DMPVN isakmp authentication issue with PKI out of band certificate.

[Kach]

Hi all, 

I have a DMVPN architecture and I want to use PKI certificate for the authentication. 

1- I manually generated the Certificate Signing Requests on the Hub and spokes. 

2- I sent the certificate for signing to the CA team by email

3- When I received the signed certificates back by email, I added them on the routers

The problem is that my IPsec tunnel does not come UP. The process stuck in phase 1 ( IKE ). 
When I test the preshared key, it works. But when I use the certificates, it does not work. 

Did anyone have an idea and can help me? 

Here are the debug attached to the post. 

PS: I have configured the NTP and it is synchronized.

configuration (only IPSEC part)

=======================

HUB_DMVPN
=========

crypto isakmp policy 1
encr 3des
hash md5
group 2
crypto isakmp fragmentation
crypto isakmp aggressive-mode disable
crypto ipsec transform-set TRANSFORM_SET esp-des esp-md5-hmac
mode transport
crypto ipsec fragmentation after-encryption
crypto ipsec profile DMVPN
set transform-set TRANSFORM_SET

SPOKE2
======

crypto isakmp policy 1
encr 3des
hash md5
group 2
crypto isakmp fragmentation
crypto ipsec transform-set TRANSFORM_SET esp-des esp-md5-hmac
mode transport
crypto ipsec fragmentation after-encryption
crypto ipsec profile DMVPN
set transform-set TRANSFORM_SET

Thank you!

[balaji.bandi]

Looks like you have certificate issue, check the domain name other parameter

here is example guide can help you.

https://www.cisco.com/c/en/us/support/docs/security/dynamic-multipoint-vpn-dmvpn/117688-config-dmvpn-00.html

https://juantron.wixsite.com/my-networking-online/dmvpn-with-pki

https://www.m00nie.com/2011/11/dmvpn-with-pki-authentication-gns3-lab/

[Kach]

Thank you Balaji for the feedback. I have checked the links but they did not really help me. My certificates are generated and installed manually for the first establishment of tunnels. 

[Rob Ingram]

Hi,
Please can you provide the output of "show crypto pki certificates verbose" command and the full configuration of both routers.

[Kach]

Thank you RJI for your feedback. The devices are using the customer's CA so there is sensitive information I cannot put here. 

I am trying to find a way to attached necessary output but nothing compromising the customer. 

thank ! 

Kach!