Nortel BCM50e, Configuration

Page: 296 / 311

296 Appendix K Log descriptions
N0115789
Table 79 Sample IKE key exchange logs
Log Message Description
Send <Symbol> Mode request to
<IP>Send <Symbol> Mode
request to <IP>
The Business Secure Router has started negotiation
with the peer.
Recv <Symbol> Mode request
from <IP>Recv <Symbol> Mode
request from <IP>
The Business Secure Router has received an IKE
negotiation request from the peer.
Recv:<Symbol>
IKE uses the ISAKMP protocol (refer to RFC2408 –
ISAKMP) to transmit data. Each ISAKMP packet
contains payloads of different types that show in the
log (see Table 81 ).
Phase 1 IKE SA process done
Phase 1 negotiation is finished.
Start Phase 2: Quick Mode
Phase 2 negotiation is beginning using Quick Mode.
!! IKE Negotiation is in
process
The Business Secure Router has begun negotiation
with the peer for the connection already, but the IKE
key exchange is not finished yet.
!! Duplicate requests with
the same cookie
The Business Secure Router has received multiple
requests from the same peer but it is still processing
the first IKE packet from that peer.
!! No proposal chosen
The parameters configured for Phase 1 or Phase 2
negotiations do not match. Check all protocols and
settings for these phases. For example, one party is
using 3DES encryption, but the other party is using
DES encryption, so the connection fails.
!! Verifying Local ID
failed!! Verifying Remote ID
failed
During IKE Phase 2 negotiation, both parties
exchange policy details, including local and remote
IP address ranges. If these ranges differ, the
connection fails.
!! Local / remote IPs of
incoming request conflict
with rule <#d>
If the security gateway is 0.0.0.0, the Business
Secure Router uses the peer Local Addr as its
Remote Addr. If this IP (range) conflicts with a
previously configured rule then the connection is not
allowed.
!! Invalid IP <IP start>/<IP
end>
The Local IP Addr range for the peer is invalid.
!! Remote IP <IP start> / <IP
end> conflicts
If the security gateway is 0.0.0.0, the Business
Secure Router uses Local Addr for the peer as its
Remote Addr. If a peer Local Addr range conflicts
with other connections, the Business Secure Router
does not accept VPN connection requests from this
peer.