Site-to-site VPN IKE troubleshooting flow

Overview

IKE/IPsec VPNs fail for boring reasons—PH2 mismatch, NAT-T, clocks, or PSK typos. Use a structured flow before packet captures.

Order of checks

1. Phase 1 up? Verify encryption proposals, DH group, lifetime match both ends.
2. Identity: FQDN vs IP; peer IDs on dynamic endpoints.
3. Phase 2 selectors—subnet objects must be symmetric; watch overlapping Any traps.
4. NAT-T UDP 4500 allowed asymmetric NAT scenarios.

Tools

Vendor VPN diagnostic, ike-scan on Linux side if permitted, controlled debug windows only.

Change control

Snapshot firewall config before proposal tweaks; rollback known-good import ready.

Documentation

Working transforms + lifetimes stored in client KB—future you will thank you.