How to troubleshoot VPN connectivity issues and faults in VPNaaS
Summary
General Troubleshooting and Configuration Considerations When Creating or Modifying VPNaaSContent
1. Make sure the Internet Key Exchange (IKE) and Internet Protocol Security (IPSEC) timeouts on the VPNaaS and the 3rd party device agree
- Authentication: pre-shared keys
- Encryption: 3DES, AES 128, AES 192, AES 256
- Hash: MD5, SHA1, SHA2
- Policy Group: Diffie-Hellman groups supported are 2, 5, 14, 22, 23, 24
- Recommend using PFS from a security viewpoint.
Phase1 / IKE
- IKE ID must match (proposed vs. expected)
- Lifetime must match
- Double Check Pre-Shared Key (PSK)
Phase2 / IPSec
- NAT-T is a requirement of OCI Classic (OCI-C)
- Lifesize unlimited
- Lifetime must match
- remove idle timeout
2. Configure the on-premise VPN device to be responder-only as the VPNaaS will always make sure tunnel is up (barring networking issues between OCI-C and the on-premise VPN).
1