R2511-HP MSR Router Series Security Configuration Guide(V5)

220

[RouterB-Virtual-Ethernet0] pppoe-client dial-bundle-number 1

[RouterB-Virtual-Ethernet0] mac-address 0011-0022-0012

# Map the virtual Ethernet interface to a PVC on interface ATM 1/0.

[RouterB] interface atm 1/0

[RouterB-Atm1/0] pvc 0/100

[RouterB-atm-pvc-Atm1/0-0/100] map bridge virtual-ethernet 0

[RouterB-atm-pvc-Atm1/0-0/100] quit

Troubleshooting IKE

When you configure parameters to establish an IPsec tunnel, enable IKE error debugging to locate

configuration problems:

<Router> debugging ike error

Invalid user ID

Symptom

Invalid user ID.

Analysis

In IPsec, user IDs identify data flows and set up different IPsec tunnels for different data flows. The IP

address and username of a user are used as the user ID.

The following is the debugging information:

got NOTIFY of type INVALID_ID_INFORMATION

drop message from A.B.C.D due to notification type INVALID_ID_INFORMATION

Solution

Verify that the ACLs in the IPsec policies configured on the interfaces at both ends are compatible.

Configure the ACLs to mirror each other. For more information about ACL mirroring, see "Configuring

IPsec."

Proposal mismatch

Symptom

The proposals mismatch.

Analysis

The following is the debugging information:

got NOTIFY of type NO_PROPOSAL_CHOSEN

drop message from A.B.C.D due to notification type NO_PROPOSAL_CHOSEN

The two parties in the negotiation have no matched proposals.

Solution

For the negotiation in phase 1, look up the IKE proposals for a match.