Amer Networks E5Web GUI - Manual (Page 651)

For example, with a large number of tunnels avoid using:
Device:/> ipsecstat -num=all
Another example of what to avoid with many tunnels is:
Device:/> ipsectunnels -num=all
In these circumstances, using the option with a small number, for example -num=10, is
recommended.
The ikesnoop console command
A common problem with setting up IPsec is a list of proposed algorithms that is unacceptable to
the device at the other end of the tunnel. The ikesnoop command is a useful tool for diagnosing
incompatible algorithm proposal lists by showing the details of negotiations during tunnel
setup. The basic form of this command is:
Device:/> ikesnoop -on -verbose
Once issued, an ICMP ping can then be sent to the Clavister Security Gateway from the remote
end of the tunnel. This will cause ikesnoop to output details of the tunnel setup negotiation to
the console and any algorithm proposal list incompatibilities can be seen.
If there are multiple tunnels in a setup or multiple clients on a single tunnel then the output from
verbose option can be overwhelming. It is therefore better to specify that the output comes from
a single tunnel by specifying the IP address of the tunnel's endpoint (this is either the IP of the
remote endpoint or a client's IP address). The command takes the form:
Device:/> ikesnoop -on -verbose
Ikesnoop can be turned off with the command:
Device:/> ikesnoop -off
For a more detailed discussion of this topic, see Section 9.4.5, “Troubleshooting with ikesnoop”.
9.8.4. Management Interface Failure with VPN
If any VPN tunnel is set up and then the management interface no longer operates then it is likely
to be a problem with the management traffic being routed back through the VPN tunnel instead
of the correct interface.
This happens when a route is established in the main routing table which routes any traffic for
all-nets through the VPN tunnel. If the management interface is not reached by the VPN tunnel
then the administrator needs to create a specific route that routes management interface traffic
leaving the Clavister Security Gateway back to the management sub-network.
9.8.5. Specific Error Messages
This section will deal with specific error messages that can appear in log event messages with
VPN and what they indicate. The messages discussed are:
1. Could not find acceptable proposal / no proposal chosen.
2. Incorrect pre-shared key.
Chapter 9: VPN
651