Справочник Пользователя для ZyXEL 202H 91-003-194003B

P-202H Plus v2 User’s Guide

Chapter 35 IPSec Log

316

The following table shows sample log messages during packet transmission.

!! No proposal chosen

The parameters configured for Phase 1 or Phase 2 

negotiations don't match. Please check all protocols and 

settings for these phases. For example, one party may be 

using 3DES encryption, but the other party is using DES 

encryption, so the connection will fail.

!! Verifying Local ID failed
!! Verifying Remote ID failed

During IKE Phase 2 negotiation, both parties exchange 

policy details, including local and remote IP address 

ranges. If these ranges differ, then the connection fails.

!! Local / remote IPs of incoming request 

conflict with rule <#d>

If the security gateway is  "0.0.0.0", the ZyXEL Device will 

use the peer's "Local Addr" as its "Remote Addr". If this IP 

(range) conflicts with a previously configured rule then the 

connection is not allowed.

!! Invalid IP <IP start>/<IP end>

The peer's "Local IP Addr" range is invalid.

!! Remote IP <IP start> / <IP end> 

conflicts

If the security gateway is  "0.0.0.0", the ZyXEL Device will 

use the peer's "Local Addr" as its "Remote Addr". If a 

peer's "Local Addr" range conflicts with other connections, 

then the ZyXEL Device will not accept VPN connection 

requests from this peer.

!! Active connection allowed exceeded

The ZyXEL Device limits the number of simultaneous 

Phase 2 SA negotiations. The IKE key exchange process 

fails if this limit is exceeded.

!! IKE Packet Retransmit

The ZyXEL Device did not receive a response from the 

peer and so retransmits the last packet sent.

!! Failed to send IKE Packet

The ZyXEL Device cannot send IKE packets due to a 

network error.

!! Too many errors! Deleting SA

The ZyXEL Device deletes an SA when too many errors 

occur.

Table 107   Sample IPSec Logs During Packet Transmission

!! WAN IP changed to <IP>

If the ZyXEL Device's WAN IP changes, all configured "My 

IP Addr" are changed to b "0.0.0.0".. If this field is 

configured as 0.0.0.0, then the ZyXEL Device will use the 

current ZyXEL Device WAN IP address (static or dynamic) 

to set up the VPN tunnel.

!! Cannot find Phase 2 SA

The ZyXEL Device cannot find a phase 2 SA that 

corresponds with the SPI of an inbound packet (from the 

peer); the packet is dropped.

!! Discard REPLAY packet

If the ZyXEL Device receives a packet with the wrong 

sequence number it will discard it.

!! Inbound packet authentication failed

The authentication configuration settings are incorrect. 

Please check them.

!! Inbound packet decryption failed

The decryption configuration settings are incorrect.  

Please check them.

Rule <#d> idle time out, disconnect

If an SA has no packets transmitted for a period of time 

(configurable via CI command), the ZyXEL Device drops 

the connection.

Table 106   Sample IKE Key Exchange Logs