site to site VPN packet not encryp and decrypt

[R Manjunatha]

Hi

site-to-site VPN packets are not encrypted and decrypted, please let me know what could be the problem 

Site-A#sh crypto ipsec sa

interface: Ethernet0/0
Crypto map tag: cryptomap, local addr 10.10.1.1

protected vrf: (none)
local ident (addr/mask/prot/port): (10.10.1.1/255.255.255.255/0/0)
remote ident (addr/mask/prot/port): (10.10.2.2/255.255.255.255/0/0)
current_peer 10.10.2.2 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0

local crypto endpt.: 10.10.1.1, remote crypto endpt.: 10.10.2.2
path mtu 1500, ip mtu 1500, ip mtu idb Ethernet0/0
current outbound spi: 0x0(0)
PFS (Y/N): N, DH group: none







crypto isakmp policy 10
encr aes
authentication pre-share
group 2
crypto isakmp key cisco hostname 10.10.2.2
!
!
crypto ipsec transform-set mytransform esp-aes esp-sha-hmac
mode tunnel
!
!
!
crypto map cryptomap 10 ipsec-isakmp
set peer 10.10.2.2
set transform-set mytransform
match address 100
!
!
!
!
!
interface Ethernet0/0
ip address 10.10.1.1 255.255.255.0
crypto map cryptomap
!
interface Ethernet0/1
ip address 192.168.1.254 255.255.255.0
!
interface Ethernet0/2
no ip address
shutdown
!
interface Ethernet0/3
no ip address
shutdown
!
router ospf 10
network 0.0.0.0 255.255.255.255 area 0
!
ip forward-protocol nd
!
!
no ip http server
no ip http secure-server
!
access-list 100 permit ip host 10.10.1.1 host 10.10.2.2
!
!

crypto isakmp policy 10
encr aes
authentication pre-share
group 2
crypto isakmp key cisco hostname 10.10.1.1
!
!
crypto ipsec transform-set mytransform esp-aes esp-sha-hmac
mode tunnel
!
!
!
crypto map cryptomap 10 ipsec-isakmp
set peer 10.10.1.1
set transform-set mytransform
match address 100
!
!
!
!
!
interface Ethernet0/0
ip address 10.10.2.2 255.255.255.0
crypto map cryptomap
!
interface Ethernet0/1
ip address 172.16.1.254 255.255.255.0
!
interface Ethernet0/2
no ip address
shutdown
!
interface Ethernet0/3
no ip address
shutdown
!
router ospf 10
network 0.0.0.0 255.255.255.255 area 0
!
ip forward-protocol nd
!
!
no ip http server
no ip http secure-server
!
access-list 100 permit ip host 10.10.2.2 host 10.10.1.1

[Georg Pauwen · Accepted solution]

Hello,

the access lists do not look right. Try the below:

Site-A

access-list 100 permit ip 192.168.1.0 0.0.0.255 172.16.1.0 0.0.0.255

Site-B

access-list 100 permit ip 172.16.1.0 0.0.0.255 192.168.1.0 0.0.0.255

[R Manjunatha · Accepted solution]

Hi,

Well, that's correct my internal host packets are not encrypted & decrypted as a defined

 access-list

I configured the same as you said and my end users are not communicating with each other after that.

I found some miss configured Phse 1 i.e 

crypto isakmp key cisco hostname 10.10.2.2

I correct it --

crypto isakmp key cisco address 10.10.2.2

now it's working fine...

Site-A#sh crypto ipsec sa

interface: Ethernet0/0
Crypto map tag: cryptomap, local addr 10.10.1.1

protected vrf: (none)
local ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (172.16.1.0/255.255.255.0/0/0)
current_peer 10.10.2.2 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 4, #pkts encrypt: 4, #pkts digest: 4
#pkts decaps: 4, #pkts decrypt: 4, #pkts verify: 4
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0