Before commencing IPSec VPN configuration, you must resolve jointly with your VPN peer the basic parameters so that IPSec VPN can be set up symmetrically in the two peers. If the IPSec VPN configuration in the two peers does not match, no VPN is created.

The basic parameters include:

• The IKE phase 1 parameters (as defined in the ISAKMP policy, see Configuring ISAKMP policies)

• The IKE phase 2 parameters (as defined in the transform-set, see Configuring transform-sets)

• The ISAKMP peer parameters (see Configuring ISAKMP peer information)

• Which packets should be secured (as defined in the crypto list, see Configuring crypto lists)

• The peer addresses. For each peer, the local address entered in the crypto list (see Configuring crypto lists) should match the ISAKMP peer address in the other peer (see Configuring ISAKMP peer information).

• NAT Traversal, if your installation includes one or more NAT devices between the local and remote VPN peers. See Configuring global parameters.

See Configuring IPSec VPN logging for information on how to view IPSec VPN configuration in both peers so as to pinpoint the problem in case of a mismatch between the two peers.