IPSec SA local duration(traffic based): 1843200 kilobytes IPSec SA local duration(time based): 3600 seconds Run the display ipsec policy command to check the IPSec SA triggering mode.The following lists two IPSec fault trees: IPSec tunnel setup failure and abnormal IPSec services. Understanding the overall troubleshooting roadmap helps network administrators quickly locate and process faults. For complex faults, the network administrator can analyze triggering causes layer by layer based on the fault symptom and IPSec working principles to find the root cause. Such faults need to be processed based on the specific scenario.ĭuring routine maintenance or after receiving a fault report, a network administrator can find the troubleshooting guidance by referring to this figure. Usually, other IPSec faults are caused by incorrect feature configurations, such as interfaces, Access Control Lists (ACLs), routes, and network address translation (NAT). You can carry out in-depth analysis on the IKE negotiation process.

IKE SA or IPSec SA negotiation failure is the core issue in IPSec faults. Data transmission stage: Services are abnormal (interrupted or of poor quality) after successful IPSec tunnel setup.Tunnel setup stage: An IKE SA or IPSec SA negotiation failure leads to an IPSec tunnel setup failure.

Service triggering stage: Internet Key Exchange (IKE) negotiation is not triggered.

You can also analyze faults according to the stage in which a fault occurs. The preceding figure analyzes faults by symptom.

Fortigate debug ipsec