08-15-2005 01:41 AM - edited 03-02-2019 11:42 PM
I just fixed the problem of NAT in 1712. Just upgrade the IOS. However, the IPSec did not work which is worked before. The IPSec tunnel has been establish but we cannot ping. I can ping before. The problem is do I need to reload the router when I changed the internal and external IP address? Please advice. Thanks.
Regards
Godwin
08-15-2005 06:43 AM
Godwin
It should not be necessary to reload the router just because you changed interface addresses.
When you changed the IOS to fix the problem with NAT were you careful to get a feature set that includes support for IPSec? Perhaps you can post the information about your new IOS?
HTH
Rick
08-15-2005 07:12 AM
Yes, I have checked the feature set which including the IPSec 3DES. Just upgrade IOS from 12.3(7)XR3 to 12.3(14)T3. Thanks
Regards
Godwin
08-15-2005 04:51 PM
Godwin,
Can you post the configs? Also, I am sure you are using the advanced IP services IOS which supports IPSec...
Rakesh
08-15-2005 05:25 PM
Rakesh
The attached file is the configuration. Actually, there is the same configuration and using on the old router 1710 which is running on IOS 12.2(11)T6. There is nothing problem. In addition, the VPN tunnel is establish but it cannot be access, such as ping. Please advice. Thanks.
08-16-2005 08:47 PM
hi
i feel 2 of the config lines related to the dynamic ipsec clients are mising while seeing your attached config file.
would suggest to add up those lines and chek out the result,i feel may be the config lines got invalid while migrating from the previous ios to the current ios.
crypto map mapname isakmp authorization list xxx
crypto map mapname client configuration address respond
few more links for your ref..
http://www.cisco.com/en/US/tech/tk583/tk372/technologies_configuration_example09186a0080094685.shtml
http://www.cisco.com/en/US/tech/tk583/tk372/tech_configuration_examples_list.html
regds
08-17-2005 11:19 PM
Thanks for your response. I have put those line but it did not access to the remote network. I am using the 1712 connected to the LinkSys VPN Router. The tunnel is created when I type sh crypto isakmp sa. But I cannot ping to the remote network. Please advice. Thanks.
Regards
08-18-2005 12:42 AM
Hi
Plz do confirm whether you are trying to ping either 10.3.0.0/16 or 192.168.3.0/24 coz i see only these are the intersting traffic being encrypted on ur router.
Also have look at this link which mite help u to troubleshoot the same.
but do remember that you arent enabling debugs during peak hours and also ensure that you arent enabling all the debug commands in a single stretch..
regds
08-18-2005 01:07 AM
Actually, we have built up two tunnel. One going to 10.3.0.0/24 and another one is going to 10.2.xxx.0/24. Also, I did not enable debug commands. Do you know why after upgrading the IOS, the command 'no crypto isakmp ccm' is generated. What is purpose of this statement. Please advice.
08-22-2005 06:55 PM
The problem is fixed. I just upgrade the IOS to 12.3(7)T11 rather than 12.4. I did not change any configuration. There is very strange.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide