Eicon Networks SHIVA 1100, Administrator'S Manual, Page: 92 / 136

IPSec
92 System Administrator’s Guide
The remote party does not support Dead Peer Detection according to
draft-ietf-ipsec-dpd-00.txt
Solution: Enable Dead Peer Detection support for the tunnel. Unless the remote party
supports draft-ietf-ipsec-dpd-00.txt, Dead Peer Detection will not be used.
Symptom: Tunnels using X.509 certificate authentication do not work
Possible Cause: The date and time settings on the Shiva VPN Gateway has not been
configured correctly.
The certificates have expired.
The Distinguished Name of the remote party has not be configured correctly on the
Shiva VPN Gateway's tunnel.
The certificates do not authenticate correctly against the CA certificate.
The remote party's settings are incorrect.
Solution: Confirm that the certificates are valid. Confirm also that the remote party's
tunnel settings are correct. Check the Distinguished Name entry in the Shiva VPN
Gateway's tunnel configuration is correct.
Symptom: Remote hosts can be accessed using IP address but not by
name
Possible cause: Windows network browsing broadcasts are not being transmitted
through the tunnel.
Solution: Set up a WINS server and use it to have the remote hosts resolve names to
IP addresses.
Set up LMHOST files on remote hosts to resolve names to IP addresses.
Symptom: Tunnel comes up but the application does not work across
the tunnel.
Possible cause: There may be a firewall device blocking IPSec packets.
The MTU of the IPSec interface may be too large.
The application uses broadcasts packets to work.
Solution: Confirm that the problem is the VPN tunnel and not the application being run.
These are the steps you can try to find where the problem is (it is assumed that a
network to network VPN is being used):
Ping from your computer to the Internet IP address of the remote party (it assumed
that the remote party is configured to accept incoming pings)
Ping from your computer to the LAN IP address of the remote party.
Ping from your computer to a computer on the LAN behind the remote party that the
tunnel has been configured to combine.
If you cannot ping the Internet IP address of the remote party, either the remote party
is not online or your computer does not have its default gateway as the Shiva VPN
Gateway. If you can ping the Internet IP address of the remote party but not the LAN
IP address, then the remote party's LAN IP address or its default gateway has not
been configured properly. Also check your network configuration for any devices
filtering IPSec packets (protocol 50) and whether your Internet Service Provider is
filtering IPSec packets. If you can ping the LAN IP address of the remote party but not
a host on the remote network, then either the local and/or remote subnets of the tunnel
settings have been misconfigured or the remote host does not have its default
gateway as the remote party.