Round 6 | Read, Rate and Reward - Help Us Improve.
  

Sangfor Jojo Lv5Posted 2026-Jul-13 09:34


Dear Forum Members,
We’re launching a weekly activity to highlight our best technical documents and gather real user feedback. Every week, we select 2 docs for the community to read and review. Whether it’s a quick rating or a detailed suggestion, every piece of feedback counts — and every participant earns rewards.


How It Works                                                                                
Simply a 5-step process — join in under 3 minutes.

Rewards                                                                                       
Three ways to earn — participate, contribute, or get lucky.



Activity Rules                                                                              
- Eligible documents only.  Rewards are limited to reviews and ratings submitted for the documents listed in this week’s activity post. Feedback on other documents does not count.
- One account per person.  Each participant may use only one account. Multiple accounts will result in disqualification.
- Each user can claim a maximum of ONE participation reward and ONE quality contribution reward in total, regardless of the number of documents scored or suggestions submitted.
- Two ways to give feedback. One is text highlight, and the other is quick rating.




Featured Cases This Week                                                            

This case mainly applies to troubleshooting issues when the phase2 of Network Secure (NGAF) fails to connect to a standard IPsec VPN.


This case guides troubleshooting Sangfor NGAF intermittent network disconnections. It lists 16 inspection steps covering interfaces, policies, logs, sessions and black boxes, sorts 13 root causes, and provides device & endpoint diagnostic fixes to locate and resolve unstable link faults.



Reminder:

1) To qualify for the activity reward, all participants must submit authentic reviews or feedback before commenting "I joined".
2) Fake, repetitive, meaningless replies will not be counted toward reward distribution. We appreciate your sincere opinions.


Source: Round 5 | Read, Rate and Reward - Help Us Improve.
Rence Lv1Posted 2026-Jul-15 09:28
  
I joined                                    
Sangfor Jojo Lv5Posted 2026-Jul-14 16:12
  

Congratulations to the following 11 participants for successfully joining the event and earning a reward of 200 coins. The gold coins will be distributed uniformly after the event ends.    
Muhammad Abid, Enrico Vanzetto, Newbie585065, Korchai, Kashif R, rohmattullah, pmateus, Humayun Ahmed, Newbie A4, Doll

ND Lv3Posted 2026-Jul-14 15:54
  
      I joined
Sangfor Jojo Lv5Posted 2026-Jul-14 14:53
  
We have gathered feedback and suggestions from 11 participants. If you want your voice to be heard, join us before July 19th and make a difference!
Samianto Lv2Posted 2026-Jul-14 14:37
  
   I joined

masih_pemula Lv2Posted 2026-Jul-14 11:42
  
I joined      
Hendra Mustopa Lv2Posted 2026-Jul-14 11:40
  
I joined      
Enrico Vanzetto Lv5Posted 2026-Jul-13 22:47
  
I joined                           
pmateus Lv3Posted 2026-Jul-13 17:24
  
I joined     
Clarence Roque Lv2Posted 2026-Jul-13 13:27
  
Case 1:

When IPsec VPN Phase 1 is established but Phase 2 fails, check the following:

Verify Phase 2 Parameters
Ensure both VPN peers use the same:
Encryption algorithm (AES-128, AES-256, etc.)
Authentication algorithm (SHA-1, SHA-256, etc.)
Perfect Forward Secrecy (PFS) settings
Diffie-Hellman (DH) Group
SA Lifetime
Check Encryption Domains (Local and Remote Subnets)
Confirm that the local and remote protected networks match exactly on both VPN endpoints.
Incorrect subnet definitions are one of the most common causes of Phase 2 failure.
Review Security Policies
Verify that firewall or security policies allow traffic between the local and remote subnets.
Check Routing
Ensure routes exist for the remote network and traffic is correctly directed to the IPsec tunnel.
Inspect NAT Configuration
Make sure VPN traffic is excluded from NAT (No-NAT policy) if required.
Review VPN Logs
Check NGAF logs or debug information for Phase 2 negotiation errors such as:
Proposal mismatch
Traffic selector mismatch
PFS mismatch
Lifetime mismatch
Verify Peer Configuration
Confirm both VPN peers have identical Phase 2 settings and that the tunnel is configured correctly on both sides.

Case 2:

To troubleshoot intermittent network disconnections on Sangfor NGAF, perform the following checks:

Check Physical Interfaces
Verify interface status, link speed, duplex settings, and cable connections.
Ensure there are no interface errors or packet drops.
Monitor Interface Statistics
Check for CRC errors, collisions, packet loss, or high bandwidth utilization.
Review Firewall Policies
Ensure security policies are correctly configured and not unintentionally blocking traffic.
Check Routing Configuration
Verify default routes, static routes, and dynamic routing status.
Inspect NAT Policies
Confirm NAT rules are correctly configured and not affecting network connectivity.
Review System and Traffic Logs
Analyze logs for link flapping, session timeouts, policy denies, or hardware events.
Check Session Table
Verify active sessions and ensure the session table is not full.
Monitor Resource Utilization
Check CPU, memory, and session usage for abnormal spikes.
Verify HA Status (if applicable)
Ensure High Availability synchronization is normal and no failover events are occurring.
Check Blacklist/Whitelist Settings
Verify IP reputation, blacklist, or protection policies are not blocking legitimate traffic.
Use Packet Capture and Diagnostic Tools
Capture packets on the affected interfaces to identify where packets are being dropped.
Verify Endpoint Connectivity
Test client devices, gateway configuration, DNS resolution, and network adapters.
Review Recent Configuration Changes
Identify any recent policy, routing, firmware, or network changes that may have introduced the issue.