Document Outline

• N0RTEL
  • Contents
  • Figures
  • Contents
  • About this document
    • Overview
    • Related versions
    • Intended audience
    • Organization
    • Conventions
      • General conventions
      • Command conventions
      • GUI conventions
      • Keyboard operation
      • Mouse operation
    • Update history
      • Updates in Issue 1.0 ( 6 June 2008 )
  • Contents
  • Figures
• 1
  • AAA troubleshooting
    • About this chapter
    • 1.1 AAA overview
      • 1.1.1 AAA and RADIUS
        • AAA
        • RADIUS
      • 1.1.2 Domains and address pool
        • Domains
        • Address pool
      • 1.1.3 Schemes and modes
        • Authentication schemes and modes
        • Authorization schemes and modes
        • Accounting schemes and modes
      • 1.1.4 Server templates
        • RADIUS server template
        • HWTACACS server template
    • 1.2 Troubleshooting local user authentication
      • 1.2.1 Typical networking
      • 1.2.2 Configuration notes
        • Configuring the serial interface on the client side
        • Configuring the serial interface on the host side
        • Configuring AAA on the host side
      • 1.2.3 Troubleshooting flowchart
        • Troubleshooting procedure
    • 1.3 Troubleshooting RADIUS authentication
      • 1.3.1 Typical networking
      • 1.3.2 Configuration notes
        • Configuring AAA
        • Enabling the FTP server
        • Configuring the RADIUS server
      • 1.3.3 Troubleshooting flowchart
      • 1.3.4 Troubleshooting procedure
    • 1.4 Troubleshooting cases
      • 1.4.1 FTP user fails to pass through RADIUS authentication
        • Fault symptom
        • Fault analysis
        • Troubleshooting procedure
        • Summary
    • 1.5 FAQs
      • Q: Nortel devices and non-Nortel devices use the same TACACS server but the authentication fails. Why?
      • Q: A Telnet user who passes RADIUS authentication cannot enter the system view? Why?
      • Q: How does AAA allocate addresses to PPP users?
      • Q: What are the common RADIUS attributes?
    • 1.6 Diagnostic tools
      • 1.6.1 Display commands
      • 1.6.2 Debugging commands
  • Contents
  • Figures
  • IPSec and IKE troubleshooting
    • About this chapter
    • 2.1 IPSec and IKE overview
      • Security Association
      • IPSec encapsulation modes
      • Authentication algorithms and encryption algorithms
      • Negotiation modes
      • IKE security mechanism
      • IKE exchange phases
      • IKE negotiation modes
    • 2.2 Troubleshooting manual IPSec SA setup
      • 2.2.1 Typical networking
      • 2.2.2 Configuration notes
        • Configuring an ACL
        • Configuring an IPSec proposal
        • Configuring an IPSec policy
        • Applying the IPSec policy
      • 2.2.3 Troubleshooting flowchart
      • 2.2.4 Troubleshooting procedure
    • 2.3 Troubleshooting ISAKMP SA
      • 2.3.1 Typical networking
      • 2.3.2 Configuration notes
        • Configuring the local ID for IKE
        • Configuring an IKE proposal
        • Configuring the IKE peer
      • 2.3.3 Troubleshooting flowchart
      • 2.3.4 Troubleshooting procedure
    • 2.4 Troubleshooting SA setup using an IPSec policy template
      • 2.4.1 Typical networking
      • 2.4.2 Configuration notes
        • Configuring an IKE proposal
        • Configuring an IKE peer
        • Configuring an IPSec proposal
        • Configuring an IPSec policy template
        • Configuring an IPSec policy
        • Applying an IPSec policy group
      • 2.4.3 Troubleshooting flowchart
      • 2.4.4 Troubleshooting procedure
    • 2.5 Troubleshooting NAT traversal in the IPSec tunnel
      • 2.5.1 Typical networking
      • 2.5.2 Configuration notes
        • Router B
        • Configuring routes
      • 2.5.3 Troubleshooting flowchart
      • 2.5.4 Troubleshooting procedure
    • 2.6 Troubleshooting GRE over IPSec or L2TP over IPSec
      • 2.6.1 Typical networking
      • 2.6.2 Configuration notes
        • Configuring IKE proposals
        • Configuring the IKE peer
        • Configuring an ACL
        • Configuring an IPSec proposal
        • Configuring an IPSec policy
        • Applying the IPSec policy group
      • 2.6.3 Troubleshooting flowchart
      • 2.6.4 Troubleshooting procedure
    • 2.7 Troubleshooting cases
      • Fault symptom
      • Fault analysis
      • Troubleshooting procedure
      • Summary
    • 2.8 FAQs
      • Q: In an unstable network, SAs cannot be set up or SAs are set up but the communication between peers fails although the ACLs have matching security proposals. Why?
      • Q. During IPSec debugging, the message "Got NOTIFY of type NO_PROPOSAL_CHOSEN or drop message from A.B.C.D due to notification type NO_PROPOSAL_CHOSEN" is displayed. What does this indicate?
      • Q. How do I validate modified IPSec or IKE configurations?
      • Q: Is the IPSec tunnel the same as the SA?
      • Q: What are guidelines for ACL used in IPSec?
      • Q: Can AH and ESP be used at the same time?
      • Q: Can ESP perform only packet encryption but not authentication?
      • Q: Can transport mode be used when the communication port and IPSec tunnel port are different?
      • Q: What are the constraints on configuring encryption and authentication shared keys manually?
      • Q: Can an SA that is set up using an IPSec policy template initiate an SA negotiation?
      • Q: Why do I not need to specify the local IP address in the IPSec tunnel?
    • 2.9 Diagnostic tools
      • 2.9.1 Display commands
        • display ipsec proposal name
        • display ipsec policy name
        • display ipsec sa policy
        • display ipsec sa brief
        • display ike proposal
        • display ike peer name
        • display ike sa
        • display ipsec statistics
      • 2.9.2 Debugging commands
        • debugging ipsec packet
        • debugging ike error
  • Contents
  • Figures
  • Tables
• 3
  • Firewall troubleshooting
    • About this chapter
    • 3.1 Firewall
      • Concepts
      • Implementation
    • 3.2 Troubleshooting the firewall
      • 3.2.1 Networking environment
      • 3.2.2 Configuration notes
      • 3.2.3 Diagnostic flowchart
      • 3.2.4 Troubleshooting procedures
        • Checking the connectivity of the network
        • Checking that the ACL rule is correct
        • Checking that the traffic classification rule is correct
        • Checking that the traffic behavior is correct
        • Checking that the traffic policy is correct
        • Checking that the correct policy is applied on the interface
    • 3.3 FAQs
    • 3.4 Diagnostic tools
      • display this
      • display this interface
      • display traffic policy user-defined
      • display traffic behavior user-defined
      • display traffic classifier user-defined
  • Contents
  • Figures
  • Tables
• 4
  • NAT troubleshooting
    • About This Chapter
    • 4.1 NAT
      • 4.1.1 NAT attributes
      • 4.1.2 NAT modes
      • 4.1.3 Special protocols supported by the address translation
    • 4.2 Troubleshooting NAT Troubleshooting
      • 4.2.1 Typical Networking
        • NAT
        • Load Balancing, Flow Control, Speed Control, and BT Flow Control on the NAT Server
      • 4.2.2 Configuration notes
      • 4.2.3 Troubleshooting flowchart
      • 4.2.4 Troubleshooting procedures
    • 4.3 Troubleshooting cases
      • 4.3.1 Internal Network Cannot Successfully Ping the External Network After NAT Is Configured on the Router
        • Networking
        • Fault Analysis
        • Troubleshooting procedure
        • Summary
    • 4.4 FAQs
    • 4.5 Diagnostic tools
      • 4.5.1 Display commands
        • display firewall session aging-time
        • display firewall servermap
        • display firewall session statistic
        • display firewall session table
        • display nat address-group
        • display nat alg
        • display nat car-class
        • display nat car-bt
        • display nat connection-class
        • display nat flow-control
        • display nat inside-ip
        • display nat outbound
        • display nat server
        • display nat all
      • 4.5.2 Debugging commands
        • debugging nat-alg information
        • debugging nat-alg packet
        • debugging nat-alg server-map
  • Contents
  • Index