Thanks guys, appreciate the help! ... View more

Thanks Giuseppe!  I appreciate the quick reply! Yes the VPLS supports VLAN tags.  One option includes creating a /29 for each remote site and making a mini-broadcast network consisting of the (1) remote site and (3) hubs.  The concerns I see with this design are... Requires a lot more configuration - an additional sub-interface on each of the (3) hubs for each remote site. Increased risk because changes need to be made to each every hub whenever a new site is added Greater VLAN and private IP space consumption If every remote site to hub sites link remain in area 0, then all we've done is reduce the broadcast size If we move each remote site into it's own area (and summerize) then we reduce the routers per area and route table, but add a lot of complexity to the design.  Is it worth it if everything will work fine on a /24 (or /23) area 0 design. In the end, the only recommendations I've found are from long out-of-date publications.  I wonder, are those limitations still are valid with newer router's CPU and memory capacity?   ... View more

So I had this very problem, with the same error messages in the log after doing a debug (see below):   000496: Oct 26 2017 20:16:36.469 UTC: ISAKMP: Error while processing SA request: Failed to initialize SA 000497: Oct 26 2017 20:16:36.469 UTC: ISAKMP: Error while processing KMI message 0, error 2.   In my case, I was doing front-door vrf, so my tunnels were in a different vrf.  I was about to reload the router because I had exhausted all other options (configs were fine and  identical to other sites that were working fine). Finally, I tried removing the vrf from the router and re-added it - litterally: no ip vrf INET ip vrf INET ...of course this removes all the vrf configuration from interfaces, etc... so that had to get re-added too.  Long story short - this completely fixed it!   If you have a similar issue - give it a try.  This was on a 4431. ... View more

I had just deployed SourceFIRE for a customer and decided to deploy it on my home 5506-X.  Had the exact same problem when I went to issue the following command: system install noconfirm ftp://<IP>/asasfr-sys-6.2.0-362.pkg It would start verifying then end almost immediately with: 113 Upgrade aborted   Found this thread and immediately remembered I hadn't cabled up the Mgmt interface - still had the memory of doing the customer's ASA and forgot to do my own. ... View more

Here's output from the ASA for show ssh and show run all ssl asa-01/pri/act# show ssh Idle Timeout: 30 minutes Versions allowed: 1 and 2 Cipher encryption algorithms enabled: aes128-cbc aes192-cbc aes256-cbc aes128-ctr aes192-ctr aes256-ctr Cipher integrity algorithms enabled: hmac-sha1 hmac-sha1-96 Hosts allowed to ssh into the system: 0.0.0.0 0.0.0.0 inside asa-01/pri/act#  Is the probem with the encryption (cbc vs. crt) or integrity algorithm (sha1)?  If it's with the encryption, is there any way to prefer the stronger crt? asa-01/pri/act#  asa-01/pri/act# sh run all ssl ssl server-version tlsv1 ssl client-version tlsv1 ssl cipher default custom "RC4-SHA:AES128-SHA:AES256-SHA:DES-CBC3-SHA" ssl cipher tlsv1 custom "RC4-SHA:AES128-SHA:AES256-SHA:DES-CBC3-SHA" ssl cipher tlsv1.1 medium ssl cipher tlsv1.2 medium ssl cipher dtlsv1 custom "RC4-SHA:AES128-SHA:AES256-SHA:DES-CBC3-SHA" ssl dh-group group2 ssl ecdh-group group19 ssl certificate-authentication fca-timeout 2 asa-01/pri/act# Not sure how to interpret the output above from the show run all ssl command.   I wasn't able to do a debug ip ssh on the Nexus (see below) nex9k-01# debug ip ssh ? ^ % Invalid command at '^' marker. ... View more