IPsec VPN Diagnostics and Automation for Site-to-Site Tunnels
IPsec tunnels fail in a small number of ways, and most of the debugging time is spent rediscovering which one. OrcaMonitor detects tunnel faults, then runs the diagnostic sequence for your specific platform — proposals, DH group, PFS, SA lifetime, NAT-T, MTU — with built-in command references for FortiGate, Cisco ASA, Juniper SRX, Palo Alto and MikroTik, and proposes the fix behind an approval gate.
Problems we solve
- Phase 1 comes up but phase 2 never completes, with no obvious cause
- Proposal mismatches — encryption, integrity, DH group or lifetime differing by one value
- Tunnels that establish and then silently drop large packets
- Engineers re-deriving the same diagnostic sequence on every incident
- VPN issues on firewalls of several different brands in the same estate
The IPsec diagnostic sequence
- Reachability — UDP 500 and 4500 between peers
- Proposals — encryption, integrity, DH group, lifetime compared on both ends
- Pre-shared key vs expired certificate, including validity window
- Interesting traffic — ACL / crypto map selectors
- NAT-T — required whenever a peer sits behind NAT
- MTU and MSS — establishes, then drops large packets
Capabilities
Platform-aware IPsec diagnosis
When a ticket mentions VPN, IPsec, IKE, tunnel or crypto, the agent's context is augmented with the vendor command set and the diagnostic checklist automatically — so the first command run is the right one for that platform, not a generic ping.
Phase 1 and phase 2 checks
The agent distinguishes an IKE phase 1 failure from a phase 2 failure rather than reporting "tunnel down", because the two point at completely different causes: credentials and proposals in phase 1, selectors and PFS in phase 2.
Mismatch detection by comparison
Proposals only work when both ends agree exactly. OrcaMonitor compares the two configurations — encryption, integrity, DH group, PFS and SA lifetime — instead of leaving an engineer to read them side by side and spot the one value that moved.
Tunnel monitoring and automation
Site-to-site tunnels are monitored as first-class objects, so a down tunnel raises a correlated alert, opens a ticket with the diagnostic context, and offers an approved remediation instead of waiting for users to report an outage.
Related solutions
FAQ
How do you troubleshoot an IPsec tunnel that is down?
Work in order rather than guessing: confirm both peers can reach each other on UDP 500 and 4500, compare the proposals on both ends (encryption, integrity, DH group, lifetime must match exactly), verify the pre-shared key or certificate validity, check that the traffic you care about is actually selected by the ACL or crypto map, confirm NAT-T is permitted if either peer is behind NAT, and check MTU if the tunnel establishes but large packets vanish. OrcaMonitor runs this sequence automatically with platform-specific commands for FortiGate, Cisco ASA, Juniper SRX, Palo Alto and MikroTik.
How do you tell an IKE phase 1 problem from a phase 2 problem?
Phase 1 covers the peer relationship: reachability, authentication and matching proposals and DH group. If phase 1 is up and phase 2 never completes, the peer trusts each other but cannot agree on the tunnel itself — look at phase 2 proposals, PFS settings, SA lifetime and the traffic selectors. NAT-T problems also present this way: phase 1 succeeds and phase 2 never finishes.
What causes a DH group mismatch on a VPN?
Each end must be configured with the same Diffie-Hellman group for the proposal to match. A mismatch usually appears after one side is upgraded or edited, or when a template is applied to one peer only — the IKE negotiation fails even though the pre-shared key is correct, which sends people looking at credentials instead of proposals.
What is PFS mismatch detection and why does it matter?
Perfect Forward Secrecy must be enabled on both peers, and with the same group. If one side requires PFS and the other does not, phase 2 fails while phase 1 stays healthy. Because the same negotiation produces a generic "tunnel down", OrcaMonitor compares PFS settings directly rather than leaving it to be inferred from a failure message.
How do you check IPsec SA lifetime?
The IKE and IPsec SA lifetimes must be compatible on both peers. Where they disagree, tunnels can drop and renegotiate on a schedule that looks intermittent rather than broken — one of the harder failure patterns to diagnose from logs alone, and much easier to spot by comparing both configurations.
Which VPN platforms have built-in command references?
FortiGate, Cisco ASA, Cisco IOS, Juniper SRX, Palo Alto and MikroTik. The agent discovers device capabilities before acting, because not every verb exists on every platform and the checklist is only useful if it runs commands the device actually supports.
See every module, pricing tier, and deployment option on the OrcaMonitor overview.