Hello all,
I have the following scenario
RT1 wan private IP <--> RT2 nat - wan public IP <- internet -> RT3 wan public IP
I have to configure a point to point ipsec protected tunnel between RT1 and RT3.
RT2 is doing one to one nat from its wan public IP to the RT1 wan private IP (tested and seems to be working). ssh from RT3 to RT2 public IP land on RT1. So far so good.
A simple GRE tunnel between RT1 and RT3 works fine also. I can ping remote tunnel interfaces.
Once I add IPSec tunnel protection in the tunnel interfaces of RT1 and RT3 the communication fails. (tested both isakmp and ikev2 and also several parameters for transform set). Interesting is that tunnel interface on RT1 has protocol UP but for the one on RT3 protocol is DOWN
The most interesting fact is that if I migrate to site to site vpn without tunnel interfaces, but using crypto map and ACL the IPSec tunnel works just fine.
Debug crypto isakmp or ikv2 error shows only some generic messages and couldn't identify where the problem is:
--- during ISAKMP tests ---
May 21 12:55:42.720: ISAKMP-ERROR: (0):deleting SA reason "Death by retransmission P1" state (R) MM_SA_SETUP (peer ....)
May 21 12:55:42.720: ISAKMP-ERROR: (0):deleting SA reason "Death by retransmission P1" state (R) MM_SA_SETUP (peer ....)
May 21 12:55:52.495: ISAKMP-ERROR: (0):SA is still budding. Attached new ipsec request to it. (local ...., remote ....)
May 21 12:55:52.496: ISAKMP-ERROR: (0):Error while processing SA request: Failed to initialize SA
May 21 12:55:52.496: ISAKMP-ERROR: (0):Error while processing KMI message 0, error 2.
May 21 12:55:54.497: %CRYPTO_ENGINE-3-CSDL_COMPLIANCE_FAIL: Cisco PSB security compliance violation is detected. Use of MD5 by Crypto IKMP is denied
May 21 12:55:54.497: ISAKMP-ERROR: (0):failed to set SKEYID
---------------------
--- during IKEv2 tests ---
May 21 12:39:32.030: IKEv2-ERROR:Couldn't find matching SA: Detected an invalid IKE SPI
May 21 12:39:32.030: IKEv2-ERROR:Address type 2986272779 not supported
May 21 12:39:32.030: IKEv2-ERROR:: A supplied parameter is incorrect
May 21 12:39:32.038: IKEv2-ERROR:(SESSION ID = 34,SA ID = 1):: Failed to locate an item in the database
May 21 12:39:32.038: IKEv2-ERROR:(SESSION ID = 34,SA ID = 1):: Auth exchange failed
May 21 12:39:33.945: IKEv2-ERROR:Address type 2147505703 not supported
May 21 12:39:33.945: IKEv2-ERROR:Couldn't find matching SA: Detected an invalid IKE SPI
May 21 12:39:33.946: IKEv2-ERROR:Address type 2986272779 not supported
May 21 12:39:33.946: IKEv2-ERROR:: A supplied parameter is incorrect
---
Any ideas, hints?
Thanks a lot
