24
3.
Display the IPsec policy configuration on the initiator and the receiver. The following shows the
IPsec policy configuration on the receiver:
ipsec policy hzbank 7000 isakmp
transform-set 1
security acl 3000
ike-profile 1
reverse-route dynamic
reverse-route tag 10
4.
Verify that the transform set configuration (such as the encryption and authentication algorithms)
is consistent on both devices.
5.
Check whether the remote IP address is configured in the IPsec policy. If not, configure the
remote IP address in the IPsec policy, for example:
[Router]ipsec policy hzbank 7000 isakmp
[Router-ipsec-policy-isakmp-hzbank-7000]remote-address 10.1.1.1
NOTE:
The initiator and the receiver must specify the remote IP address of the IPsec tunnel by using
the
remote-address
command in the IPsec policy. If the receiver uses an IPsec policy
template, the remote IP address configuration is optional on the receiver.
6.
Verify that the protection flows configuration is consistent on both devices.
IPsec uses ACLs to identify the traffic to be protected. Make sure the ACL rules in an IPsec
policy are correctly configured, and make sure the ACL rules on one device are the mirror
images of the rules on the peer device. For example, on IPsec peers A and B, if the ACL rule in
the IPsec policy on device B is b->a, the ACL rule in the IPsec policy on device A must be a->b.
If the ACL rules on IPsec peers do not form mirror images of each other, SAs can be set up only
when the range specified by an ACL rule on the initiator is covered by its counterpart ACL rule
on the receiver. For example:
The ACL on the initiator is as follows:
acl number 3001
rule 5 permit ip source 168.201.0.0 0.0.0.7 destination 168.68.2.200 0
The ACL on the receiver is as follows:
acl number 3000
rule 7 permit ip source 168.68.2.200 0 destination 168.201.0.0 0.0.127.255
NOTE:
If the receiver uses an IPsec policy template, the ACL is optional. If no ACL is specified, the
IPsec protection range has no limit. So the receiver accepts all ACL settings of the negotiation
initiator. If an ACL is configured, all the rules of the ACL must comply with the previous
requirements.
Related commands
This section lists the commands that you might use for troubleshooting IPsec.
Command Description
display ike sa
[
verbose
[
connection-id
connection-id
|
remote-address
[
ipv6
]
remote-address
[
vpn-instance
vpn-name
] ] ]
Displays detailed information about current IKE SAs.