Cause: The Shiva VPN Gateway has not been assigned a default gateway.
Solution: Ensure the Shiva VPN Gateway has a default gateway by configuring the
Internet connection on the Connect to Internet page or assigning a default gateway on
the IP Configuration page.
Symptom: Tunnel is always down even though IPSec is running and the
tunnel is enabled.
Possible Cause: The tunnel is using Manual Keying and the encryption and/or
authentication keys are incorrect.
The tunnel is using Manual Keying and the Shiva VPN Gateway's and/or remote
party's keys do not correspond to the Cipher and Hash specified.
Solution: Configure a correct set of encryption and/or authentication keys. Select the
appropriate Cipher and Hash that the key have been generated from, or change the
keys used to use the selected Cipher and Hash.
Symptom: Tunnel is always Negotiating Phase 1.
Possible Cause: The remote party does not have an Internet IP address (a No route
to host message is reported in the system log).
The remote party has IPSec disabled (a Connection refused message is reported in
the system log).