Nortel 3050 User manual

Nortel VPN Gateway
Troubleshooting Guide
Release: 7.0
Document Revision: 01.01
www.nortel.com
NN46120-700 324371-A
.

Nortel VPN Gateway
Release: 7.0
Publication: NN46120-700
Document status: Standard
Document release date: 12 October 2007
Copyright © 2007 Nortel Networks
All Rights Reserved.
The information in this document is subject to change without notice. The statements, configurations, technical
data, and recommendations in this document are believed to be accurate and reliable, but are presented without
express or implied warranty. Users must take full responsibility for their applications of any products specified in this
document. The information in this document is proprietary to Nortel Networks.
Export
This product, software and related technology is subject to U.S. export control and may be subject to export or
import regulations in other countries. Purchaser must strictly comply with all such laws and regulations. A license to
export or reexport may be required by the U.S. Department of Commerce.
Licensing
This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit
(http://www.openssl.org/).
This product includes cryptographic software written by Eric Young ([email protected]).
This product includes software written by Tim Hudson ([email protected]).
This product includes software developed by the Apache Software Foundation http://www.apache.org/.
This product includes a TAP-Win32 driver derived from the CIPE-Win32 kernel driver, Copyright © Damion K.
Wilson, and is licensed under the GPL.
See Appendix D, "License Information", in the User’s Guide for more information
.

3
.
Contents
New in this release 5
Introduction 7
Prerequisites 7
Navigation 7
Acronyms 8
Troubleshooting Fundamentals 9
Navigation 9
SSL acceleration 9
Log files 10
Traffic Generators 11
NVG hardware 12
Virtual IP addresses 12
Global troubleshooting tasks 13
Navigation 13
Dumping the log files to another server 13
Displaying the audit trials 14
Viewing SSL traffic generators 14
Viewing TCP traffic generators 14
Feature-specific troubleshooting tasks 17
Navigation 17
Troubleshooting SSL acceleration 17
SSL acceleration troubleshooting tools 18
SSL acceleration troubleshooting tools navigation 18
Viewing current configuration 18
Resetting default configuration 18
Troubleshooting Net Direct 18
Troubleshooting TunnelGuard 19
Recovering using boot.img 20
Upgrading code using .pkg 21
Troubleshooting authentication tasks 25
Navigation 25
Nortel VPN Gateway
Troubleshooting Guide
NN46120-700 01.01 Standard
12 October 2007
Copyright © 2007 Nortel Networks
.

4
Troubleshooting RADIUS authentication 25
Troubleshooting RADIUS authentication navigation 25
Troubleshooting LDAP authentication with Active Directory 37
Troubleshooting LDAP authentication with Active Directory navigation 37
Troubleshooting LDAP authentication issues 37
Adding a SSL VPN gateway user into the Active Directory 38
Configuring the LDAP Attributes 40
Configuring LDAPs authentication with Active Directory 41
Importing certificates 44
Troubleshooting NTLM authentication with Primary Domain Controller 46
Troubleshooting NTLM authentication with Primary Domain Controller
navigation 46
Creating the Windows group and add a user into that group 46
Adding users to the new group 47
Emergency Recovery Trees 49
Cannot access NVG for management -- recovery tree 49
Cannot access VPN -- recovery tree 50
Reference to third party Application Guides 53
Contact Nortel technical support 55
Navigation 55
Gathering critical information 55
Getting help from the Nortel Web site 56
Getting help over the phone from a Nortel Solutions Center 56
Getting help from a specialist by using an Express Routing Code 57
Getting help through a Nortel distributor or reseller 57
Glossary 59
Nortel VPN Gateway
Troubleshooting Guide
NN46120-700 01.01 Standard
12 October 2007
Copyright © 2007 Nortel Networks
.

5
.
New in this release
Nortel VPN Gateway Troubleshooting Guide (Part number 324371-A,
NN46120-700) is a new document for Nortel VPN Gateway Release 7.0.
Some of the contents in this document originally appeared in the following
sources:
•Application Guide for SSL Acceleration (Part number 216370-D,
NN46120-100)
•CLI Application Guide (Part number 216371-E, NN46120-101)
•BBI Application Guide for VPN (Part number 217239-E, NN46120-102)
•Command Reference Guide (Part number 216369-E, NN46120-103)
•User Guide (Part number 216368-F, NN46120-104)
•Administrator Guide (Part number 217238-D, NN46120-105)
Nortel VPN Gateway
Troubleshooting Guide
NN46120-700 01.01 Standard
12 October 2007
Copyright © 2007 Nortel Networks
.

6New in this release
Nortel VPN Gateway
Troubleshooting Guide
NN46120-700 01.01 Standard
12 October 2007
Copyright © 2007 Nortel Networks
.

7
.
Introduction
This chapter describes the prerequisites and various tools used to
troubleshoot the Nortel VPN Gateway (NVG). Use the troubleshooting
tools to enhance overall performance, resolve error messages, and
increase response time for a specific feature.
Each tool is described by purpose, usage procedures, and how to interpret
the output.
Prerequisites
Nortel recommends you to use one or more of the following commercially
available troubleshooting tools as well as the tools described in this
document.
•Capture and analyze HTTP and HTTPS with the HTTP Analyzer from
IE Inspector http://www.ieinspector.com/
•Capture and analyze HTTP and HTTPS with Tamper Data, a plug-in
available for Mozilla Firefox https://addons.mozilla.org/en-US/firefox/
addon/966
•Display the time to load Web pages with Faster Fox, a plug-in available
for Mozilla Firefox https://addons.mozilla.org/en-US/firefox/addon/1269
•Capture and analyze packets with either Sniffer or Wireshark from
Network General http://www.wireshark.org/ and http://www.networkge
neral.com/
Navigation •“Troubleshooting Fundamentals” (page 9)
•“Global troubleshooting tasks” (page 13)
•“Feature-specific troubleshooting tasks” (page 17)
•“Troubleshooting authentication tasks” (page 25)
•“Emergency Recovery Trees” (page 49)
Nortel VPN Gateway
Troubleshooting Guide
NN46120-700 01.01 Standard
12 October 2007
Copyright © 2007 Nortel Networks
.

8Introduction
•“Reference to third party Application Guides” (page 53)
•“Contact Nortel technical support” (page 55)
•“Glossary” (page 59)
Acronyms Table 1 "Acronyms" (page 8) lists the acronyms used in this guide.
Table 1
Acronyms
BootP Bootstrap Protocol
CLI Command Line Interface
CPU Central Processing Unit
IP Internet Protocol
I/O Input/Output
MAC Media Access Control
NVG Nortel VPN Gateway
VPN Virtual Private Network
LDAP Lightweight Directory Application Protocol
AD Active Directory
NTLM New Technology LAN Manager
Nortel VPN Gateway
Troubleshooting Guide
NN46120-700 01.01 Standard
12 October 2007
Copyright © 2007 Nortel Networks
.

9
.
Troubleshooting Fundamentals
This section provides conceptual information about the methods and
tools that you can use to troubleshoot and isolate problems in the VPN
Gateway.
Navigation •“SSL acceleration” (page 9)
•“Log files” (page 10)
•“Traffic Generators” (page 11)
•“NVG hardware” (page 12)
•“Virtual IP addresses” (page 12)
SSL acceleration
The Secure Sockets Layer (SSL) protocol runs above the TCP/IP protocol
and below higher-level protocols such as HTTP or IMAP. SSL uses TCP/IP
on behalf of the higher-level protocols and, in the process, allows an
SSL-enabled server to authenticate itself to an SSL-enabled client. The
client then authenticates itself to the server, and both machines establish
an encrypted connection. The current standard is TLS (Transport Layer
Security) but the name SSL is still used.
See “Dumping the log files to another server” (page 13) for instructions on
how to view the ssl.log files.
Table 2 "Interpreting SSL acceleration log files" (page 10) gives the
information about log files messages and their descriptions.
Nortel VPN Gateway
Troubleshooting Guide
NN46120-700 01.01 Standard
12 October 2007
Copyright © 2007 Nortel Networks
.

10 Troubleshooting Fundamentals
Table 2
Interpreting SSL acceleration log files
Message Severity Type Description
Failed to initialize SSL
hardware ERROR Traffic processing The SSL acceleration hardware failed to
initialize and the NVG
runs with degraded
performance.
Set CSWIFT as default INFO Startup The NVG is using
CSWIFT SSL
hardware acceleration.
ssl-hw-fail ALARM (MAJOR) System control The SSL hardware
acceleration card
could not be found or
initiated and the NVG
runs with degraded
performance.
Using <hardware
type> hardware INFO Startup The NVG is using <hardware type>
hardware for SSL
acceleration.
Log files View the log files to see the history of system events.
This troubleshooting guide documents only the most common messages
from the ssl.log.
/maint/debug/proxydebug [on|off|once]
on: enable simpleproxy to print out debug message.
off: disable simpleproxy to print out debug message.
once: enable simpleproxy to print out debug message only once.
ATTENTION
Enabling proxydebug will use more CPU resource. Make sure to disable it after
you finish debugging.
Transmit the event log from the Nortel VPN Gateway to a file on a TFTP,
FTP, or SFTP server. Specify the IP address or host name of the server
as well as the file name. The default value is TFTP.
Table 3 "Log file types in a log dump" (page 11) lists the log file types in
a log dump.
Nortel VPN Gateway
Troubleshooting Guide
NN46120-700 01.01 Standard
12 October 2007
Copyright © 2007 Nortel Networks
.