I am trying to configure a SRP527W for a remote site. It needs to connect back to our Central Office, (via an ASA) which has several VLANs configured.  I have entered the configuration for an IKE policy, and one for an IPSec policy (I can only enter one ip/subnet per IPSec policy) When I try to create a 2nd IPSec policy, if I point to the existing IKE policy, I get an error stating "IKE policy has been used by other IPSec policy" If I try to create a new IKE policy, using a different name, but with the same parameters, it shows an error stating the policy is a replica of an existing policy. If I create a new IKE policy, but use a different pre-shared key, then it is accepted by the 2nd IPSec policy, but that would mean I would have to create 2 seperate tunnels on the ASA, each using a different pre-shared key.  I have never needed to do this for any of the other routers we have connected. Does anyone have any ideas how to get around this? ... View more

I am having a problem configuring a VPN connection from a 1721 router to an ASA5520. The router has already been configured, but I have been asked to setup the VPN. I think the issue is because they are using a Loopback interface (which I have never configured for before). The "sh crypto isakmp sa" command shows: dst                      src                         state                 conn-id   status 5.6.7.8                1.2.3.4                    QM_IDLE                   4   ACTIVE where 5.6.7.8 is the ip on Loopback0, 1.2.3.4 is remote peer ip. Pings to the remote network don't work. Here is the (slightly edited) config of the 1721 . . . --------------------------------------- --------------------------------------- Current configuration : 3838 bytes ! version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname 1721 ! boot-start-marker boot-end-marker ! no logging buffered enable secret 5 dummy ! no aaa new-model ip cef ! ! ip auth-proxy max-nodata-conns 3 ip admission max-nodata-conns 3 ! ! ! ! ! username dummy privilege 15 password 0 dummy ! ! ! ! crypto isakmp policy 10 encr 3des hash md5 authentication pre-share lifetime 28800 crypto isakmp key dummy-key address 1.2.3.4 ! ! crypto ipsec transform-set myset esp-3des esp-md5-hmac ! crypto map mymap local-address Loopback0 ! crypto map myumap 10 ipsec-isakmp set peer 1.2.3.4 set security-association lifetime seconds 28800 set transform-set myset match address 120 ! ! ! interface Loopback0 ip address 5.6.7.8 255.255.255.240 no ip redirects no ip unreachables no ip proxy-arp ip nat outside ip virtual-reassembly ! interface FastEthernet0 ip address 192.168.1.1 255.255.255.0 no ip redirects no ip unreachables no ip proxy-arp ip nat inside ip virtual-reassembly speed auto ! interface Serial0 no ip address no ip proxy-arp ip nat outside ip virtual-reassembly encapsulation frame-relay IETF no fair-queue frame-relay lmi-type cisco ! interface Serial0.1 point-to-point ip address 5.6.9.1 255.255.255.252 ip nat outside ip virtual-reassembly frame-relay interface-dlci 297 IETF   crypto map mymap ! ip forward-protocol nd ip route 0.0.0.0 0.0.0.0 Serial0.1 ! ip http server ip http authentication local ip http secure-server ip nat inside source route-map nonat interface Loopback0 overload ! access-list 120 permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255 access-list 130 deny   ip 192.168.1.0 0.0.0.225 192.168.2.0 0.0.0.255 access-list 130 permit ip 192.168.1.0 0.0.0.255 any ! route-map nonat permit 10 match ip address 130 ! ! control-plane ! ! line con 0 line aux 0 line vty 0 4 exec-timeout 40 0 privilege level 15 password dummy login local transport input telnet ssh ! end 1721# ------------------------------ ------------------------------ ... View more