Troubleshoot: IPsec VPN Tunnel Down

IPsec (IP Security) is a suite of protocols used to secure IP communications by authenticating and encrypting each IP packet in a data stream. A site-to-site IPsec VPN tunnel is established between two routers (or firewalls) to create a secure path for traffic between two private networks over an untrusted network like the internet. When the tunnel is 'down,' no encrypted traffic can pass, and the underlying cause can be anything from a simple configuration typo to a mismatch in security parameters.

IPsec tunnel establishment follows a two-phase process using Internet Key Exchange (IKE):

Phase 1 (IKE SA): The two peers establish a secure, authenticated control channel. This can use Main Mode or Aggressive Mode. Main Mode (default) uses six messages:

Phase 2 (IPsec SA): Using the secure channel from Phase 1, the peers negotiate the IPsec security associations (SAs) for data traffic. This uses Quick Mode (three messages) to agree on transform sets (encryption, integrity, and encapsulation mode) and to generate keying material for each direction.

Once Phase 2 completes, the tunnel is 'up' and traffic can flow encrypted.

To check the status of a tunnel, use these commands:

show crypto isakmp sa
show crypto ipsec sa
show crypto map

Example output of show crypto isakmp sa:

IPv4 Crypto ISAKMP SA
C-id   Local           Remote          I-VRF   Status Encr Hash Auth DH Lifetime Cap.
1001   10.1.1.1        10.2.2.2                ACTIVE aes sha psk 2   23:59:30

If the SA is in MM_NO_STATE or MM_KEY_EXCH, Phase 1 has not completed. If it shows ACTIVE, Phase 1 is up.

Example output of show crypto ipsec sa:

interface: Tunnel0
    Crypto map tag: CMAP, local addr 10.1.1.1
   protected vrf: (none)
   local  ident (addr/mask/prot/port): (10.1.1.0/255.255.255.0/0/0)
   remote ident (addr/mask/prot/port): (10.2.2.0/255.255.255.0/0/0)
   current_peer 10.2.2.2 port 500
     PERMIT, flags={origin_is_acl,}
    #pkts encaps: 0, #pkts encrypt: 0, #pkts digest 0
    #pkts decaps: 0, #pkts decrypt: 0, #pkts verify 0
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0
    #pkts not decompressed: 0, #pkts decompress failed: 0
    #send errors 0, #recv errors 0

     local crypto endpt.: 10.1.1.1, remote crypto endpt.: 10.2.2.2
     plaintext mtu 1400, path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/0
     current outbound spi: 0x0(0)
     PFS (Y/N): N, DH group: none

If no inbound/outbound SAs are present (spi=0x0), Phase 2 has not completed.

Use debug crypto isakmp and debug crypto ipsec to see negotiation messages. This is high CPU, but essential for pinpointing the issue. Look for error messages like: - %CRYPTO-4-IKMP_BAD_MESSAGE – indicates mismatched parameters. - %CRYPTO-4-IKMP_NO_PEER – peer unreachable. - %CRYPTO-4-IKMP_NO_POLICY – no matching IKE policy.

Always use no debug all when done.

In a typical enterprise environment, site-to-site IPsec VPNs connect branch offices to the headquarters. For example, a retail chain might have 50 stores each with a Cisco router terminating a VPN to the data center. The most common real-world issue is that after a router reboot, the tunnel fails to come up because the pre-shared key was not re-entered correctly after a configuration change. Another scenario: when a new firewall is placed in the path, the administrator forgets to allow ESP traffic, causing the tunnel to flap or stay down. In production, network engineers often use a phased rollout: first verify Phase 1 with show crypto isakmp sa, then Phase 2 with show crypto ipsec sa. They also rely on syslog messages like %CRYPTO-4-IKMP_BAD_MESSAGE to quickly identify mismatches. A common scale consideration: with many tunnels, the router's CPU can spike during rekey events. Performance tuning includes adjusting SA lifetimes to reduce rekey frequency. When misconfigured, the most subtle issue is an ACL mismatch that causes the tunnel to come up but no traffic to be encrypted, leading to dropped packets or black holes. Engineers learn to always verify the crypto ACLs on both sides are exact mirrors.