Hi,
we have a bunch of homes office which i am connecting over dmvpn.
the set up is working fine when i am not using ip sec, but when i am configuring ip sec the tunnel going down after 15 min, and failing to renegotiate the isakmp key.
if i am not implementing ipsec the setup not working with 3G or 4G modems but DSL Broadband working fine.
if i am implementing ipsec then viceversa. i am totally clueless what is going on..
topoly is like
HUB---------------Internet--------DSL broadband----------(DHCP ip to)------------>Spoke
here is my config
HUB without IPSec
_____________________
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
lifetime 3600
crypto isakmp key XXXX address 0.0.0.0 0.0.0.0
interface Tunnel0
ip address 172.18.18.1 255.255.255.0
no ip redirects
ip mtu 1400
ip nhrp authentication XXXX
ip nhrp map multicast dynamic
ip nhrp network-id 200
ip nhrp registration no-unique
ip tcp adjust-mss 1360
delay 1000
tunnel source GigabitEthernet0/0
tunnel mode gre multipoint
tunnel key 150
SPOKE without IPSec
---------------------------------
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
lifetime 3600
crypto isakmp key XXXX address <hub public ip>
interface Tunnel0
bandwidth 1024
ip address 172.18.18.2 255.255.255.0
no ip redirects
ip mtu 1400
ip nhrp authentication XXXX
ip nhrp map multicast <hub public ip>
ip nhrp map 172.18.18.1 <hub public ip>
ip nhrp network-id 200
ip nhrp nhs 172.18.18.1
ip tcp adjust-mss 1360
delay 1000
tunnel source FastEthernet4
tunnel destination <public ip>
tunnel key 150
---------------------------------------------------------------------------------------------------------------------
IPSEC config for hub
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
lifetime 3600
crypto isakmp key XXXX address 0.0.0.0 0.0.0.0
crypto ipsec transform-set yyyy esp-3des esp-md5-hmac
!
crypto ipsec profile prof1
set security-association lifetime seconds 900
set transform-set yyyy
interface Tunnel0
bandwidth 1024
ip address 172.18.18.1 255.255.255.0
no ip redirects
ip mtu 1400
ip nhrp authentication XXXX
ip nhrp map multicast < hub public ip>
ip nhrp map 172.18.18.1 <hub public ip>
ip nhrp network-id 200
ip nhrp nhs 172.18.18.1
ip tcp adjust-mss 1360
delay 1000
tunnel source FastEthernet4
tunnel destination <hub public ip>
tunnel key 150
tunnel protection ipsec profile prof1
Spoke With IPSEC
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
lifetime 3600
crypto isakmp key XXXX address <hub public ip>
crypto ipsec transform-set yyyy esp-3des esp-md5-hmac
!
crypto ipsec profile prof1
set security-association lifetime seconds 900
set transform-set yyyy
interface Tunnel0
bandwidth 1024
ip address 172.18.18.2 255.255.255.0
no ip redirects
ip mtu 1400
ip nhrp authentication XXXX
ip nhrp map multicast <hub public ip>
ip nhrp map 172.18.18.1 <hub public ip>
ip nhrp network-id 200
ip nhrp nhs 172.18.18.1
ip tcp adjust-mss 1360
delay 1000
tunnel source FastEthernet4
tunnel destination <public ip>
tunnel key 150
tunnel protection ipsec profile prof1
There is no firewall between hub and spoke to block any ports and no NAT.
