Remove Crytpo Map and Pix locks up

tony.hanson · ‎10-12-2004

We have a site to site VPN and we are migrating to a new DSL connection on one side and when I went to remove the crypto map so I could put in the new peer address the pix locks up. I've had this happen before and know that there is a procedure to prevent this but don't know what it is. All I'm trying to do is change the address from the: "crypto map AMLVPN 10 set peer xx.xx.xx.xxx" to the new IP address of the new DSL connection.

Patrick Iseli · ‎10-13-2004

Use this commands to clear/reset all connections:

clear ipsec sa

clear isakmp sa

Use this command to reset a specific VPN peer:

clear [crypto] ipsec sa entry destination-address protocol spi

clear [crypto] ipsec sa map map-name

clear [crypto] ipsec sa peer

Command reference FOS ver 6.3:

crypto ipsec

------------

Create, view, or delete IPSec security associations, security association global lifetime values, and global transform sets.

[no] crypto ipsec security-association lifetime seconds seconds | kilobytes kilobytes

crypto ipsec transform-set transform-set-name transform1 [transform2 [transform3]]

crypto ipsec transform-set transform-set-name mode transport

clear [crypto] ipsec sa

clear [crypto] ipsec sa counters

clear [crypto] ipsec sa entry destination-address protocol spi

clear [crypto] ipsec sa map map-name

clear [crypto] ipsec sa peer

show crypto ipsec security-association lifetime

show crypto ipsec transform-set [tag transform-set-name]

show crypto ipsec sa [map map-name | address | identity] [detail]

See in the command reference for more details:

http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_command_reference_chapter09186a00801727a6.html#wp1026972

sincerely

Patrick

subaa · ‎10-13-2004

Hi,

The order of the commands is really important. Do the following

1) disable isakmp on the interface in question

2) clear the crypto map from the interface

3) modify the crypto map definition (e.g. peer)

4) clear the SAs.

5) put the cry map back to the interface

6) reenable the isakmp on the interface

In config:

no cry isak en outside

no cry map AMLVPN int outside

no cry map AMLVPN 10 set peer A.B.C.D

cry map AMLVPN 10 set peer D.C.B.A

cle cry ips sa

cle cry sa

cle cry isa sa

cry map AMLVPN int outside

isak en outside

If you follow this order, it works. I often migrate my clients w/ this, even if they are 2000 Km far from here... 😄

SubAa

tony.hanson · ‎10-13-2004

Thanks for your input, I will try this tonight and reply tomorrow and let you know.

tony.hanson · ‎10-14-2004

Worked out well.

Thanks!