Hi,
I don't have a great deal of time free at the moment and don't use WebUI so will have to find some sutitable screen shots from the web. I will try to get back to this later today once I have cleared some other work but take a look at the stuff below which should help:
The most important thing to remember is that both ends of the VPN have to share the same encryption settings.The following is a list of which VPN settings must be set the same on both ends of the tunnel.These settings are for both routebased and policy-based VPNs.
■ Phase 1 key management protocol—for example, IKE
■ Phase 1 encryption algorithm to encrypt the key—for example, DES, 3DES,AES,or CAST
■ Phase 1 hash/authentication algorithm—for example, SHA1 or MD5
■ Phase 1 authentication—for example, PRE-SHARED SECRET or CERTIFICATE
■ Phase 1 mode—for example, MAIN or AGGRESSIVE
■ Phase 2 encryption algorithm to encrypt the data—for example, DES, 3DES,AES,or CAST
■ Phase 2 hash/authentication algorithm—for example, SHA1 or MD5
■ Phase 2 Perfect Forward Secrecy—for example,YES-GROUP1,YES-GROUP2, YES-GROUP5, or NO
■ Outgoing interface of the VPN tunnel
■ Encryption domain
The Event log contains VPN events. When troubleshooting a VPN on a Juniper firewall,
keep an eye on the Event log for PKI (public-key infrastructure) events.The following
debug commands can be useful during troubleshooting Phase 1 issues:
■ get ike cookie This will display all completed Phase 1 negotiations.
■ debug flow basic This will enable debugging.
■ debug ike This will enable detailed VPN debug logs with an empasis on phase 1 of the communication.
■ debug sa This will turn on a debug with an emphasis on phase 2 of the VPN setup.
■ clear ike This will force a VPN tunnel to renegotiate. It will clear Phase 1 and Phase 2 for the specified tunnel.
Troubleshooting commands useful for Phase 2 issues are shown next:
■ get sa active This will display all completed Phase 2 negotiations.
■ unset ike policy-checking This will tell the firewall to ignore the policy and allow all routed traffic through the VPN.
Policy Based VPN
The following are some common issues regarding policy-based VPNs:
■ Policies are in the wrong order. Remember the rule base is parsed from top to bottom.
■ Missing a rule in the other direction. VPN policies require a rule to allow inbound as well as outbound traffic.
■ Wrong VPN tunnel is selected. Double-check the address book entries and the VPN tunnel selected.
■ Policy is in the wrong zone. Make sure the traffic going into the VPN is allowed by a policy.
Regards
Gavrilo
