03-13-2013 11:02 AM - edited 03-04-2019 07:16 PM
Hi everyone, we're having an issue with a few of our routers that mobile users use to remote access VPN into. These routers are also DMVPN spokes.
Basically I have two isakmp policies and ipsec policies as below:
crypto isakmp policy 3
encr 3des
authentication pre-share
group 2
!
crypto isakmp policy 10
encr 3des
hash md5
authentication pre-share
group 5
!
crypto isakmp key ABC address 0.0.0.0 0.0.0.0 no-xauth
crypto isakmp keepalive 30 5 periodic
!
crypto ipsec transform-set myset esp-3des esp-sha-hmac
crypto ipsec transform-set TS1 esp-3des esp-md5-hmac
mode transport
!
Until this morning, all of the spoke routers on DMVPN were having major issues where they would try to talk to one another but fail due to CONF_XAUTH error. Once I added the no-xauth keyword at the end of crypto isakmp key, all started working well without any issues. However since then, our remote access VPN clients are no longer working. If I remove no-xauth, remote access clients start working but DMVPN starts to flap.
Any ideas?
Solved! Go to Solution.
03-13-2013 11:14 AM
I think you can use isakmp profiles to split the keyring for the remote access and the one that is for dmvpn
Best
Hope it helps
03-13-2013 11:14 AM
I think you can use isakmp profiles to split the keyring for the remote access and the one that is for dmvpn
Best
Hope it helps
03-13-2013 06:48 PM
Thanks Enrique. I was able to resolve the issue by following steps on this link
http://www.cisco.com/en/US/tech/tk583/tk372/technologies_configuration_example09186a00801eafcb.shtml
03-13-2013 08:20 PM
Glad to know it's working fine now
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide