* IPSec troubleshooting guide for VPN administrators
A few days ago, I got an e-mail from a support tech who works overseas for a large maker of small routers that shall remain nameless.
The tech couldn’t establish an IPSec VPN connection between a local PC and a remote IPSec concentrator. He was pretty sure the router was configured to allow the connection, but didn’t know whether the IPSec client software on the PC was. Could I help?
I tell the story because even now, when VPN client software is included in Microsoft operating systems and IPSec vendors have been trying for interoperability for years, problems still arise. And there are still some pretty knowledgeable people having trouble figuring out the answers.
Recognizing this continuing need, ICSA Labs, the testing and certification people, have published a troubleshooting guide for VPN administrators. The document, called “Advanced Troubleshooting of Interoperability Problems with IPSec Products” (see link below) is written without any particular vendors in mind.
It explains IPSec configuration issues in general and directs readers to the specific documentation that comes with specific products for more detail. It walks users through check lists to make sure they have set the multiple parameters properly and that they are compatible with other end devices on the VPN. It even details how to use sniffers and logs of VPN activity to figure out what’s wrong.
The guide also presents a step-by-step account of how IPSec works, so that with a little study, readers can feel informed and need not feel like they are blindly following instructions.
The tone of the paper is that of a knowledgeable, helpful colleague – something we can all use from time to time. Check it out.
