PeteLong:
Thanks. That is certainly a help...I'll keep the notes, particularly on the definitions of the status codes.
We have about 15-17 Site2Site VPNs on a Shiva VPN concentrator and are going to move them to the ASA. We have a few of the "easy" ones - the ones connecting to other ISA boxes. I can build the tunnels, but didn't know the commands to "see" the tunnel in the process of being built.
I am currently using the following to watch status of the tunnel:
no debug all
debug crypto isakmp 4
term mon
Can you add to this?
Main Topics
Browse All Topics
by: PeteLongPosted on 2008-08-27 at 08:26:59ID: 22325864
Troubleshoot Cisco VPN
(Version 7 and above)
Step 1 Make sure Phase 1 completes
On the Firewall
hostname# show crypto isakmp sa
Active SA: 1
Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
Total IKE SA: 1
1 IKE Peer: 123.123.123.123
Type : L2L Role : initiator
Rekey : no State : MM_ACTIVE
Where 123.123.123.123 is the IP address of the other end of the VPN tunnel MM_ACTIVE indicates that phase 1 has completed.
Type L2L (Lan to Lan) Means its a site to site VPN (RA (Remote Access) means Client to Gateway).
Role "initiator" means this side brought the tunnel up "responder" means the other end brought the tunnel up.
Note MM_ACTIVE means you are using Main Mode and its connected (On a v6 firewall it would say QM_IDLE if it was connected)
AM_ACTIVE means you are using Agressive Mode and its connected
MM_KEY_EXCH means Device Authentication Failed check the pre shared keys match
AG_INIT_EXCH means Device Authentication Failed check the pre shared keys match
MM_NO_STATE main mode has failed check phase 1 matches on both ends.
MM_KEY_EXCH means the shared sectret is wrong or the peer IP address is wrong.
MM_WAIT_MSG2 Main mode you have sent the phase one proposal to the other end and are waiting for the reply.
Possible Causes: There is no connectivity or traffic is getting dropped, or the other end has stalled.
Try: put "isakmp keepalive 20" on both ends (dead peer detection) reboot both ends.
Ensure UDP Ports 500 and 4500 are open from SA to SA
AM_WAIT_MSG2 Aggressive mode you have sent the phase one proposal to the other end and are waiting for the reply.
Possible Causes: There is no connectivity or traffic is getting dropped, or the other end has stalled.
Try: put "isakmp keepalive 20" on both ends (dead peer detection) reboot both ends.
Ensure UDP Ports 500 and 4500 are open from SA to SA