Death by retransmission error's?

[ROBERT WATSON]

What is the cause of death by retransmission has anyone else experienced this? I am assuming this happens during phase 1 due to the fact that my show isa sa will never by established always showing in deleted.

2nd ne1 experience a seccessfull tunnel built but communications are occuring in only 1 direction. Configs are identicle to working IPSEC Tunnels as well. one direction meaning that the remote site can perform all work and ping the peer site but I am unable to ping or verify that a tunnel is up unless I'm in the router doing a show cry ipsec sa and conn active commands.

[ciscomoderator]

Since there has been no response to your post, it appears to be either too complex or too rare an issue for our forum members to assist you. If you don't get a suitable response to your post, you may wish to review our resources at the online Technical Assistance Center (www.cisco.com/tac) or speak with a TAC engineer. You can open a TAC case online at www.cisco.com/tac/caseopen

If anyone else in the forum has some advice, please reply to this thread.

Thank you for posting.

[thangtran]

I've experienced a similar problem where traffic can only go one direction on one tunnel. Here is part of what I did on the 506 to get around it.

1. Create an access-list 101, 102 for each remote site:

access-list 101 permit ip localnet remotenet1

access-list 102 permit ip localnet remotenet2

2. Create an access-list 103 to include all remote site (101 and 102):

access-list 103 permit ip localnet1 remotenet1

access-list 103 permit ip localnet2 remotenet2

3. Map each access-list to each SA:

crypto map mypolicy 10 match address 101

crypto map mypolicy 11 match address 102

4. Disable NAT on access-list 103:

NAT 0 access-list 103