D-Link DFL-2500 - Manual (Page 239)

IPsec Tunnel Local Net Remote Net Remote GW
------------ -------------- ------------ -------------
L2TP_IPSec 214.237.225.43 84.13.193.179 84.13.193.179
IPsec_Tun1 192.168.0.0/24 172.16.1.0/24 82.242.91.203
To examine the first IKE negotiation phase of tunnel setup use:
> ipsecstat -ike
To get complete details of tunnel setup use:
> ipsecstat -u -v
The ikesnoop console command
A common problem with setting up IPsec is a proposal list that is unacceptable to the device at the
other end of the tunnel. The ikesnoop command can show up problems with the proposal list by
showing the details of the negotiations that take place.
ikesnoop verbose
Once this command is issued, an ICMP ping can be then sent to the D-Link Firewall from the other
end of the tunnel. This will cause ikesnoop verbose to output details of the tunnel setup.
Incompatibilities in the proposal lists for IKE and/or IPsec can often cause problems which show up
in this output.
If there are multiple tunnels in a setup or mutiple clients on a single tunnel then the output from
ikesnoop verbose can be overwhelming. It is therefore better to specify that the output come from a
single tunnel by specifying the client's IP address:
ikesnoop verbose <ip-address>
Management Interface Failure with VPN
If any VPN tunnel is set up and then the management interface no longer operates then it is likely to
be a problem with the management traffic being routed back through the VPN tunnel instead of the
correct interface.
This happens when a route is established in the main routing table which routes any traffic for
all-nets through the VPN tunnel. If the management interface is not reached by the VPN tunnel then
the administrator needs to create a specific route that routes management interface traffic leaving the
D-Link Firewall back to the management subnet.
When any VPN tunnel is defined, an all-nets route is automatically defined in the routing table so
the administrator should always set up a specific route for the management interface to be correctly
routed.
9.2.7. VPN Troubleshooting Chapter 9. VPN
239