Цели
- Понимать common failures: proposals, PSK/cert, routes, NAT-T, split tunnel, DNS.
- Отделять tunnel down от routing/selectors issue.
- Давать чёткий escalation packet.
Allowed tools
- sample VPN logs
- phase1/phase2 checklist
- routes and allowed subnets
- tcpdump/packet counters if available
Scenario / symptom
Site-to-site VPN down после изменения у партнёра. Пользователи видят timeout к remote subnet, но интернет работает.
Hands-on task
- Определить scope: all users, one subnet, one app.
- Проверить tunnel status и последние log reasons.
- Проверить proposals/auth/certs/PSK как гипотезы.
- Проверить routes, selectors, NAT exemption.
- Написать escalation packet: facts + what changed + timestamps.
Mock questions
- How would you troubleshoot IPsec VPN down?
- What information do you collect before escalation?
- What can break split tunnel/DNS for remote users?