304
Failure to establish an IPsec tunnel
Symptom
The expected IPsec tunnel cannot be established.
Analysis
Sometimes an IPsec tunnel cannot be established, or there is no way to communicate in the presence of
an IPsec tunnel in an unstable network. According to examination results, however, ACLs of both parties
are configured correctly, and proposals are also matched.
In this case, the problem is usually caused by the reboot of one router after the IPsec tunnel is
established.
Solution
•
Use
display ike sa
to check whether both parties have established an SA in phase 1.
•
Use
display ipsec sa policy
to check whether the IPsec policy on the interface has established IPsec
SA.
•
If the two commands show that one party has an SA but the other does not, use
reset ipsec sa
to
clear the IPsec SA that has no corresponding SA, use
reset ike sa
to clear the IKE SA that has no
corresponding IKE SA, and trigger SA re-negotiation.
ACL configuration error
Symptom
ACL configuration error results in data flow blockage.
Analysis
When multiple routers create different IPsec tunnels early or late, a router may have multiple peers. If the
router is not configured with ACL rule, the peers send packets to it to set up different IPsec tunnels in
different protection granularity. Because the priorities of IPsec tunnels are determined by the order in
which they are established, a router cannot interoperate with other peers in fine granularity when its
outbound packets are first matched with an IPsec tunnel in coarse granularity.
Solution
When a router has multiple peers, configure ACLs on the router to distinguish different data flows, and
try to avoid configuring overlapping ACL rules for different peers. If it is unavoidable, the subrules in fine
granularity should be configured with higher preferences.
