R3166-R3206-HP High-End Firewalls VPN Configuration Guide-6PW101

36
[outbound ESP SAs]
spi: 89389742 (0x553faae)
proposal: ESP-ENCRYPT-DES ESP-AUTH-SHA1
sa duration (kilobytes/sec): 1843200/3600
sa remaining duration (kilobytes/sec): 1843199/3590
max received sequence-number: 5
udp encapsulation used for nat traversal: N
Troubleshooting IKE
When configuring parameters to establish an IPsec tunnel, enable IKE error debugging to locate
configuration problems:
<Firewall> debugging ike error
Invalid user ID
Symptom
Invalid user ID.
Analysis
In IPsec, user IDs are used to identify data flows and to set up different IPsec tunnels for different data
flows. Now, the IP address and username are used as the user ID.
The following is the debugging information:
got NOTIFY of type INVALID_ID_INFORMATION
Or
drop message from A.B.C.D due to notification type INVALID_ID_INFORMATION
Solution
Check that the ACLs in the IPsec policies configured on the interfaces at both ends are compatible.
Configure the ACLs to mirror each other. For more information about ACL mirroring, see the chapter
“IPsec configuration.”
Proposal mismatch
Symptom
The proposals mismatch.
Analysis
The following is the debugging information:
got NOTIFY of type NO_PROPOSAL_CHOSEN
Or
drop message from A.B.C.D due to notification type NO_PROPOSAL_CHOSEN
The two parties in the negotiation have no matched proposals.