Heads Up :
The post you are writing will appear in a public forum. Please ensure all content is appropriate for public consumption. Review the employee guidelines for the community here.
For our IPsec connection, our site uses policy-based IPsec, while the remote site uses route-based IPsec.When I changed our site from policy-based to route-based, the router’s tunnel interface went up and the connection was encrypted, but the count o...
In a policy-based IPsec redundant configuration, if Router 1 fails, an IPsec SA inconsistency occurs between Router 2 and the remote VPN device, preventing communication from resuming. Therefore, we have automated the execution of the clear command v...
When establishing multiple VPN peers with a single router, is it okay to configure the IKEv2 and IPsec profiles together?Or is it better to configure them separately for each peer?The peer addresses are different, but the PSK is the same. crypto ikev...
We have configured route-based IPsec as follows.The tunnel address for the routers in the redundant configuration is set to the HSRP VIP on the LAN side.Under normal conditions, the tunnel interface between Router-1 and Router-3 is up, while the tunn...
Although the IPsec connection itself has been established using route-based IPsec, when I check `show crypto ipsec sa`, I see that only encrypted packets are being counted, as shown below, and the number of decrypted packets is 0. In contrast, the VP...
@Rob Ingram Thank you.So, the encapsulation types are different. Specifically, how should I configure the settings to prevent GRE from being used?Does that mean the other party is using transport mode?
@Rob Ingram We do not have details about the other party’s equipment.We are using an IOS router (ISR900 series).Since there were no issues when we used policy-based routing, the route to the peer’s IP address or network on the other device should be ...
