Category Archives: VPN

Virtual Private Network

Site to Site VPN Troubleshooting

Recently I setup 3 or 4 site to site ipsec vpn’s on some cisco ISR routers (887’s and 1921’s) and while I have done this a few times before and I know the fundamental steps for the configuration I was caught out a few times not being able to bring the tunnel up on the first attempt.  I found that when I was interrupted in the middle of the config, I forgot where I was up to or I started to jump around config tasks instead of going back and taking a logical approach.

In the most recent instance I decided to make a few notes of basic troubleshooting steps I took to resolve the issue and so I didn’t forget I decided to blog them for next time and here they are:

Phase 1 Tunnel

  • Check that both routers can ping the peers public IP address
  • Check the policy encryption type is the same on both routers
  • Check the transform set is using the same encryption type on both routers
  • Check the crypto map peer ip addresses are the same
Phase 2 Tunnel
  • Check the crypto map on each router is referencing the correct ACL
  • Check each ACL to confirm that it is correctly matching the interesting traffic

Just a basic checklist for the next time your tunnel wont come up.