Key Management (IKE)
299
IPLink Software Configuration Guide
26 • VPN configuration
profile ipsec-policy-isakmp VPN
authentication-method pre-shared-key sdfkl@hgdslkfs/iuçkfld$gus+ghf
mode tunnel
peer 1.2.3.4
diffie-hellman-group group2
use profile ipsec-transform 1 IPSEC_3DES_192
use profile isakmp-transform 1 ISAKMP_3DES_192
context ip
interface WAN
use profile acl WAN_Out out
Troubleshooting
To analyze IKe configuration or networking problems, use the following debug monitors that log important
information about the exchanged ISAKMP messages:
•
debug ike event
This monitor prints every ISAKMP message sent or received as well as the current state of the ISAKMP main
and quick modes.
•
debug ike error
Τ
his monitor prints information about errors detected during the ISAKMP exchange. In addition to the mon-
itors there are also show commands, which display current information about IKE and IPSEC.
•
show ike policy <policy-name>
Displays information about the configuration options of specific policy as well as an indication, if the policy is
valid or not. A policy might be invalid, if one or more configuration option is missing.
•
show ike status
Displays information about the state of current IKE main and quick modes.
•
show ipsec security-associations
Displays information about currently established IPSEC security associations including SPIs, peer IP addresses
and security association lifetime.
Using an alternate source IP address for specific destinations
Normally, locally originated IP packets use the IP address of the outbound IP interface as their source address.
However, when using VPN tunnels there are situations, where locally originated IP packets must be sent using
the source IP address of an alternate interface. You can specify using the following command that for one or
more destination network the IP address of an alternate IP interface should be used. This configuration com-
mand affects all locally originated IP packets except those, which originate from explicitly bound components.