topic Re: Tunnel not working until remote peer initiate some traffic in Network Security

Tunnel not working until remote peer initiate some traffic

leandro.candido — Fri, 21 Feb 2020 11:26:02 GMT

Hi all,

I have configured a vpn that just working it, when we initiate the traffic. If remote to try initiate any connection, will be unble to make it.

Do you know why should is heppening this?

Just this peer is able to initiate the traffic

access-list outside_cryptomap_1 extended permit ip 1.2.3.0 255.255.255.0 4.5.6.0 255.255.255.0

crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac

crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac

crypto ipsec transform-set ESP-3DES esp-3des esp-none

crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac

crypto ipsec security-association lifetime seconds 28800

crypto ipsec security-association lifetime kilobytes 4608000

crypto map outside_map 1 match address outside_cryptomap_1

crypto map outside_map 1 set pfs group1

crypto map outside_map 1 set peer X.X.X.X

crypto map outside_map 1 set transform-set ESP-3DES

Re: Tunnel not working until remote peer initiate some traffic

Farrukh Haroon — Sat, 02 May 2009 13:17:12 GMT

Do you have a 'dynamic' crypto map setup at one side? In that case only the side with the static crypto map can initiate the connection.

Regards

Farrukh

Re: Tunnel not working until remote peer initiate some traffic

leandro.candido — Mon, 04 May 2009 00:54:55 GMT

I haven't. There is no dynamic crypto at other side.

Re: Tunnel not working until remote peer initiate some traffic

Farrukh Haroon — Mon, 04 May 2009 06:37:27 GMT

Please post more details about the setup.

What are the VPN terminating devices, IOS?

Are you using NAT-T?

What is the routing configuration?

Regards

Farrukh

Re: Tunnel not working until remote peer initiate some traffic

leandro.candido — Mon, 04 May 2009 14:06:07 GMT

The vpn terminating device is IOS.

I dont have the information if the vpn terminating is using nat-t, the only information about vpn terminating that I have are this:

crypto isakmp policy 4

encr 3des

hash md5

authentication pre-share

group 2

crypto isakmp key

crypto ipsec transform-set ZZZZZ esp-3des

crypto map XXX 11 ipsec-isakmp

set peer Y.Y.Y.Y

set transform-set ZZZZZ

match address AAAAA

ip access-list extended AAAAA

About the routing, I have a branch office that arrives via L2L until vpn and the traffic is forward to tunnel. In concern to the routing is okay.

Thank you

Re: Tunnel not working until remote peer initiate some traffic

Farrukh Haroon — Sat, 09 May 2009 07:49:59 GMT

Sorry I was away, please let me know if this issue is still open.

Regards

Farrukh

Re: Tunnel not working until remote peer initiate some traffic

leandro.candido — Sat, 09 May 2009 14:19:33 GMT

yes. Is open yet.

Re: Tunnel not working until remote peer initiate some traffic

hunnetvl01 — Tue, 19 May 2009 09:51:44 GMT

do a sh crypto isakmp sa

deb isakmp 255 and post the output