There is however still a glitch with my VPN for some reason?
I mean it's online as running:
sh crypto isakmp sa gives me this:
IPv4 Crypto ISAKMP SA
dst src state conn-id slot status
QM_IDLE 2010 0 ACTIVE
and running: sh crypto ipsec sa gives generally good output however I do get a few errors:
PERMIT, flags={origin_is_acl,}
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 426, #recv errors 0
PERMIT, flags={origin_is_acl,}
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 426, #recv errors 0
for the various ACL parameters I've set.....
Could this be related to the MTU as before or is it something else that is causing so many send and receive errors???
I added extra config to the VPN which was this:
crypto isakmp invalid-spi-recovery
as I thought that it might help in resolving the "Invlaid SPI" notice I kept getting from the syslog and debugging.
The actual config is standard standard Site-to-Site:
crypto isakmp policy 10
authentication pre-share
crypto isakmp key address
crypto isakmp invalid-spi-recovery
!
!
crypto ipsec transform-set esp-3des esp-md5-hmac
!
crypto map 10 ipsec-isakmp
set peer
set transform-set
match address 101
with crypto map under the Dialer0 interface.
I also have this: ip nat inside source route-map NO-NAT interface Dialer0 overload
and this:
route-map NO-NAT permit 10
match ip address 110
with ACL's matching my internal networks for VPN packet forwarding and blocking the internal network addresses for NAT'ting.
Any ideas? Thanks!
