Buy or Renew
Buy or Renew
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
cancel
Start a conversation
915
Views
0
Helpful
0
Replies

Help interpreting IOS ip packet debug detail results to help resolve VPN problem?

christopher.caruk
Beginner
Beginner

‎03-30-2013 09:02 AM - edited ‎03-04-2019 07:27 PM

Hello,

I am trying to diagnose a IPSec VPN issue.  I can extablish  VPN.  Packets seem to be arriving.  They are being decrypted but they are not exiting the router.

The setup uses an 1741w with 2 x ADSL router but for the purpose of my debug I have disabled one.  Wireless is also disabled.

ip CEF is off but I have also tried with CEF on.  The packet still does not exit thr router.

Wireshark is running on the target system (90.155.11.181) and is filtering for tcp port 80.  It is picking up requests from other IPs.

I am using IOS 15.3 and have a working zone based firewall.  I've established a site to site VPN using a crypto map as follows:

  class-map type inspect match-all sdm-cls-VPNOutsideToInside-1

   match access-group 103

  !

  policy-map type inspect ccp-permit-inservice

   class type inspect CCP_PPTP

    pass

   class type inspect sdm-cls-VPNOutsideToInside-1

    inspect

  class class-default

    drop log

  !

  zone-pair security ccp-zp-out-in source out-zone destination in-zone

   service-policy type inspect ccp-permit-inservice

  !

  access-list 101 remark CCP_ACL Category=4

  access-list 101 remark IPSec Rule

  access-list 101 permit ip 90.155.11.128 0.0.0.127 192.168.5.0 0.0.0.255

  access-list 103 remark CCP_ACL Category=0

  access-list 103 permit ip 192.168.5.0 0.0.0.255 90.155.11.128 0.0.0.127

  !

  crypto isakmp policy 1

   encr 3des

   authentication pre-share

   group 2

  crypto isakmp key xxx address 0.0.0.0         no-xauth

  !

  crypto dynamic-map SDM_DYNMAP_1 1

   set transform-set ESP-3DES-SHA1

   match address 101

  !

  crypto map SDM_CMAP_1 65535 ipsec-isakmp dynamic SDM_DYNMAP_1

  !

  crypto ipsec transform-set ESP-3DES-SHA1 esp-3des esp-sha-hmac

   mode tunnel

  !

  interface Dialer1

   description $FW_OUTSIDE$

   bandwidth 6000

   ip address negotiated

   ip flow ingress

   ip flow egress

   zone-member security out-zone

   encapsulation ppp

   dialer pool 2

   dialer-group 2

   ppp authentication chap pap callin

   ppp chap hostname xxx

   ppp chap password 0 xxx

   ppp pap sent-username xxx password 0 xxx

   crypto map SDM_CMAP_1

  !

The packet trace looks like this:

2013-03-3015:24:14debug90.155.11.129local750864*Mar 30 15:24:25.285: IP: s=192.168.5.254 (GigabitEthernet0/1), d=90.155.11.181 (GigabitEthernet0/0), len 48, output feature
2013-03-3015:24:14debug90.155.11.129local750863*Mar 30 15:24:25.285:     TCP src=62148, dst=80, seq=1866716499, ack=0, win=65535 SYN, CCE Post NAT Classification(40), rtype 1, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE
2013-03-3015:24:14debug90.155.11.129local750862*Mar 30 15:24:25.285: IP: s=192.168.5.254 (GigabitEthernet0/1), d=90.155.11.181 (GigabitEthernet0/0), len 48, output feature
2013-03-3015:24:14debug90.155.11.129local750861*Mar 30 15:24:25.285: IP: tableid=0, s=192.168.5.254 (GigabitEthernet0/1), d=90.155.11.181 (GigabitEthernet0/0), routed via RIB
2013-03-3015:24:14debug90.155.11.129local750860, MCI Check(90), rtype 0, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE
2013-03-3015:24:14debug90.155.11.129local750859*Mar 30 15:24:25.285:     TCP src=62148, dst=80, seq=1866716499, ack=0, win=65535 SYN
2013-03-3015:24:14debug90.155.11.129local750858*Mar 30 15:24:25.285: IP: s=192.168.5.254 (GigabitEthernet0/1), d=90.155.11.181, len 48, input feature
2013-03-3015:24:14debug90.155.11.129local750857*Mar 30 15:24:25.285:     TCP src=62148, dst=80, seq=1866716499, ack=0, win=65535 SYN, Virtual Fragment Reassembly After IPSec Decryption(49), rtype 0, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE
2013-03-3015:24:14debug90.155.11.129local750856*Mar 30 15:24:25.285: IP: s=192.168.5.254 (GigabitEthernet0/1), d=90.155.11.181, len 48, input feature
2013-03-3015:24:14debug90.155.11.129local750855*Mar 30 15:24:25.285:     TCP src=62148, dst=80, seq=1866716499, ack=0, win=65535 SYN, Virtual Fragment Reassembly(33), rtype 0, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE
2013-03-3015:24:14debug90.155.11.129local750854*Mar 30 15:24:25.285: IP: s=192.168.5.254 (GigabitEthernet0/1), d=90.155.11.181, len 48, input feature
2013-03-3015:24:14debug90.155.11.129local750853*Mar 30 15:24:25.285:     TCP src=62148, dst=80, seq=1866716499, ack=0, win=65535 SYN, Ingress-NetFlow(29), rtype 0, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE
2013-03-3015:24:14debug90.155.11.129local750852*Mar 30 15:24:25.285: IP: s=192.168.5.254 (GigabitEthernet0/1), d=90.155.11.181, len 48, input feature
2013-03-3015:24:14debug90.155.11.129local750851*Mar 30 15:24:25.285:     TCP src=62149, dst=80, seq=1817213112, ack=0, win=65535 SYN, packet consumed, Firewall (firewall component)(42), rtype 1, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE
2013-03-3015:24:14debug90.155.11.129local750850(GigabitEthernet0/0), len 48, output feature
2013-03-3015:24:14debug90.155.11.129local750849*Mar 30 15:24:25.285: IP: s=192.168.5.254 (GigabitEthernet0/1), d=90.155.11.181
2013-03-3015:24:14debug90.155.11.129local750848*Mar 30 15:24:25.285:     TCP src=62149, dst=80, seq=1817213112, ack=0, win=65535 SYN, CCE Post NAT Classification(40), rtype 1, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE
2013-03-3015:24:14debug90.155.11.129local750847*Mar 30 15:24:25.285: IP: s=192.168.5.254 (GigabitEthernet0/1), d=90.155.11.181 (GigabitEthernet0/0), len 48, output feature
2013-03-3015:24:14debug90.155.11.129local750846*Mar 30 15:24:25.285: IP: tableid=0, s=192.168.5.254 (GigabitEthernet0/1), d=90.155.11.181 (GigabitEthernet0/0), routed via RIB
2013-03-3015:24:14debug90.155.11.129local750845*Mar 30 15:24:25.285:     TCP src=62149, dst=80, seq=1817213112, ack=0, win=65535 SYN, MCI Check(90), rtype 0, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE
2013-03-3015:24:14debug90.155.11.129local750844*Mar 30 15:24:25.285: IP: s=192.168.5.254 (GigabitEthernet0/1), d=90.155.11.181, len 48, input feature
2013-03-3015:24:14debug90.155.11.129local750843*Mar 30 15:24:25.285:     TCP src=62149, dst=80, seq=1817213112, ack=0, win=65535 SYN, Virtual Fragment Reassembly After IPSec Decryption(49), rtype 0, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE
2013-03-3015:24:14debug90.155.11.129local750842*Mar 30 15:24:25.285: IP: s=192.168.5.254 (GigabitEthernet0/1), d=90.155.11.181, len 48, input feature
2013-03-3015:24:14debug90.155.11.129local750841*Mar 30 15:24:25.285:     TCP src=62149, dst=80, seq=1817213112, ack=0, win=65535 SYN, Virtual Fragment Reassembly(33), rtype 0, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE
2013-03-3015:24:14debug90.155.11.129local750840, len 48, input feature
2013-03-3015:24:14debug90.155.11.129local750839*Mar 30 15:24:25.285: IP: s=192.168.5.254 (GigabitEthernet0/1), d=90.155.11.181
2013-03-3015:24:14debug90.155.11.129local750838*Mar 30 15:24:25.285:     TCP src=62149, dst=80, seq=1817213112, ack=0, win=65535 SYN, Ingress-NetFlow(29), rtype 0, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE
2013-03-3015:24:14debug90.155.11.129local750837*Mar 30 15:24:25.285: IP: s=192.168.5.254 (GigabitEthernet0/1), d=90.155.11.181, len 48, input feature
2013-03-3015:24:14debug90.155.11.129local750836*Mar 30 15:24:25.285:     TCP src=62150, dst=80, seq=3741048627, ack=0, win=65535 SYN, packet consumed, Firewall (firewall component)(42), rtype 1, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE
2013-03-3015:24:14debug90.155.11.129local750835*Mar 30 15:24:25.285: IP: s=192.168.5.254 (GigabitEthernet0/1), d=90.155.11.181 (GigabitEthernet0/0), len 48, output feature
2013-03-3015:24:14debug90.155.11.129local750834*Mar 30 15:24:25.285:     TCP src=62150, dst=80, seq=3741048627, ack=0, win=65535 SYN, CCE Post NAT Classification(40), rtype 1, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE
2013-03-3015:24:14debug90.155.11.129local750833*Mar 30 15:24:25.285: IP: s=192.168.5.254 (GigabitEthernet0/1), d=90.155.11.181 (GigabitEthernet0/0), len 48, output feature
2013-03-3015:24:14debug90.155.11.129local750832*Mar 30 15:24:25.285: IP: tableid=0, s=192.168.5.254 (GigabitEthernet0/1), d=90.155.11.181 (GigabitEthernet0/0), routed via RIB
2013-03-3015:24:14debug90.155.11.129local750831*Mar 30 15:24:25.285:     TCP src=62150, dst=80, seq=3741048627, ack=0, win=65535 SYN, MCI Check(90), rtype 0, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE
2013-03-3015:24:14debug90.155.11.129local750830, len 48, input feature
2013-03-3015:24:14debug90.155.11.129