topic peer address: 1.1.1.1 in Network Security

Pix 515e with Mikrotik

opnineopnine — Tue, 12 Mar 2019 05:43:51 GMT

HI all,

Im trying to connect the Pix515 with Mikrotik via IPsec vpn, but I is not even doing the Phase 1.

This is the link Im using as reference.

http://wiki.mikrotik.com/wiki/MikroTik_router_to_CISCO_PIX_Firewall_IPSEC

Thanks all.

Hi, Can you provide the "show

Pranay Prasoon — Sat, 04 Apr 2015 02:51:43 GMT

Hi,

Can you provide the "show run" from PIX?

Also share output of "show crypto isakmp sa" and "show crypto IPSec sa" when you try to ping to destination network.

Please see link for more information:-

http://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/6211-38.html

Thanks

Pranay

hello, the Pix config is the

opnineopnine — Sat, 04 Apr 2015 11:06:27 GMT

hello,

the Pix config is the same as the one I posted in the link, and there is no out put for the show commands.

But I have this debug,

debug crypto isakmp 127

debug crypto ipsec 127

pixfirewall# Apr 04 11:05:40 [IKEv1]: IP = 1.0.0.2, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 128
Apr 04 11:05:40 [IKEv1 DEBUG]: IP = 1.0.0.2, processing SA payload
Apr 04 11:05:40 [IKEv1]: IP = 1.0.0.2, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + NOTIFY (11) + NONE (0) total length : 100
Apr 04 11:05:40 [IKEv1 DEBUG]: IP = 1.0.0.2, All SA proposals found unacceptable
Apr 04 11:05:40 [IKEv1]: IP = 1.0.0.2, Error processing payload: Payload ID: 1
Apr 04 11:05:40 [IKEv1 DEBUG]: IP = 1.0.0.2, IKE MM Responder FSM error history (struct &0x29452c8) <state>, <event>: MM_DONE, EV_ERROR-->MM_START, EV_RCV_MSG-->MM_START, EV_START_MM-->MM_START, EV_START_MM-->MM_START, EV_START_MM-->MM_START, EV_START_MM-->MM_START, EV_START_MM-->MM_START, EV_START_MM
Apr 04 11:05:40 [IKEv1 DEBUG]: IP = 1.0.0.2, IKE SA MM:e430d1d0 terminating: flags 0x01000002, refcnt 0, tuncnt 0
Apr 04 11:05:40 [IKEv1 DEBUG]: IP = 1.0.0.2, sending delete/delete with reason message
Apr 04 11:05:40 [IKEv1]: IP = 1.0.0.2, Removing peer from peer table failed, no match!
Apr 04 11:05:40 [IKEv1]: IP = 1.0.0.2, Error: Unable to remove PeerTblEntry
Apr 04 11:05:50 [IKEv1]: IP = 1.0.0.2, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 128
Apr 04 11:05:50 [IKEv1 DEBUG]: IP = 1.0.0.2, processing SA payload
Apr 04 11:05:50 [IKEv1]: IP = 1.0.0.2, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + NOTIFY (11) + NONE (0) total length : 100
Apr 04 11:05:50 [IKEv1 DEBUG]: IP = 1.0.0.2, All SA proposals found unacceptable
Apr 04 11:05:50 [IKEv1]: IP = 1.0.0.2, Error processing payload: Payload ID: 1
Apr 04 11:05:50 [IKEv1 DEBUG]: IP = 1.0.0.2, IKE MM Responder FSM error history (struct &0x29452c8) <state>, <event>: MM_DONE, EV_ERROR-->MM_START, EV_RCV_MSG-->MM_START, EV_START_MM-->MM_START, EV_START_MM-->MM_START, EV_START_MM-->MM_START, EV_START_MM-->MM_START, EV_START_MM-->MM_START, EV_START_MM
Apr 04 11:05:50 [IKEv1 DEBUG]: IP = 1.0.0.2, IKE SA MM:afe0d7b0 terminating: flags 0x01000002, refcnt 0, tuncnt 0
Apr 04 11:05:50 [IKEv1 DEBUG]: IP = 1.0.0.2, sending delete/delete with reason message
Apr 04 11:05:50 [IKEv1]: IP = 1.0.0.2, Removing peer from peer table failed, no match!
Apr 04 11:05:50 [IKEv1]: IP = 1.0.0.2, Error: Unable to remove PeerTblEntry

Thanks.

Well there are typos in that

Jon Marshall — Sat, 04 Apr 2015 11:09:10 GMT

Well there are typos in that link.

For example the crypto map acl in that link is -

access-list myacl permit ip 172.22.2.0 255.255.255.0 172.22.2.0 255.255.255.0

which clearly doesn't make sense.

Which end are you testing from and how are you testing ie. are you pinging etc.

If you want help then please post your configuration as asked because based on that link it could be wrong if you just did a straight translation to your firewall.

Jon

Based on debug it says "All

Pranay Prasoon — Sat, 04 Apr 2015 13:07:15 GMT

Based on debug it says "All SA proposals found unacceptable". I think "running config" would be needed. What is the version of PIX?

BTW, just found that in your

Pranay Prasoon — Sat, 04 Apr 2015 13:41:38 GMT

BTW, just found that in your link both router and PIX has peer as "1.0.0.2" which is not correct. Hope you have not configured it similarly. It Peer should be IP address of outside interface of neighbor device.

Hi all,Here is the sh run for

opnineopnine — Sat, 04 Apr 2015 14:11:06 GMT

Hi all,

Here is the sh run for my Pix. what Im doing is from a PC in my Pix side network I try to ping and Telnet a PC in the Mikrotik side, and I tried the other way and have the same issue.

pixfirewall# sh run
: Saved
:
PIX Version 7.2(2)
!
hostname pixfirewall
enable password 8Ry2YjIyt7RRXU24 encrypted
names
!
interface Ethernet0
nameif outside
security-level 0
ip address 2.0.0.2 255.255.255.0
!
interface Ethernet1
nameif inside
security-level 100
ip address 172.22.2.1 255.255.255.0
!
interface Ethernet2
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet3
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet4
shutdown
no nameif
no security-level
no ip address
!
passwd 2KFQnbNIdI.2KYOU encrypted
ftp mode passive
access-list myacl extended permit ip 172.22.2.0 255.255.255.0 172.22.2.0 255.255.255.0
access-list nonat extended permit ip 172.22.2.0 255.255.255.0 172.22.1.0 255.255.255.0
pager lines 24
mtu outside 1500
mtu inside 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
global (outside) 1 2.0.0.3
nat (inside) 0 access-list nonat
nat (inside) 1 172.22.2.0 255.255.255.0
route outside 0.0.0.0 0.0.0.0 2.0.0.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set myset esp-des esp-sha-hmac
crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map mymap 21 match address myacl
crypto map mymap 21 set peer 1.0.0.2
crypto map mymap 21 set transform-set ESP-AES-128-SHA
crypto map mymap 21 set security-association lifetime seconds 1800
crypto map mymap interface outside
crypto isakmp identity address
crypto isakmp enable outside
crypto isakmp policy 20
authentication pre-share
encryption des
hash md5
group 2
lifetime 86400
crypto isakmp policy 65535
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
tunnel-group 1.0.0.2 type ipsec-l2l
tunnel-group 1.0.0.2 ipsec-attributes
pre-shared-key *
telnet timeout 5
ssh timeout 5
console timeout 0
!
!
prompt hostname context
Cryptochecksum:17b3d21f08f0cb92f7270d12594ec75a
: end
pixfirewall#

Hi, on PIX your IPSEC

Pranay Prasoon — Sat, 04 Apr 2015 14:51:21 GMT

Hi,

on PIX your IPSEC transform set is

crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac

while from link, the transform set of router is

crypto ipsec transform-set myset esp-des esp-sha-hmac ////This is a mismatch

Also on router isakmp policy is

crypto isakmp policy 20
authentication pre-share
hash md5

Hope router is using default encryption as "des" and group 2. If not try to manually set it to this value, so that there is no mismatch.

Also if you are simply copying the configuration from the link you provided then make sure peer address is set correctly, the link has wrong config.

Thanks

Hi all, Know I have this

opnineopnine — Sun, 05 Apr 2015 13:18:00 GMT

Hi all,

Know I have this after some changes.

1 IKE Peer: 1.1.1.1
Type : L2L Role : responder
Rekey : no State : MM_WAIT_MSG5
2 IKE Peer: 1.1.1.1
Type : L2L Role : responder
Rekey : no State : MM_WAIT_MSG5
3 IKE Peer: 1.1.1.1
Type : L2L Role : responder
Rekey : no State : MM_WAIT_MSG5

I changed in both device the preshared to be sure they where the same.

hostname pixfirewall
enable password 8Ry2YjIyt7RRXU24 encrypted
names
!
interface Ethernet0
nameif Outside
security-level 0
ip address 1.1.1.2 255.255.255.252
!
interface Ethernet1
nameif Inside
security-level 100
ip address 192.168.2.1 255.255.255.0
!
interface Ethernet2
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet3
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet4
shutdown
no nameif
no security-level
no ip address
!
passwd 2KFQnbNIdI.2KYOU encrypted
ftp mode passive
access-list Outside_1_cryptomap extended permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0
access-list inside_nat_outbound remark PAT all out
access-list inside_nat_outbound extended permit ip 192.168.2.0 255.255.255.0 any
access-list inside_nat0_outbound extended permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0
pager lines 24
mtu Outside 1500
mtu Inside 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
global (Outside) 1 interface
nat (Inside) 0 access-list inside_nat0_outbound
nat (Inside) 1 access-list inside_nat_outbound
route Outside 0.0.0.0 0.0.0.0 1.1.1.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto map Outside_map 1 match address Outside_1_cryptomap
crypto map Outside_map 1 set pfs
crypto map Outside_map 1 set peer 1.1.1.1
crypto map Outside_map 1 set transform-set ESP-3DES-MD5
crypto map Outside_map interface Outside
crypto isakmp enable Outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash md5
group 2
lifetime 86400
crypto isakmp policy 65535
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
tunnel-group 1.1.1.1 type ipsec-l2l
tunnel-group 1.1.1.1 ipsec-attributes
pre-shared-key *
telnet timeout 5
ssh timeout 5
console timeout 0
!
!
prompt hostname context
Cryptochecksum:7ff1118c7dc9b3dfdba57771486733ff
: end

Thanks.

MM5 still suggest other end

Pranay Prasoon — Sun, 05 Apr 2015 14:43:41 GMT

MM5 still suggest other end not authenticating pre-shred key, take debug of "crypto isakmp sa" on both router and PIX and see why it fails.

Hello Pranay. This is the

opnineopnine — Sun, 05 Apr 2015 15:01:45 GMT

Hello Pranay.

This is the output of the debug.

pixfirewall# Apr 05 14:58:59 [IKEv1 DEBUG]: Group = 1.1.1.1, IP = 1.1.1.1, IKE MM Responder FSM error history (struct &0x2929a98) <state>, <event>: MM_DONE, EV_ERROR-->MM_WAIT_MSG5, EV_PROB_AUTH_FAIL-->MM_WAIT_MSG5, EV_TIMEOUT-->MM_WAIT_MSG5, NullEvent-->MM_SND_MSG4, EV_CRYPTO_ACTIVE-->MM_SND_MSG4, EV_SND_MSG-->MM_SND_MSG4, EV_START_TMR-->MM_SND_MSG4, EV_RESEND_MSG
Apr 05 14:58:59 [IKEv1 DEBUG]: Group = 1.1.1.1, IP = 1.1.1.1, IKE SA MM:76089618 terminating: flags 0x01004002, refcnt 0, tuncnt 0
Apr 05 14:58:59 [IKEv1 DEBUG]: Group = 1.1.1.1, IP = 1.1.1.1, sending delete/delete with reason message
Apr 05 14:58:59 [IKEv1 DEBUG]: Group = 1.1.1.1, IP = 1.1.1.1, constructing blank hash payload
Apr 05 14:58:59 [IKEv1 DEBUG]: Group = 1.1.1.1, IP = 1.1.1.1, constructing IKE delete payload
Apr 05 14:58:59 [IKEv1 DEBUG]: Group = 1.1.1.1, IP = 1.1.1.1, constructing qm hash payload
Apr 05 14:58:59 [IKEv1]: IP = 1.1.1.1, IKE_DECODE SENDING Message (msgid=4e03b73e) with payloads : HDR + HASH (8) + DELETE (12) + NONE (0) total length : 76
Apr 05 14:58:59 [IKEv1]: Group = 1.1.1.1, IP = 1.1.1.1, Removing peer from peer table failed, no match!
Apr 05 14:58:59 [IKEv1]: Group = 1.1.1.1, IP = 1.1.1.1, Error: Unable to remove PeerTblEntry
Apr 05 14:59:06 [IKEv1]: IP = 1.1.1.1, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 124
Apr 05 14:59:06 [IKEv1 DEBUG]: IP = 1.1.1.1, processing SA payload
Apr 05 14:59:06 [IKEv1 DEBUG]: IP = 1.1.1.1, Oakley proposal is acceptable
Apr 05 14:59:06 [IKEv1 DEBUG]: IP = 1.1.1.1, processing VID payload
Apr 05 14:59:06 [IKEv1 DEBUG]: IP = 1.1.1.1, Received Cisco Unity client VID
Apr 05 14:59:06 [IKEv1 DEBUG]: IP = 1.1.1.1, processing VID payload
Apr 05 14:59:06 [IKEv1 DEBUG]: IP = 1.1.1.1, Received DPD VID
Apr 05 14:59:06 [IKEv1 DEBUG]: IP = 1.1.1.1, processing IKE SA payload
Apr 05 14:59:06 [IKEv1 DEBUG]: IP = 1.1.1.1, IKE SA Proposal # 1, Transform # 1 acceptable Matches global IKE entry # 3
Apr 05 14:59:06 [IKEv1 DEBUG]: IP = 1.1.1.1, constructing ISAKMP SA payload
Apr 05 14:59:06 [IKEv1 DEBUG]: IP = 1.1.1.1, constructing Fragmentation VID + extended capabilities payload
Apr 05 14:59:06 [IKEv1]: IP = 1.1.1.1, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108
Apr 05 14:59:07 [IKEv1]: IP = 1.1.1.1, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + KE (4) + NONCE (10) + NONE (0) total length : 188
Apr 05 14:59:07 [IKEv1 DEBUG]: IP = 1.1.1.1, processing ke payload
Apr 05 14:59:07 [IKEv1 DEBUG]: IP = 1.1.1.1, processing ISA_KE payload
Apr 05 14:59:07 [IKEv1 DEBUG]: IP = 1.1.1.1, processing nonce payload
Apr 05 14:59:07 [IKEv1 DEBUG]: IP = 1.1.1.1, constructing ke payload
Apr 05 14:59:07 [IKEv1 DEBUG]: IP = 1.1.1.1, constructing nonce payload
Apr 05 14:59:07 [IKEv1 DEBUG]: IP = 1.1.1.1, constructing Cisco Unity VID payload
Apr 05 14:59:07 [IKEv1 DEBUG]: IP = 1.1.1.1, constructing xauth V6 VID payload
Apr 05 14:59:07 [IKEv1 DEBUG]: IP = 1.1.1.1, Send IOS VID
Apr 05 14:59:07 [IKEv1 DEBUG]: IP = 1.1.1.1, Constructing ASA spoofing IOS Vendor ID payload (version: 1.0.0, capabilities: 20000001)
Apr 05 14:59:07 [IKEv1 DEBUG]: IP = 1.1.1.1, constructing VID payload
Apr 05 14:59:07 [IKEv1 DEBUG]: IP = 1.1.1.1, Send Altiga/Cisco VPN3000/Cisco ASA GW VID
Apr 05 14:59:07 [IKEv1]: IP = 1.1.1.1, Connection landed on tunnel_group 1.1.1.1
Apr 05 14:59:07 [IKEv1 DEBUG]: Group = 1.1.1.1, IP = 1.1.1.1, Generating keys for Responder...
Apr 05 14:59:07 [IKEv1]: IP = 1.1.1.1, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + KE (4) + NONCE (10) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 256
no deApr 05 14:59:09 [IKEv1 DEBUG]: Group = 1.1.1.1, IP = 1.1.1.1, IKE MM Responder FSM error history (struct &0x292bd58) <state>, <event>: MM_DONE, EV_ERROR-->MM_WAIT_MSG5, EV_PROB_AUTH_FAIL-->MM_WAIT_MSG5, EV_TIMEOUT-->MM_WAIT_MSG5, NullEvent-->MM_SND_MSG4, EV_CRYPTO_ACTIVE-->MM_SND_MSG4, EV_SND_MSG-->MM_SND_MSG4, EV_START_TMR-->MM_SND_MSG4, EV_RESEND_MSG
Apr 05 14:59:09 [IKEv1 DEBUG]: Group = 1.1.1.1, IP = 1.1.1.1, IKE SA MM:7b8ec6f4 terminating: flags 0x01004002, refcnt 0, tuncnt 0
Apr 05 14:59:09 [IKEv1 DEBUG]: Group = 1.1.1.1, IP = 1.1.1.1, sending delete/delete with reason message
Apr 05 14:59:09 [IKEv1 DEBUG]: Group = 1.1.1.1, IP = 1.1.1.1, constructing blank hash payload
Apr 05 14:59:09 [IKEv1 DEBUG]: Group = 1.1.1.1, IP = 1.1.1.1, constructing IKE delete payload
Apr 05 14:59:09 [IKEv1 DEBUG]: Group = 1.1.1.1, IP = 1.1.1.1, constructing qm hash payload
Apr 05 14:59:09 [IKEv1]: IP = 1.1.1.1, IKE_DECODE SENDING Message (msgid=a5821508) with payloads : HDR + HASH (8) + DELETE (12) + NONE (0) total length : 76
Apr 05 14:59:09 [IKEv1]: Group = 1.1.1.1, IP = 1.1.1.1, Removing peer from peer table failed, no match!
Apr 05 14:59:09 [IKEv1]: Group = 1.1.1.1, IP = 1.1.1.1, Error: Unable to remove PeerTblEntry

Well not sure why other end

Pranay Prasoon — Sun, 05 Apr 2015 15:58:25 GMT

Well not sure why other end is not responding to authentication. Is there any Firewall in between router and firewall?. Also can you share router's config, i can test in my lab.

They are connected directly.

opnineopnine — Sun, 05 Apr 2015 16:41:30 GMT

They are connected directly.

And this is the document im using for the config.

http://gregsowell.com/wp-content/uploads/2009/12/GregSowell-mikrotik-vpn1.pdf

No firewall or router in the middle.

Thanks.

well config on PIX seems to

Pranay Prasoon — Sun, 05 Apr 2015 21:54:53 GMT

well config on PIX seems to be okay. I would suggest to reconfigure pre-share key (both side should match) and do a "clear crypto isakmp" on PIX and test again.

If you have support contract, you may open a TAC case.

Hello Pranay, I will open a

opnineopnine — Sun, 05 Apr 2015 22:05:13 GMT

Hello Pranay,

I will open a case, but I tryed with an ASA insted of the pix and it worked with no issue, but I will have to open a case.

Thanks for all your help and support.

Hello Pranay, I finally did

opnineopnine — Thu, 09 Apr 2015 13:25:27 GMT

Hello Pranay,

I finally did it work the phase 1 of the connection, but now the issue is I can't ping from inside to inside of the vpn.

Thanks.

do you see ipsec tunnel

Pranay Prasoon — Thu, 09 Apr 2015 14:13:22 GMT

do you see ipsec tunnel created?

show crypto ipsec sa

the tunnel was created IKE

opnineopnine — Thu, 09 Apr 2015 14:39:15 GMT

the tunnel was created

IKE Peer: 1.1.1.1
Type : L2L Role : responder
Rekey : no State : MM_ACTIVE

The issue is that the ping between the insides address is not working.

yes, but this is phase 1

Pranay Prasoon — Thu, 09 Apr 2015 15:00:05 GMT

yes, but this is phase 1 tunnel. ipsec sa is phase 2 which will show if encryption and decryption of data is happening.

peer address: 1.1.1.1

opnineopnine — Thu, 09 Apr 2015 16:57:18 GMT

peer address: 1.1.1.1
Crypto map tag: outside_map, seq num: 51, local addr: 200.80.147.254

access-list test permit ip 192.168.100.0 255.255.255.0 192.168.22.0 255.255.255.0
local ident (addr/mask/prot/port): (192.168.100.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (192.168.22.0/255.255.255.0/0/0)
current_peer: 1.1.1.1

#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 44147, #pkts decrypt: 44147, #pkts verify: 44147
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0
#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
#send errors: 0, #recv errors: 0

local crypto endpt.: 1.1.1.2, remote crypto endpt.: 1.1.1.1

path mtu 1500, ipsec overhead 58, media mtu 1500
current outbound spi: 0B47667C

inbound esp sas:
spi: 0x3552F180 (894628224)
transform: esp-3des esp-md5-hmac no compression
in use settings ={L2L, Tunnel, PFS Group 2, }
slot: 0, conn_id: 5992448, crypto-map: outside_map
sa timing: remaining key lifetime (kB/sec😞 (4373270/8059)
IV size: 8 bytes
replay detection support: Y
Anti replay bitmap:
0xFFFFFFFF 0xFFFFFFFF
outbound esp sas:
spi: 0x0B47667C (189228668)
transform: esp-3des esp-md5-hmac no compression
in use settings ={L2L, Tunnel, PFS Group 2, }
slot: 0, conn_id: 5992448, crypto-map: outside_map
sa timing: remaining key lifetime (kB/sec😞 (4374000/8059)
IV size: 8 bytes
replay detection support: Y
Anti replay bitmap:
0x00000000 0x00000001