cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
111
Views
0
Helpful
0
Replies
Highlighted
Beginner

IPsec Duplicate Isakmp sa and duplicate IPsec SA?

Hi all, hopefully someone can provide some clarity on what is happening.

I have two routers, R1 and R2, tunneling to eachother R1 - R3 - R2

I am labbing some IPsec tunnels using Crypto maps, IPsec profiles, and VTI.

When I use a crypto MAP, I get a single isakmp SA and a single IPsec SA (outbound and inbound)

When I use IPsec profiles I end up seeing duplicate isakmp sa on each router with a single IPsec SA (inbound and outbound)

R1

dst             src             state          conn-id status
200.200.200.1   200.200.200.6   QM_IDLE           1030 ACTIVE
200.200.200.6   200.200.200.1   QM_IDLE           1031 ACTIVE

R2

dst             src             state          conn-id status
200.200.200.6   200.200.200.1   QM_IDLE           1031 ACTIVE
200.200.200.1   200.200.200.6   QM_IDLE           1030 ACTIVE

 

When I do IPsec using VTI, I see the same duplicate isakmp SA but I also see duplicate IPsec SA (2 inbound and 2 outbound)

I am clearing my crypto sessions in between each re configuration using clear crypto session.

Can anyone explain what is going on here? Thanks for any help

 

Attached are my running configs for the VTI configuration: