Hello folks,
IPsec tunnels between two devices have many configuration options and settings that need to be aligned for the tunnels to come up correctly. In fact we see hundreds of cases per month for configuration assistance requests for VPN tunnels. In an effort to make things easier for our customers I wanted to introduce you to a tool that has been developed by myself and a few other Cisco TAC security engineers.
IPsec Lan-to-Lan Configuration Checker
(http://www.cisco.com/c/en/us/support/web/redirects/l2l-checker.html)
The tool checks the configuration of two devices (IOS or ASA), examines for the presence of a crypto map based tunnel between them. If discovered it will do an analysis of the most common configuration mistakes and best practices. This tool's goal is to help you identify any configuration reasons why your tunnel is not establishing or traffic is correctly passing over it.
Currently there it only support static crypto map Lan-to-Lan tunnels between IOS, IOS-XE and ASA devices.
If there is a specific feature you would like to see or if you run into problems with the tool please let use know at tool_l2l_checker_feedback@cisco.com
The tool was recently updated, here is an example of the output generated:
Here is an example of the older version:
