Tricks: How to debug a specific IPSec VPN Tunnel on Cisco.

Let’s say you’ve got a router with well over 100 IPSec VPN peers, and you’ve got this one tunnel that just won’t form correctly. Your not sure why and want nothing more than to debug the IPSec process for this one peer but you know if you debug the isakmp or ipsec process your going … Continue reading Tricks: How to debug a specific IPSec VPN Tunnel on Cisco.

Restarting VPN Tunnels on Cisco

In some rare cases, VPN Tunnels hang-up randomly and needs to be bounced or restarted to restart the VPN Tunnel negotiate that on some cases the easiest fix on VPN Down issues Check Phase 1 Status of the Tunnel: show crypto ipsec sa Normal/UP status should show: QM_IDLE (More info on Status here) Restarting VPN … Continue reading Restarting VPN Tunnels on Cisco

How to Clear IPSec VPN Remote Peer on Cisco IOS

The following command clears the crypto sessions for a remote IKE peer. You can use context sensitive help ?to find other options. This command will also reset encap/decap counters on the show crytpo ipsec sa peer <PEER_IP_ADDRESS>  output Syntax clear crypto session remote IP_ADDRESS Example: clear crypto session remote 1.1.1.1

Troubleshooting Cisco VPN Phase 2

Problem It’s been over two years since I wrote Troubleshooting Phase 1 Cisco Site to Site (L2L) VPN Tunnels. I’ve always meant to come back and write the ‘Phase 2’ article but never got around to it. This article is NOT intended to be a ‘fix all” for phase 2 problems, it’s designed to point you in the … Continue reading Troubleshooting Cisco VPN Phase 2

Troubleshooting Cisco VPN Phase 1

Problem Site to Site VPN’s either work faultlessly straight away, or involve head scratching and a call to Cisco TAC, or someone like me to come and take a look. If I’m honest, the simplest and best answer to the problem is “Remove the Tunnel from both ends and put it back again”. Just about every VPN tunnel … Continue reading Troubleshooting Cisco VPN Phase 1

Useful Cisco Site-to-Site VPN Phase 1 and 2 Status Troubleshooting Commands

One way is to display it with the specific peer ip. Check Phase 1 Tunnel ASA#show crypto isakmp sa detail | b [peer IP add] Check Phase 2 Tunnel ASA#show crypto ipsec sa peer [peer IP add] Display the PSK ASA#more system:running-config | b tunnel-group [peer IP add] Display Uptime, etc. ASA#sh vpn-sessiondb detail l2l … Continue reading Useful Cisco Site-to-Site VPN Phase 1 and 2 Status Troubleshooting Commands

Tricks: Introducing Cisco RF Planning Tool

Here is a useful planning tool in Wireless Network provisioning for Cisco Meraki AP or the Mobility Express models. This is an online tool called Cisco RF Wi-Fi Planner Tool. Check out https://rftool.cisco.com You can use this by logging in to your Cisco Account. You can put into account external factors in designing your wireless network … Continue reading Tricks: Introducing Cisco RF Planning Tool

Meraki Wifi Best Practice for multiple APs: Bridge Mode

Bridge Mode In bridge mode, the Meraki APs act as bridges, allowing wireless clients to obtain their IP addresses from an upstream DHCP server. Bridge mode should be enabled when any of the following is true: Wired and wireless clients in the network need to reach each other (e.g., a wireless laptop needs to discover … Continue reading Meraki Wifi Best Practice for multiple APs: Bridge Mode

Cisco Switch Selector / Model Finder Tool

Few days ago, I shared a link for HPE Switch Selector / Model Finder tool, to help finding an appropriate HPE switch model based on your requirement. My client preferred a Cisco, so I have to find an appropriate Cisco model for them and found a similar tool to that of HPE. https://www.cisco.com/c/dam/assets/prod/switches/cisco-switch-selector-how-to/index.html#/ Check it … Continue reading Cisco Switch Selector / Model Finder Tool

Tricks: Steps to Fix the Cisco VPN 412 Error

Cisco VPN Error 412 for Legacy VPN Client v5.0.0.07   Reason 412. The remote peer is no longer responding". Means that the software VPN Client detected that the VPN server is not responding anymore and deleted the connection. It can be anything from IPSEC traffic being blocked by your upstream device, NAT Issues or simply misconfigured VPN Settings: Once … Continue reading Tricks: Steps to Fix the Cisco VPN 412 Error