Hi Friends, I've created a site to site VPN between cisco devices. VPN tunnels are coming up, but traffic is getting encryted only at side. Anyone any idea why it's? Output from local device: Router#show crypto isa CRPvtMUScingh01#show crypto isakmp sa | in 204.75.145.14 216.143.142.69  204.75.145.14   QM_IDLE             33    0 ACTIVE Router #sh crypto ipsec sa | be 204.75.145.14    current_peer 204.75.145.14 port 500      PERMIT, flags={origin_is_acl,}     #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0     #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0     #pkts compressed: 0, #pkts decompressed: 0     #pkts not compressed: 0, #pkts compr. failed: 0     #pkts not decompressed: 0, #pkts decompress failed: 0     #send errors 0, #recv errors 0      local crypto endpt.: 216.143.142.69, remote crypto endpt.: 204.75.145.14      path mtu 1412, ip mtu 1412      current outbound spi: 0x0(0)      inbound esp sas:      inbound ah sas:      inbound pcp sas:      outbound esp sas:      outbound ah sas:      outbound pcp sas:      local crypto endpt.: 216.143.142.69, remote crypto endpt.: 204.75.144.14      path mtu 1412, ip mtu 1412      current outbound spi: 0x0(0)      inbound esp sas:      inbound ah sas:      inbound pcp sas:      outbound esp sas:      outbound ah sas:      outbound pcp sas:    protected vrf: (none)    local  ident (addr/mask/prot/port): (205.173.92.5/255.255.255.255/0/0)    remote ident (addr/mask/prot/port): (204.75.145.138/255.255.255.255/0/0)    current_peer 204.75.145.14 port 500      PERMIT, flags={origin_is_acl,}     #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0     #pkts decaps: 36, #pkts decrypt: 36, #pkts verify: 36     #pkts compressed: 0, #pkts decompressed: 0     #pkts not compressed: 0, #pkts compr. failed: 0     #pkts not decompressed: 0, #pkts decompress failed: 0     #send errors 0, #recv errors 0      local crypto endpt.: 216.143.142.69, remote crypto endpt.: 204.75.145.14      path mtu 1412, ip mtu 1412      current outbound spi: 0x111D7A8E(287144590)      inbound esp sas:       spi: 0x86F5054A(2264204618)         transform: esp-3des esp-sha-hmac ,         in use settings ={Tunnel, }         conn id: 3085, flow_id: Onboard VPN:85, crypto map: geshared         sa timing: remaining key lifetime (k/sec): (4378030/3492)         IV size: 8 bytes         replay detection support: Y         Status: ACTIVE      inbound ah sas:      inbound pcp sas:      outbound esp sas:       spi: 0x111D7A8E(287144590)         transform: esp-3des esp-sha-hmac ,         in use settings ={Tunnel, }         conn id: 3048, flow_id: Onboard VPN:48, crypto map: geshared         sa timing: remaining key lifetime (k/sec): (4378031/3492)         IV size: 8 bytes         replay detection support: Y         Status: ACTIVE      outbound ah sas:      outbound pcp sas: Output from remote devcie: ud1-vpn-rtr01a#sh cry isa sa IPv4 Crypto ISAKMP SA dst             src             state          conn-id status 216.143.142.69  204.75.145.14   QM_IDLE          14566 ACTIVE ud1-vpn-rtr01a#sh cry ses bri Status: A- Active, U - Up, D - Down, I - Idle, S - Standby, N - Negotiating         K - No IKE ivrf = (none)            Peer     I/F        Username          Group/Phase1_id   Uptime Status 216.143.142.69   Gi0/2                           216.143.142.69 00:08:55    UA ud1-vpn-rtr01a#sh cry ipsec sa peer 216.143.142.69 interface: GigabitEthernet0/2     Crypto map tag: SMS, local addr 204.75.145.14    protected vrf: (none)    local  ident (addr/mask/prot/port): (204.75.145.138/255.255.255.255/0/0)    remote ident (addr/mask/prot/port): (205.173.92.5/255.255.255.255/0/0)    current_peer 216.143.142.69 port 500      PERMIT, flags={origin_is_acl,}     #pkts encaps: 22, #pkts encrypt: 22, #pkts digest: 22     #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0 ... View more

Friends, Normal burst size defines the size of token bucket which is the amount of data that can be sent in a given time interval. Excess burst size defines  the amount of data that can be sent if no tokens are available in bucket per time interval. That means, in a given time interval, if the normal burst size is reached, it will borrow a token from excess burst bits. As per Cisco standards, Normal burst = CIR * Tc Excess burst = 2 * Normal burst For example, on a 1Mbps link, I'm limiting traffic to 512Kbps with 96KB as normal burst and 192KB as excess burst. rate-limit output 512000000 96000 192000 conform-action transmit exceed-action drop My questions is, Does the above command means that I can send traffic with a max rate of 1Mbps since I set excess burst as 192KB ? Thanks, Ameen. ... View more