ZyXEL Communications ZyWall USG20-VPN, Руководство пользователя

Страница: 641 / 683

Chapter 36 Troubleshooting
USG20(W)-VPN Series User’s Guide
641
The USG keeps resetting the connection.
If an alternate gateway on the LAN has an IP address in the same subnet as the USG’s LAN IP
address, return traffic may not go through the USG. This is called an asymmetrical or “triangle”
route. This causes the USG to reset the connection, as the connection has not been acknowledged.
You can set the USG’s security policy to permit the use of asymmetrical route topology on the
network (so it does not reset the connection) although this is not recommended since allowing
asymmetrical routes may let traffic from the WAN go directly to the LAN without passing through
the USG. A better solution is to use virtual interfaces to put the USG and the backup gateway on
separate subnets. See
Asymmetrical Routes on page 321 and the chapter about interfaces for more
information.
I cannot set up an IPSec VPN tunnel to another device.
If the IPSec tunnel does not build properly, the problem is likely a configuration error at one of the
IPSec routers. Log into both ZyXEL IPSec routers and check the settings in each field methodically
and slowly. Make sure both the USG and remote IPSec router have the same security settings for
the VPN tunnel. It may help to display the settings for both routers side-by-side.
Here are some general suggestions. See also Chapter 21 on page 333 .
• The system log can often help to identify a configuration problem.
• If you enable NAT traversal, the remote IPSec device must also have NAT traversal enabled.
• The USG and remote IPSec router must use the same authentication method to establish the IKE
SA.
• Both routers must use the same negotiation mode.
• Both routers must use the same encryption algorithm, authentication algorithm, and DH key
group.
• When using pre-shared keys, the USG and the remote IPSec router must use the same pre-
shared key.
• The USG’s local and peer ID type and content must match the remote IPSec router’s peer and
local ID type and content, respectively.
• The USG and remote IPSec router must use the same active protocol.
• The USG and remote IPSec router must use the same encapsulation.
• The USG and remote IPSec router must use the same SPI.
• If the sites are/were previously connected using a leased line or ISDN router, physically
disconnect these devices from the network before testing your new VPN connection. The old
route may have been learnt by RIP and would take priority over the new VPN connection.
• To test whether or not a tunnel is working, ping from a computer at one site to a computer at the
other.
Before doing so, ensure that both computers have Internet access (via the IPSec routers).
• It is also helpful to have a way to look at the packets that are being sent and received by the USG
and remote IPSec router (for example, by using a packet sniffer).