Monitoring and Troubleshooting Site-to-Site IPSec VPNs

Summary

Everyday, more and more organizations are deploying IPSec site-to-site tunnels to cut costs on traditional WAN links. It is a responsibility of the security professional to design and implement an IPSec solution that will fit the needs of an organization. If the other end of the IPSec VPN tunnel is managed by a different security professional, make sure that you consult with them before configuring the ISAKMP and IPSec attributes in the ASA. This chapter discussed the configuration guide on how to implement the site-to-site tunnels and discussed the two deployment scenarios. If you implement the solution, and the IPSec tunnel is not working as expected, use the appropriate show commands and monitor the status of the SAs. You can also turn on the ISAKMP and IPSec debugs to help narrow down the issue.