Troubleshooting VPN Connections

Table Of Contents

VPN Troubleshooting

VPN Troubleshooting    

VPN Troubleshooting: Specify Easy VPN Client

VPN Troubleshooting: Generate Traffic

VPN Troubleshooting: Generate GRE Traffic

Cisco SDM Warning: SDM will enable router debugs...

VPN Troubleshooting

---

Cisco SDM can troubleshoot VPN connections that you have configured. Cisco SDM reports the success or failure of the connection tests, and when tests have failed, recommends actions that you can take to correct connection problems.

The following link provides information on VPN troubleshooting using the CLI.

http://www.cisco.com/univercd/cc/td/doc/product/rtrmgmt/cw2000/cw2000_b/vpnman/vms_2_2/rmc13/useguide/u13_rtrb.htm

VPN Troubleshooting    

This window appear when you are troubleshooting a site-to-site VPN, a GRE over IPSec tunnel, an Easy VPN remote connection, or an Easy VPN server connection.

---

Note VPN Troubleshooting will not troubleshoot more than two peers for site-to-site VPN, GRE over IPsec, or Easy VPN client connections.

---

Tunnel Details

This box provides the VPN tunnel details.

Interface

Interface to which the VPN tunnel is configured.

Peer

The IP address or host name of the devices at the other end of the VPN connection.

Summary

Click this button if you want to view the summarized troubleshooting information.

Details

Click this button if you want to view the detailed troubleshooting information.

Activity

This column displays the troubleshooting activities.

Status

Displays the status of each troubleshooting activity by the following icons and text alerts:

	The connection is up.
	The connection is down.
	Test is successful.
	Test failed.

Failure Reason(s)

This box provides the possible reason(s) for the VPN tunnel failure.

Recommended action(s)

This box provides a possible action/solution to rectify the problem.

Close Button

Click this button to close the window.

Test Specific Client Button

This button is enabled if you are testing connections for an Easy VPN server configured on the router. Click this button and specify the client to which you want to test connectivity.

This button is disabled in the following circumstances:

•The Basic testing is not done or has not completed successfully.

•The IOS image does not support the required debugging commands.

•The view used to launch Cisco SDM does not have root privileges.

What Do You Want to Do?

If you want to:	Do this:
Troubleshoot the VPN connection.	Click Start button. When test is running, Start button label will change to Stop. You have option to abort the troubleshooting while test is in progress.
Save the test report.	Click Save Report button to save the test report in HTML format. This button is disabled when the test is in progress.

VPN Troubleshooting: Specify Easy VPN Client

This window allows you to specify the Easy VPN client which you want to debug.

IP Address

Enter IP address of Easy VPN client you want to debug.

Listen for request for X minutes

Enter the time duration for which Easy VPN Server has to listen to requests from Easy VPN client.

Continue Button

After selecting the traffic generation type you want, click this button to continue testing.

Close Button

Click this button to close the window.

VPN Troubleshooting: Generate Traffic

This window allows you to generate site-to-site VPN or Easy VPN traffic for debugging. You can allow Cisco SDM to generate VPN traffic or you can generate VPN traffic yourself.

VPN traffic on this connection is defined as

This area lists current VPN traffic on the interface.

Action

This column denotes whether the type of traffic is allowed in the interface.

Source

Source IP address.

Destination

Destination IP address.

Service

This column lists the type of traffic on the interface.

Log

This column indicates whether logging is enabled for this traffic.

Attributes

Any additional attributes defined.

Have SDM generate VPN Traffic

Select this option if you want Cisco SDM to generate VPN traffic on the interface for debugging.

---

Note Cisco SDM will not generate VPN traffic when the VPN tunnel traffic is from non-IP based Access Control List (ACL) or when the applied and current CLI View is not root view.

---

Enter the IP address of a host in the source network

Enter the host IP address in the source network.

Enter the IP address of a host in the destination network

Enter the host IP address in the destination network.

I will generate VPN traffic from the source network

Select this option if you want to generate VPN traffic from the source network.

Wait interval time

Enter the amount of time in seconds that the Easy VPN Server is to wait for you to generate source traffic. Be sure to give yourself enough time to switch to other systems to generate traffic.

Continue Button

After selecting the traffic generation type you want, click this button to continue testing.

Close Button

Click this button to close the window.

VPN Troubleshooting: Generate GRE Traffic

This screen appears if you are generating GRE over IPSec traffic.

Have SDM generate VPN Traffic

Select this option if you want Cisco SDM to generate VPN traffic on the interface for debugging.

Enter the remote tunnel IP address

Enter the IP address of the remote GRE tunnel. Do not use the address of the remote interface.

I will generate VPN traffic from the source network

Select this option if you want to generate VPN traffic from the source network.

Wait interval time

Enter the amount of time in seconds that the Easy VPN Server is to wait for you to generate source traffic. Be sure to give yourself enough time to switch to other systems to generate traffic.

Continue Button

After selecting the traffic generation type you want, click this button to continue testing.

Close Button

Click this button to close the window.

Cisco SDM Warning: SDM will enable router debugs...

This window appears when Cisco SDM is ready to begin advanced troubleshooting. Advanced troubleshooting involves delivering debug commands to the router waiting for results to report, and then removing the debug commands so that router performance is not further affected.

This message is displayed because this process can take several minutes and may affect router performance.