Hi balaji, phase II is up and encap/decap packet, but we can't ping the bgp peer, it is big concern for me. I have no clue what is the problem. I compared with other site, the setting remain the same. the bgp peer also be reflected in routing table I guess the established tunnel might not be valid.
aa-makit-pon72-spl-am#sh cry ipsec sa
interface: Tunnel1
Crypto map tag: Tunnel1-head-0, local addr 38.57.132.42
protected vrf: LAN
local ident (addr/mask/prot/port): (38.57.132.42/255.255.255.255/47/0)
remote ident (addr/mask/prot/port): (63.250.144.1/255.255.255.255/47/0)
current_peer 63.250.144.1 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 108, #pkts encrypt: 108, #pkts digest: 108
#pkts decaps: 155, #pkts decrypt: 155, #pkts verify: 155
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0
local crypto endpt.: 38.57.132.42, remote crypto endpt.: 63.250.144.1
plaintext mtu 1466, path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/0/1
current outbound spi: 0x40A9072(67801202)
PFS (Y/N): N, DH group: none
inbound esp sas:
spi: 0x38A2D30C(950194956)
transform: esp-gcm 256 ,
in use settings ={Transport, }
conn id: 2009, flow_id: ESG:9, sibling_flags FFFFFFFF80000008, crypto map: Tunnel1-head-0, initiator : False
sa timing: remaining key lifetime (k/sec): (4607981/3323)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE(ACTIVE)
inbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0x40A9072(67801202)
transform: esp-gcm 256 ,
in use settings ={Transport, }
conn id: 2010, flow_id: ESG:10, sibling_flags FFFFFFFF80000008, crypto map: Tunnel1-head-0, initiator : False
sa timing: remaining key lifetime (k/sec): (4607990/3323)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE(ACTIVE)
outbound ah sas:
aa-makit-pon72-spl-am#sh ip route vrf LAN 62.6.89.201
Routing Table: LAN
Routing entry for 62.6.89.201/32
Known via "static", distance 1, metric 0 (connected)
Routing Descriptor Blocks:
* directly connected, via Tunnel1
Route metric is 0, traffic share count is 1
