I85PREP
⌘ K
Cisco 300-730 SVPN study materials
Cisco 300-730 SVPN study resources

Cisco 300-730 SVPN: Troubleshooting and maintenance

Cisco 300-730 SVPN · Work through your exam, one topic at a time.

All guide sections

Troubleshooting and maintenance

Troubleshooting and maintenance

This domain tests systematic isolation of VPN faults and the commands that prove where a tunnel stops. You should be able to move from underlay reachability to IKE, then IPsec, then routing and MTU, and to use debug, packet capture, syslog, and session tables without flooding the device.

Core rules

  • Layer the fault: confirm underlay routing and UDP 500/4500 or ESP reachability; then check IKE SA; then IPsec SA; then overlay routing, NHRP, and MTU.
  • IKE evidence: show crypto ikev2 sa or show crypto isakmp sa shows whether Phase 1 is established. debug crypto ikev2 and debug crypto isakmp show proposals, identity, and authentication failures.
  • IPsec evidence: show crypto ipsec sa shows encaps/decaps counters, SPIs, and ACL matches. Rising encaps with zero decaps points to return-path, ACL, or NAT problems.
  • DMVPN evidence: show dmvpn shows NHRP state and peer type; show ip nhrp shows mappings. A spoke stuck in IKE has not completed IPsec; a spoke with no NHRP entry has not registered.
  • Remote-access evidence: show vpn-sessiondb detail anyconnect shows assigned address, tunneled networks, and DTLS/TLS. For IKEv2 RA, check the IKEv2 session and virtual-access interface.
  • Maintenance: use conditional debug (debug condition) or logging filters, capture with monitor capture, and archive configurations before changes.

Worked example

A DMVPN spoke brings up an IPsec SA, but TCP sessions to a hub-side server stall while small pings succeed. show crypto ipsec sa shows encaps and decaps increasing. On the tunnel, a large ping with the DF bit set fails. Reasoning: GRE and IPsec headers reduce the effective MTU, and the path cannot fragment. Set ip mtu 1400 and ip tcp adjust-mss 1360 on the tunnel interfaces, matching the underlay. Clearing the IPsec SA is not the fix; the SA is healthy.

Traps

debug all can overwhelm a production router; use specific debug and terminal monitor. An ACL that permits GRE but not ESP, or a NAT device that does not pass NAT-T, breaks IPsec even when IKE looks fine. Asymmetric routing can make an SA appear up while return traffic bypasses the tunnel. Certificate-based failures often come from clock skew, so check NTP before replacing certificates. Do not forget that NHRP registration and IPsec SA state are separate: one can be up while the other is down.