- Cisco Community
- Technology and Support
- Networking
- Routing
- Site2Site: ACL are not installed, IPSec SA are fine
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
11-03-2019 02:44 PM - edited 11-03-2019 02:53 PM
Hello Community.
I am not a native English speaker, so sorry for that.
I have a strange problem running a site2site IPSec tunnel which work well on a 2821 on a ASR1002X AES License.
First what i know, eg. have done.
The IOS-XE 16.9.4 dont work on dynamic remote vpn because crypto map CMAP isakmp authorization list GROUPAUTHOR dont work. There is a new way to configure ISAKMP groups via profiles which require an not documented "password" parameter. Okay i downgraded to 16.7.1 and the VPN part for dialin user (OSX, HO-Router etc.) is back in service. The above crypto statement is available. The site2site problem i am facing is pretty strange. The remote end, Verizon IPSec Tunnel runing since 7 years without problems. Config follow.
Behavior is easy to explain. I clear the sessions on the 2821 and shut the interface. I no shut the new interface on the ASR and i trigger the remote end to establish the tunnel wit a phone call (SIP Interconnect). The tunnel imediately start to come up on the ASR. IKE P1 complete IPSec P1 will use the ACL to insert the protected network in the routing database. That fails. Errormessages not really appear (deb cry isa, deb cry ips) will paste it later. After the tunnel is up and active i tried to ping remote end. No resonse because routing ends on the ASR.
My questions are, what went wrong in the IOS-XE with ACLs?
Why the config is ignored?
Do i miss some global configuration statements to activate the ACL route installation?
The config is far from a complicated one.
I have tried 16.7.1, 16.3.5 same config, also same main behaviour.
Here the config from the ASR (interesting part plus all globals. IPs are masked to 10.0.0.0/8 but consistent)
version 16.7
service timestamps debug datetime msec
service timestamps log datetime msec
platform qfp utilization monitor load 80
no platform punt-keepalive disable-kernel-core
platform hardware throughput level 5000000
!
hostname ASR1002X
!
boot-start-marker
boot system bootflash:asr1002x-universalk9.16.07.01.SPA.bin
boot-end-marker
!
!
vrf definition Mgmt-intf
!
address-family ipv4
exit-address-family
!
address-family ipv6
exit-address-family
!
enable secret 5 xxxxxxxxxxxxxxx
!
!
transport-map type persistent webui https-webui
secure-server
!
transport-map type persistent ssh sshhandler
authentication-retries 1
rsa keypair-name sshkeys
transport interface GigabitEthernet0
connection wait allow interruptible
!
aaa new-model
!
!
aaa authentication login userauthen local
aaa authentication ppp default local
aaa authorization network groupauthor local
!
!
!
!
!
!
aaa session-id common
!
!
!
!
!
!
ip nbar http-services
!
!
!
ip name-server x.x.x.x y.y.y.y
!
!
!
login on-success log
!
!
!
!
!
!
!
subscriber templating
!
!
!
!
!
!
!
multilink bundle-name authenticated
!
domain domain.net
!
!
!
!
!
!
!
ivr prompt buffers 2
license udi pid ASR1002-X sn ABC123456
no license smart enable
!
spanning-tree extend system-id
diagnostic bootup level minimal
!
!
!
username user .....!*Few Remote User
!
redundancy
mode none
!
!
!
!
!
!
!
!
!
no crypto isakmp default policy
!
crypto isakmp policy 1
encr aes 256
hash md5
authentication pre-share
group 2
!
crypto isakmp policy 2
encr aes
hash md5
authentication pre-share
group 2
!
crypto isakmp policy 3
encr aes 256
hash sha256
authentication pre-share
group 14
lifetime 3600
!
crypto isakmp policy 5
encr aes
authentication pre-share
group 2
!
crypto isakmp policy 10
encr 3des
hash md5
authentication pre-share
group 2
!
crypto isakmp policy 11
encr 3des
authentication pre-share
group 2
!
crypto isakmp policy 12
encr 3des
authentication pre-share
group 2
!
crypto isakmp policy 13
encr 3des
authentication pre-share
group 2
crypto isakmp key preshared-key-secret address 10.10.1.238
crypto isakmp key preshared-key-secret address 10.10.2.238
crypto isakmp key preshared-key-secret address 10.10.3.238
crypto isakmp invalid-spi-recovery
crypto isakmp keepalive 60 periodic
crypto isakmp nat keepalive 30
!
crypto isakmp client configuration group VPNGROUP
key xxxxx
dns x.x.x.x y.y.y.y
domain domain.net
pool IPPool
save-password
!
crypto ipsec security-association lifetime seconds 86400
crypto ipsec security-association replay window-size 512
!
crypto ipsec transform-set ipcom esp-3des esp-md5-hmac
mode tunnel
!
!
!
crypto dynamic-map dynvpn 1
set nat demux
set transform-set ipcom
!
!
crypto map CRYMAP local-address GigabitEthernet0/0/1
crypto map CRYMAP 1 ipsec-isakmp
description VzB DTM
set peer 10.10.1.238
set transform-set ipcom
set pfs group2
match address 120
crypto map CRYMAP 2 ipsec-isakmp
description VzB AMS
set peer 10.10.2.238
set transform-set ipcom
set pfs group2
match address 121
crypto map CRYMAP 3 ipsec-isakmp
description VzB LND
set peer 10.10.3.238
set transform-set ipcom
set pfs group2
match address 122
!
crypto map VPN local-address GigabitEthernet0/0/2
crypto map VPN client authentication list userauthen
crypto map VPN isakmp authorization list groupauthor
crypto map VPN client configuration address respond
crypto map VPN 10 ipsec-isakmp dynamic dynmap
crypto map VPN 20 ipsec-isakmp dynamic dynvpn
!
!
!
!
!
!
!
interface GigabitEthernet0/0/0
ip address 10.1.1.10 255.255.255.192
no ip redirects
ip nbar protocol-discovery
shutdown
negotiation auto
!
interface GigabitEthernet0/0/1
ip address 10.1.2.219 255.255.255.192
no ip redirects
ip nbar protocol-discovery
ip tcp adjust-mss 1260
shutdown
negotiation auto
crypto map CRYMAP
!
interface GigabitEthernet0/0/2
ip address 10.1.3.10 255.255.255.240
no ip redirects
ip nbar protocol-discovery
ip tcp adjust-mss 1260
negotiation auto
ipv6 nd ra suppress
crypto map DUSVPN
!
interface GigabitEthernet0/0/3
no ip address
shutdown
negotiation auto
!
interface GigabitEthernet0/0/4
no ip address
shutdown
negotiation auto
!
interface GigabitEthernet0/0/5
no ip address
shutdown
negotiation auto
!
interface GigabitEthernet0
vrf forwarding Mgmt-intf
ip address 10.10.10.251 255.255.255.0
negotiation auto
!
no ip forward-protocol nd
ip http secure-server
ip http timeout-policy idle 600 life 86400 requests 1
ip http session-idle-timeout 1200
ip tftp source-interface GigabitEthernet0
ip route 0.0.0.0 0.0.0.0 10.1.1.1
ip route vrf Mgmt-intf 0.0.0.0 0.0.0.0 10.10.10.1
!
ip ssh server algorithm authentication password
!
access-list 10 permit 10.1.1.7 log
access-list 10 deny any log
access-list 11 permit 10.1.10.0 0.0.0.255
access-list 11 permit 10.1.1.0 0.0.0.16
access-list 11 permit 10.1.2.0 0.0.0.255
access-list 11 deny any log
access-list 120 permit ip 10.1.1.0 0.0.0.255 10.11.1.192 0.0.0.31
access-list 121 permit ip 10.1.1.0 0.0.0.255 10.11.2.192 0.0.0.31
access-list 122 permit ip 10.1.1.0 0.0.0.255 10.11.3.192 0.0.0.31
!
!
!
!
!
!
control-plane
!
!
!
!
!
!
line con 0
stopbits 1
line aux 0
stopbits 1
line vty 0 4
!
transport type persistent webui input https-webui
!
end
So thats the router config.
Is there any missing in cause of the different systems between the C2821 and the ASR1002X?
Here a full establishing log, all is fine except traffic thru the tunnel. No routing is installed :( I marked intersting parts BOLD:
So any tipp or hint what can resolve this isse would be appreciated.
Thanks in advance,
kind regards,
Udo
Solved! Go to Solution.
- Labels:
-
ASR 1000 Series
Accepted Solutions
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
11-08-2019 12:44 AM - edited 11-08-2019 12:50 AM
Hi Georg.
Yes i can prost it here. I found the solution after days of reading issues and posts about "VRF-Aware IPSec VPN". But all was complicated and many things you don't need. I am a admin who love simple and clear configurations that do what i want, not more.
You don't need VTI. Because you need to change the remote side too because of lack of pre shared key, you need in a plain Crypto Map and ACL setup. You also dnt need such OSPF or BGP or RIP routing monsters to do the simple thing i am tried to achive.
I only use the VRF vzb as a route engine as it is. This mechanism still works on a ASR1002X to push the protected traffic thru the tunnel. Benefit is a separation of crypto traffic in a virtual instance you miss in pure ACL based routing (which definitively not work on a ASR1002X). Because i love simple but complete examples here my actual config. Stripped another VPN partner and the Dialup VPN.
The BOLD parts are statements i added in comparison to the original C2821 config without VRF. Keyring needs to changed to original crypto isakmp key <secretkey> address <peer-ip> for each peer.
aaa new-model ! aaa authentication login userauthen local aaa authorization network groupauthor local ! aaa session-id common ! ip vrf vzb ! ip name-server <nameserver ips> ! crypto keyring vzb vrf vzb pre-shared-key address <peerip-ldn> key <secretkey> pre-shared-key address <peerip-dtm> key <secretkey> pre-shared-key address <peerip-ams> key <secretkey> ! no crypto isakmp default policy ! crypto isakmp policy 3 encr aes 256 hash sha256 authentication pre-share group 14 lifetime 3600 ! crypto isakmp policy 10 encr 3des hash md5 authentication pre-share group 2 crypto isakmp keepalive 60 periodic crypto isakmp nat keepalive 30 ! crypto isakmp profile vzb-ike-prof vrf vzb keyring vzb match identity address <peerip-ldn> 255.255.255.255 match identity address <peerip-dtm> 255.255.255.255 match identity address <peerip-ams> 255.255.255.255 ! crypto ipsec security-association lifetime seconds 86400 crypto ipsec security-association replay window-size 1024 ! crypto ipsec transform-set ipcom esp-3des esp-md5-hmac mode tunnel ! crypto map CRYMAP local-address GigabitEthernet0/0/1 crypto map CRYMAP 1 ipsec-isakmp description VzB DTM set peer <peerip-dtm> set transform-set ipcom set pfs group2 set isakmp-profile vzb-ike-prof match address VZB-DTM reverse-route crypto map CRYMAP 2 ipsec-isakmp description VzB AMS set peer <peerip-ams> set transform-set ipcom set pfs group2 set isakmp-profile vzb-ike-prof match address VZB-AMS reverse-route crypto map CRYMAP 3 ipsec-isakmp description VzB LND set peer <peerip-ldn> set transform-set ipcom set pfs group2 set isakmp-profile vzb-ike-prof match address VZB-LDN reverse-route ! interface GigabitEthernet0/0/0 no ip address shutdown negotiation auto ! interface GigabitEthernet0/0/1 ip vrf forwarding vzb ip address <our-peer-ip> 255.255.255.192 no ip redirects negotiation auto crypto map CRYMAP ! interface GigabitEthernet0/0/2 ip address <defaultip-router> 255.255.255.240 no ip redirects negotiation auto ipv6 nd ra suppress ! interface GigabitEthernet0/0/3 no ip address shutdown negotiation auto ! interface GigabitEthernet0/0/4 no ip address shutdown negotiation auto ! interface GigabitEthernet0/0/5 no ip address shutdown negotiation auto ! interface GigabitEthernet0 vrf forwarding Mgmt-intf ip address 10.10.10.251 255.255.255.0 negotiation auto ! ip forward-protocol nd ip http server ip http secure-server ip http timeout-policy idle 600 life 86400 requests 1 ip tftp source-interface GigabitEthernet0 ip route 0.0.0.0 0.0.0.0 <uplink-gatewayip> ip route vrf Mgmt-intf 0.0.0.0 0.0.0.0 10.10.10.1 ip route vrf vzb 0.0.0.0 0.0.0.0 <gw-ip-our-peer-net> ! ip access-list extended VZB-AMS permit ip <local-protected-net> 0.0.0.255 <remote-protected-net-ams> 0.0.0.31 ip access-list extended VZB-DTM permit ip <local-protected-net> 0.0.0.255 <remote-protected-netdtm> 0.0.0.31 ip access-list extended VZB-LDN permit ip <local-protected-net> 0.0.0.255 <remote-protected-net-ldn> 0.0.0.31 ! ! control-plane ! line con 0 stopbits 1 line aux 0 stopbits 1 line vty 0 4 session-timeout 35000 ! transport type persistent webui input https-webui ! ntp source GigabitEthernet0/0/2 ntp server <ntp-server-ip> ! wsma agent exec ! wsma agent config ! wsma agent filesys ! wsma agent notify ! end
Hope this will help anybody who migrate an old IOS-VPN-Aggregator to an IOS-XE ASR and prevent Administrator-Suicide :).
Best,
Udo
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
11-03-2019 11:57 PM
Hello,
not sure what your topology looks like, but you have three interfaces:
interface GigabitEthernet0/0/0
ip address 10.1.1.10 255.255.255.192
no ip redirects
ip nbar protocol-discovery
shutdown
negotiation auto
!
interface GigabitEthernet0/0/1
ip address 10.1.2.219 255.255.255.192
no ip redirects
ip nbar protocol-discovery
ip tcp adjust-mss 1260
shutdown
negotiation auto
crypto map CRYMAP
!
interface GigabitEthernet0/0/2
ip address 10.1.3.10 255.255.255.240
no ip redirects
ip nbar protocol-discovery
ip tcp adjust-mss 1260
negotiation auto
ipv6 nd ra suppress
crypto map DUSVPN
and one default route:
ip route 0.0.0.0 0.0.0.0 10.1.1.1
The default route points to the other side of interface GigabitEthernet0/0/0, and that interface has no crypto map applied ?
That said, the crypto map applied to interface GigabitEthernet0/0/2 (DUSVPN) doesn't exist, or did you just not post it ?
Either way, check your routing. Actually, using VTI tunnels instead of crypto maps usually works better,so you might want to try and reconfigure your VPN with VTIs...
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
11-04-2019 02:00 AM - edited 11-04-2019 02:09 AM
Hi Georg,
sorry for the confusion. The default route is wrong "translated".
-ip route 0.0.0.0 0.0.0.0 10.1.1.1
+ip route 0.0.0.0 0.0.0.0 10.1.3.1
Interface gig 0/0/0 is shutdown. It's the next crypto Interface i want to bring in service. But fist i need to solve the problem. I will take a look in VTI. You mean Virtual Tunnel Interface right? Never use that virtual stuff in 25 years ;(
The routing is pretty well. On the Router 10.1.3.1 are following routes for the remote peers and net's
ip route 10.11.1.192 255.255.255.192 10.1.219
ip route 10.11.2.192 255.255.255.192 10.1.219
ip route 10.11.3.192 255.255.255.192 10.1.219
Its pretty simple. The ASR is on the same Switch as the C2801 is. I only shut the interfaces via serial console and clear the arp cache on the router with the routes above.
My config works on a 2901 and a 2821 perfectly. I can't believe that the ASR is not able to do that as an "Aggregated Service Router" it's able to handle 40k IPSec sessions.
Best,
Udo
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
11-04-2019 02:09 AM
Hello Udo,
there was a recent case here on this forum where somebody had an almost identical problem, after configuring VTIs it worked right away. I guess crypto maps are considered outdated...
That's not to say that this will solve your problem, but it is definitely worth trying and will save you a lot of time and hassle if it does.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
11-04-2019 02:14 AM
I will search about the thread. The problem is, if the other side need to change anything i will stuck here. It's Verizon. They are not really fast an a challenge to get one on the other end to reconfigure the other side.
Best,
Udo
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
11-05-2019 06:06 PM - edited 11-05-2019 06:07 PM
I have made a new try and there is no success. No traffic goes thru the tunnel. ISAKMP and IPSec SA are installed. Very strange.
Here are the config, ch cry ips sa, and a debg log.
Any hints are welcome.
!
! Last configuration change at 01:25:46 UTC Wed Nov 6 2019 by admin
! NVRAM config last updated at 01:08:55 UTC Wed Nov 6 2019 by admin
!
version 16.7
service timestamps debug datetime msec
service timestamps log datetime msec
platform qfp utilization monitor load 80
no platform punt-keepalive disable-kernel-core
platform hardware throughput level 5000000
!
hostname ASR1002X
!
boot-start-marker
boot system bootflash:asr1002x-universalk9.16.07.01.SPA.bin
boot-end-marker
!
!
vrf definition Mgmt-intf
!
address-family ipv4
exit-address-family
!
address-family ipv6
exit-address-family
!
!
transport-map type persistent webui https-webui
secure-server
!
transport-map type persistent ssh sshhandler
authentication-retries 1
rsa keypair-name sshkeys
transport interface GigabitEthernet0
connection wait allow interruptible
!
transport-map type persistent webui http-webui
server
!
aaa new-model
!
!
aaa authentication login userauthen local
aaa authentication login RADIATOR group radius
aaa authorization network groupauthor local
!
!
!
!
!
!
aaa session-id common
!
!
!
!
!
!
!
ip name-server 8.8.8.8
!
!
!
login on-success log
!
!
!
!
!
!
!
subscriber templating
!
!
!
!
!
!
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
!
!
!
ivr prompt buffers 2
license udi pid ASR1002-X sn xxxxxxxxx
no license smart enable
!
spanning-tree extend system-id
diagnostic bootup level minimal
!
!
!
!
redundancy
mode none
!
!
!
!
!
!
!
!
!
!
!
!
!
no crypto isakmp default policy
!
crypto isakmp policy 3
encr aes 256
hash sha256
authentication pre-share
group 14
lifetime 3600
!
crypto isakmp policy 10
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key xxxxxxxxxxxxxxxxxxx address 10.10.100.238
crypto isakmp keepalive 60 periodic
crypto isakmp nat keepalive 30
!
!
crypto ipsec security-association lifetime seconds 86400
crypto ipsec security-association replay disable
!
crypto ipsec transform-set ipcom esp-3des esp-md5-hmac
mode tunnel
!
!
crypto map CRYMAP local-address GigabitEthernet0/0/1
crypto map CRYMAP 1 ipsec-isakmp
description VzB DTM
set peer 10.10.100.238
set transform-set ipcom
set pfs group2
match address VZB-DTM
!
!
!
!
!
!
!
!
interface GigabitEthernet0/0/0
ip address 10.10.8.219 255.255.255.192
no ip redirects
shutdown
negotiation auto
!
interface GigabitEthernet0/0/1
ip address 10.10.9.219 255.255.255.192
no ip redirects
negotiation auto
crypto map CRYMAP
!
interface GigabitEthernet0/0/2
ip address 10.10.10.10 255.255.255.240
no ip redirects
negotiation auto
ipv6 nd ra suppress
crypto map DUSVPN
!
interface GigabitEthernet0/0/3
no ip address
shutdown
negotiation auto
!
interface GigabitEthernet0/0/4
no ip address
shutdown
negotiation auto
!
interface GigabitEthernet0/0/5
no ip address
shutdown
negotiation auto
!
interface GigabitEthernet0
vrf forwarding Mgmt-intf
ip address 10.10.10.251 255.255.255.0
negotiation auto
!
no ip forward-protocol nd
ip http server
ip http secure-server
ip http timeout-policy idle 600 life 86400 requests 1
ip tftp source-interface GigabitEthernet0
ip route 0.0.0.0 0.0.0.0 10.10.10.1
ip route vrf Mgmt-intf 0.0.0.0 0.0.0.0 10.10.10.1
!
!
!
ip access-list extended VZB-DTM
permit ip 10.10.8.0 0.0.0.255 10.10.101.192 0.0.0.31
!
!
control-plane
!
!
!
!
!
!
line con 0
stopbits 1
line aux 0
stopbits 1
line vty 0 4
session-timeout 35000
!
transport type persistent webui input https-webui
!
wsma agent exec
!
wsma agent config
!
wsma agent filesys
!
wsma agent notify
!
!
end
ASR1002X(config-if)#do sh cry ipsec sa
protected vrf: (none)
local ident (addr/mask/prot/port): (10.10.8.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (10.10.101.192/255.255.255.224/0/0)
current_peer 10.10.100.238 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 18, #pkts decrypt: 18, #pkts verify: 18
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0
local crypto endpt.: 10.10.9.219, remote crypto endpt.: 10.10.100.238
plaintext mtu 1446, path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/0/1
current outbound spi: 0xF92C3B96(4180425622)
PFS (Y/N): Y, DH group: group2
inbound esp sas:
spi: 0x4C2C6162(1277976930)
transform: esp-3des esp-md5-hmac ,
in use settings ={Tunnel, }
conn id: 2333, flow_id: HW:333, sibling_flags FFFFFFFF80000048, crypto map: CRYMAP
sa timing: remaining key lifetime (k/sec): (4607981/3498)
IV size: 8 bytes
replay detection support: N
Status: ACTIVE(ACTIVE)
inbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0xF92C3B96(4180425622)
transform: esp-3des esp-md5-hmac ,
in use settings ={Tunnel, }
conn id: 2334, flow_id: HW:334, sibling_flags FFFFFFFF80000048, crypto map: CRYMAP
sa timing: remaining key lifetime (k/sec): (4608000/3498)
IV size: 8 bytes
replay detection support: N
Status: ACTIVE(ACTIVE)
outbound ah sas:
outbound pcp sas:
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
11-05-2019 10:42 PM
Hello Udo,
I assume you are still testing with interfa ce GigabitEthernet0/0/1 ?
If that is the case, your access list VZB-DTM needs to match the subnet of that interface, 10.10.9.0 0.0.0.63.
Right now it matches the subnet of interface GigabitEthernet0/0/0...
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
11-05-2019 11:37 PM
So the access list needs to look like this:
ip access-list extended VZB-DTM
permit ip 10.10.9.0 0.0.0.63 10.10.101.192 0.0.0.31
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
11-06-2019 02:04 AM
Yes i use ge 0/0/1. But it don't need to match any interface Networks. Traffic runs thru the router and matches VZB-DTM should run thru the tunnel via ge 0/0/1. In the sh cry ipse sa you see that the ACLs are shown there. No errors in the config. On the 2821 the exact same config running fine.
Its weird. I think its a bug in the IOS-XE 16.x tested down to 16.3.1 and up to 16.7.1. 17.9.4 i cant use because crypto map listname authentication list listname is gone in 16.9.4. and therefore i dont tested it.
Best,
Udo
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
11-06-2019 03:16 AM
Error is always :
ISAKMP-ERROR: (0):Failed to find peer index node to update peer_info_list
I cant find anything about this error. But i am pretty sure thats the cause.
I am wonder i am alone with this problem :(
Best,
Udo
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
11-06-2019 03:31 AM
Hello Udo,
the transform set could be the problem. The thing is: you would have to change it on both sides:
Try:
crypto ipsec transform-set aesset esp-aes 256 esp-sha-hmac
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
11-06-2019 04:38 AM
Done on booth sides in the LAB. No luck. Same behavior. C2821 > ASR1002X traffic flow. Vice versa not.
I cant belive it.
Is there a way to leave the C2821 in its config (Crypto Map wise) and configure the ASR1002X with VRF +. IPSec?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
11-06-2019 06:23 AM
Hello,
weird indeed. Can you post the config of the 2821 as well ? I want to lab it, too, maybe I can spot something...
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
11-06-2019 07:15 AM
Hi Georg.
Yes its a bug i guess. The things i tried are countless. Nothing works. Here the Config from the 2821:
Current configuration : 1881 bytes ! version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname cr4 ! boot-start-marker boot system flash:c2800nm-adventerprisek9-mz.124-24.T8.bin boot-end-marker ! ! card type command needed for slot/vwic-slot 0/0 logging message-counter syslog ! no aaa new-model ! dot11 syslog ip source-route ! ! ip cef ! ! no ipv6 cef ! multilink bundle-name authenticated ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! voice-card 0 ! ! ! ! ! archive log config hidekeys ! ! crypto isakmp policy 10 encr 3des hash md5 authentication pre-share group 2 crypto isakmp key xxxxxxxxxxx address 10.10.9.219 ! ! crypto ipsec transform-set ipcom esp-3des esp-md5-hmac crypto ipsec transform-set aesset esp-aes 256 esp-sha-hmac ! crypto map CRYMAP local-address GigabitEthernet0/0 crypto map CRYMAP 4 ipsec-isakmp description VzB LND set peer 10.10.9.219 set transform-set ipcom set pfs group2 match address VZB-OFFTST ! ! ! ! ! ! ! ! interface GigabitEthernet0/0 ip address 10.10.100.238 255.255.255.240 duplex auto speed auto crypto map CRYMAP ! ip forward-protocol nd ip route 0.0.0.0 0.0.0.0 10.10.100.1 no ip http server no ip http secure-server ! ! ! ip access-list extended VZB-OFFTST permit ip 10.10.101.192 0.0.0.31 10.10.8.0 0.0.0.255 ! ! ! ! ! ! control-plane ! ! ! ! ! ! ! ! ! ! line con 0 line aux 0 line vty 0 4 password e4r5t6z7 login ! scheduler allocate 20000 1000 end
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
11-07-2019 09:53 PM - edited 11-07-2019 10:20 PM
Final notice :)
I have sidestepped the, in my eyes, bug along crypto map and ACL routing. I have created VRF's for each tunnel partner. The crypto map has extended with an IPSec profile and a reverse-route statement. The default routes are in each of the VRF's and the keyrings also one for each VRF. Looks nice and work like a charme.
Now its possible to connect a pure crypto map based site2site tunnel with a so called "VRF-Aware" one.
Thanks for the interest and all the help!!!
Best,
Udo
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide
