The VPN shows up, but no traffic passes. How do you troubleshoot it?
Show the answer
Say this first
"Up" usually means the IKE SA is up. I check that IPsec SAs exist and read the encaps and decaps counters on both ends while sending test traffic. Encaps at zero means the traffic never reaches the encryption: routing, the crypto ACL or NAT exemption on the sending side. Encaps rising but the peer's decaps at zero means the packets die in transit: an ACL or ISP filter on ESP or UDP 4500. Decaps rising but no replies means the remote side: its NAT exemption, its route back, or a host firewall.
Go deeper
Commands, in order
show crypto session detail
show crypto ipsec sa peer 203.0.113.2
show ip route 10.2.0.0
show ip nat translations
show access-listsReading the counters for traffic from site 1 to site 2
| R1 encaps | R2 decaps | R2 encaps | R1 decaps | Where it breaks |
|---|---|---|---|---|
| 0 | 0 | any | any | R1 never sends into the tunnel: route, crypto ACL, NAT |
| rising | 0 | any | any | in transit: ESP or UDP 4500 blocked |
| rising | rising | 0 | 0 | R2 return path: NAT exemption, route back, crypto ACL |
| rising | rising | rising | rising | tunnel works; look at hosts, inside firewalls, MTU |
Test traffic from the right source
A ping from the router itself is sourced from the outside interface and does not match the crypto
ACL. Use ping 10.2.0.10 source GigabitEthernet0/0/1.
With a VTI
Check that the route to the remote LAN points into Tunnel0, and look at the tunnel interface counters as well as the SA counters.
They will ask next
Counters rise on both routers but the application still fails. What next?
The tunnel is doing its job. Look past it: the server's default gateway may not be the VPN router, an inside firewall may block the flow, the host firewall may drop it, or large transfers may hit an MTU problem while small pings pass.
When would you clear the SAs?
After I have collected the evidence, or when the SAs are clearly stale, for example after the peer rebooted. Clearing first destroys the counters that tell me where traffic stops.
Traps
- Testing with a plain ping from the router and concluding the tunnel is broken.