Troubleshooting IPsec VPN Connection with IKEv2
This article describes how to troubleshoot IPsec VPN connection with IKEv2 on Aviatrix gateway.
Check External Connection (S2C) Connection Status
In CoPilot, go to Networking > Connectivity > External Connections (S2C). Check if there is a green or red dot next to the name of the external connection.
You can also check external connection status from Diagnostics > Cloud Routes > External Connections (look at the Status and Tunnel Status columns).
If the Tunnel Status is down, you can perform the following procedure.
Perform the Analysis Diagnostics Action
-
Go to Diagnostics > Diagnostic Tools > Connectivity Diagnostics.
-
Select the Gateway Instance and the related Connection.
-
Select Analysis in the Tools list and click Run. The screen will display analysis results.
Troubleshoot the keyword in the Diagnostics Action "Show logs"
-
Go to Diagnostics > Diagnostic Tools > Connectivity Diagnostics.
-
Select the Gateway Instance and the related Connection.
-
Select Logs in the Tools list.
-
(optional) Enable or disable verbose logging.
-
Click Run. The screen displays the related logs. You can copy the results to the clipboard.
Examples of IKEvs Negotiation Failure
Here are some examples of negotiation failure related troubleshooting hints:
Keyword | Probable Causes | Suggestions |
---|---|---|
Error: Failed to deliver message to gateway |
Aviatrix Controller cannot reach gateway |
|
Establishing IKE_SA failed, peer not responding |
Peer IP address is mismatched, or peer IP address is not reachable UDP port 500/4500 is not accessible |
Troubleshoot connectivity between the Aviatrix Gateway and the peer VPN router. |
NO_PROPOSAL_CHOSEN |
Peer IP address is mismatched, or peer IP address is not reachable IKE version is mismatched (one VPN gateway uses IKEv1 and another uses IKEv2) IKEv2 algorithm is mismatched IPsec algorithm is mismatched |
Troubleshoot connectivity between Aviatrix gateway and peer VPN router Verify that both VPN settings use the same IKEv2 version Verify that all IKEv2/IPsec algorithm parameters (i.e., Authentication/DH Groups/Encryption) match on both VPN configuration |
AUTHENTICATION_FAILED |
IKE version is mismatched (one VPN gateway uses IKEv1 and another uses IKEv2) Pre-shared key is mismatched Identifier configuration is mismatched |
Verify that both VPN settings use the same IKEv2 version Verify that pre-shared key match on both VPN configuration Verify that Identifiers match; by default, Aviatrix utilizes the gateway’s public IP as the Local Identifier. |
no shared key found |
IKE version is mismatched (one VPN gateway uses IKEv1 and another uses IKEv2) Identifier configuration is mismatched |
Verify that both VPN settings use the same IKEv2 version Verify that identifiers match; by default, Aviatrix utilizes the gateway’s public IP as the Local Identifier. |
failed to establish CHILD_SA, keeping IKE_SA |
IPsec algorithm is mismatched |
Verify that all IPsec algorithm parameters (i.e., Authentication/DH Groups/Encryption) match on both VPN configurations. |