auto-connect
track-event-notify enable exit
interface tunnel3 zone \
tunnelipsec \reverse-route prefer exit
如果看这些还没有看出问题的话就debug vpn抓下数据包
简单的介绍下需要看vpn的哪些部分
2016-01-16 11:22:20, DEBUG@VPN: [10.88.16.143]: phase 1 (main mode): remote supp orts DPD
2016-01-16 11:22:20, DEBUG@VPN: [10.88.16.143]: Compared: DB:Peer 2016-01-16 11:22:20, DEBUG@VPN: [10.88.16.143]: (lifetime = 86400:86400) 2016-01-16 11:22:20, DEBUG@VPN: [10.88.16.143]: (lifebyte = 0:0)
2016-01-16 11:22:20, DEBUG@VPN: [10.88.16.143]: enctype = DES-CBC:DES-CBC 2016-01-16 11:22:20, DEBUG@VPN: [10.88.16.143]: (encklen = 0:0)
2016-01-16 11:22:20, DEBUG@VPN: [10.88.16.143]: hashtype = MD5:MD5
2016-01-16 11:22:20, DEBUG@VPN: [10.88.16.143]: authmethod = pre-shared key:pre- shared key
2016-01-16 11:22:20, DEBUG@VPN: [10.88.16.143]: dh_group = 1024-bit MODP group:1 024-bit MODP group
2016-01-16 11:22:20, DEBUG@VPN: [10.88.16.143]: An acceptable proposal found
2016-01-16 11:22:20, DEBUG@VPN: [10.88.16.143]: ++++++++Phase 1 main mode first msg receive END.++++++++
2016-01-16 11:22:20, DEBUG@VPN: 2016-01-16 11:22:20, DEBUG@VPN:
2016-01-16 11:22:20, DEBUG@VPN: [10.88.16.143]: ++++++++Phase 1 main mode first msg send START.++++++++
以上为一个正常的一阶段vpn协商包一个小部分，当出现错误的时候会报以下错误
1.no suitable proposal found
Phase 1 (main mode): failed to get valid proposal! 第一阶段提议不匹配需要去检查提议
2. HASH mismatched （野蛮模式）
Invalid payload or failed to mallocbuffer(pre-share key may mismatch).（主模式） 预共享秘钥不匹配
3. Peer Main mode, try to find rmconf byIP and local if.
Error can not find ISAKMP peer
可能是俩边的模式不匹配，检查下 4．:No ID match.
: phase 1 (aggressive mode): invalid ID payload. Fqdn不匹配
5．No suitable proposal found
phase 1 (aggressive mode): failed to get valid proposal. 一阶段提议不匹配
6．phase 1 (aggressive mode): gateway ceshi can work as initiator only 双方都是发起段可能出现这个报错
7.encmode mismatched: my:Transportpeer:Tunnel Not matched
No suitable proposals found 二阶段模式不同
8.pfs group mismatched: my:2 peer:0 Not matched
No suitable proposals found. 二阶段提议不同
9．Phase 2(quick mode):failed to get sainfo by ipsecdoi id 二阶段代理id的问题
10．如果俩边都没有协商包检查下自动连接是否启用了
11.一段有发起的数据而另外一段没有接收的数据，看看对方公网是否有问题。
12.如果vpn通了，数据不同就需要看数据路由和策略方面。如果配置没看到错误就抓数据包看了
以上讲的就是些小的排错方法，很不全面。更多的排错方法是靠平时的积累和实验自己学会的，希望这些能对大家处理问题有小的帮助