WEBVTT

1
00:00.000 --> 00:08.000
So we just saw a lot of good show commands and more importantly debug commands

2
00:08.000 --> 00:08.440
that we

3
00:08.440 --> 00:12.280
can use for troubleshooting our IPsec connections.

4
00:12.280 --> 00:16.260
The problem is it's not going to help us a whole lot unless we know what the

5
00:16.260 --> 00:16.760
errors

6
00:16.760 --> 00:19.720
are that can occur and then how to fix them.

7
00:19.720 --> 00:23.200
So let's take a look here real quick at some of the most common errors that we

8
00:23.200 --> 00:23.880
'll run into

9
00:23.880 --> 00:32.600
with our IPsec VPNs and what those errors mean and consequently how to fix them
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

9
00:23.880 --> 00:32.600
with our IPsec VPNs and what those errors mean and consequently how to fix them

10
00:32.600 --> 00:32.600
.

11
00:32.600 --> 00:38.800
So the first error to discuss is the QM FSM error, FSM being finite state

12
00:38.800 --> 00:39.840
machine, but

13
00:39.840 --> 00:48.390
this error is due to a mismatch between the crypto ACLs on the configured peers

14
00:48.390 --> 00:48.840
.

15
00:48.840 --> 00:54.590
Now truth be told, if you're using a VTI, which remembers your virtual tunnel

16
00:54.590 --> 00:55.600
interface,

17
00:55.600 --> 01:01.840
this is not likely because we generally don't use these crypto map ACLs anymore
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

17
00:55.600 --> 01:01.840
this is not likely because we generally don't use these crypto map ACLs anymore

18
01:01.840 --> 01:02.340
because those

19
01:02.340 --> 01:06.720
were used to define the interesting traffic that was going to be encrypted.

20
01:06.720 --> 01:09.700
But now we're just going to encrypt all of the tunnel traffic.

21
01:09.700 --> 01:12.920
So this is not commonly done with a VTI.

22
01:12.920 --> 01:16.840
So some of the more important ones invalid local address.

23
01:16.840 --> 01:20.280
Well, this one's going to be fairly straightforward.

24
01:20.280 --> 01:25.770
This is when either the address used for the local identity is incorrect or the

25
01:25.770 --> 01:26.320
crypto

26
01:26.320 --> 01:30.000
map is applied to the wrong interface.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

27
01:30.000 --> 01:32.600
Now again, we're not using crypto maps.

28
01:32.600 --> 01:34.400
We're using a VTI.

29
01:34.400 --> 01:39.160
However, it could still be that the local identity is incorrect.

30
01:39.160 --> 01:44.260
So this is the one that would be more applicable in our current environment.

31
01:44.260 --> 01:49.330
This is a fairly common one that the Ike message from and the X is of course

32
01:49.330 --> 01:50.220
indicate the

33
01:50.220 --> 01:55.900
remote peer failed its sanity check or is malformed.

34
01:55.900 --> 01:58.500
Well this one's actually fairly straightforward.

35
01:58.500 --> 02:03.940
This is almost always going to be when the pre shared keys on each side.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

35
01:58.500 --> 02:03.940
This is almost always going to be when the pre shared keys on each side.

36
02:03.940 --> 02:05.260
Don't match.

37
02:05.260 --> 02:07.100
They are mismatched.

38
02:07.100 --> 02:09.780
Very very common mistake happens a lot.

39
02:09.780 --> 02:13.420
So this is going to be a really common one to watch out for.

40
02:13.420 --> 02:16.420
Of course, only if you're using pre shared keys.

41
02:16.420 --> 02:20.180
But again, fairly common problem.

42
02:20.180 --> 02:22.900
Transform proposal not supported.

43
02:22.900 --> 02:29.900
This is when your phase two or your IP sec policies do not match.

44
02:29.900 --> 02:34.930
If your IP sec policies do not have a shared set of parameters that they can
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

44
02:29.900 --> 02:34.930
If your IP sec policies do not have a shared set of parameters that they can

45
02:34.930 --> 02:35.580
agree on.

46
02:35.580 --> 02:39.370
Remember, there can be multiple choices on how we're going to do encryption and

47
02:39.370 --> 02:39.700
such.

48
02:39.700 --> 02:44.180
But they have to have at least one in common that they can agree on.

49
02:44.180 --> 02:48.600
And if they do not have that, well then the tunnel is not going to come up and

50
02:48.600 --> 02:49.060
this is

51
02:49.060 --> 02:50.500
the error that you'll get.

52
02:50.500 --> 02:54.020
So here you would want to just review your configuration.

53
02:54.020 --> 02:57.340
This is again a common one that we're not going to get.

54
02:57.340 --> 02:59.620
Proxy identity is not supported.

55
02:59.620 --> 03:05.390
Well once again, this is talking about the access lists not matching for the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

55
02:59.620 --> 03:05.390
Well once again, this is talking about the access lists not matching for the

56
03:05.390 --> 03:06.940
list of peers.

57
03:06.940 --> 03:09.410
And again, we're not going to generally be using that here because we're using

58
03:09.410 --> 03:10.540
our tunnel

59
03:10.540 --> 03:13.900
and the tunnel peer is going to be the tunnel destination.

60
03:13.900 --> 03:18.780
So again, this is not going to be very common one for a VTI.

61
03:18.780 --> 03:23.790
The final error that we want to be aware of with IP sec is the no cert and no

62
03:23.790 --> 03:24.700
keys with

63
03:24.700 --> 03:26.380
remote peer.

64
03:26.380 --> 03:31.460
This error simply indicates that the configured peer address is incorrect.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

64
03:26.380 --> 03:31.460
This error simply indicates that the configured peer address is incorrect.

65
03:31.460 --> 03:34.540
And once again, like some of these other errors we've discussed, you're not

66
03:34.540 --> 03:34.940
going to

67
03:34.940 --> 03:40.700
see this very often with a VTI because the VTI of course, the peer address is

68
03:40.700 --> 03:41.140
actually

69
03:41.140 --> 03:43.540
the destination address of the tunnel.

70
03:43.540 --> 03:48.540
So that's probably not going to be incorrect, but it could still be incorrect

71
03:48.540 --> 03:49.580
in our policies.

72
03:49.580 --> 03:52.660
So always keep that in mind.

73
03:52.660 --> 03:57.880
So in this video, we took a look at some of the common IP sec errors that we'll

74
03:57.880 --> 03:58.340
see out

75
03:58.340 --> 04:02.100
of those debuggs that we looked at in the previous video.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

75
03:58.340 --> 04:02.100
of those debuggs that we looked at in the previous video.

76
04:02.100 --> 04:06.710
So that concludes everything that we need to discuss in this skill, which of

77
04:06.710 --> 04:07.500
course leaves

78
04:07.500 --> 04:10.140
us with just the challenge.

79
04:10.140 --> 04:11.780
So give that a shot.

80
04:11.780 --> 04:12.780
Good luck.

81
04:12.780 --> 04:15.580
And I'll see you in the solution video on the other side.

82
04:15.580 --> 04:23.780
[BLANK_AUDIO]