Hello! Meanwhile together with the Cisco Support I could  solve the problem. The devices with Sync Archive message "partially  successful" had associated the wrong credential sets (and so using the  wrong password - as can be seen with packet capture). Reason for this  was that in "Default Credential Sets Policy Configuration" there was one  entry with (f.ex.) "10.*.*.*" and other entries with (f.ex.) "10.1.*.*"  and "10.2.*.*". With this configuration the credentials for the entries with  f.ex. "10.1.*.*" are not used but the credentials for the entry  "10.*.*.*" are used instead. After deleting the policy entry  "10.*.*.*" and configuring policy entries (f.ex.) "10.100.*.*" and  "10.101.*.*" instead of using the policy entry "10.*.*.*" I thought that  the problem should be solved. But as can be seen in      Inventory > Device Administration > Add / Import / Manage Devices > Edit Credentials still the wrong credentials were associated with the devices in question. After deleting and rediscovering the problematic devices the correct credentials were associated with the devices. Another problem was that for tftp our firewall between the Prime server and the problematic devices was not opened. After solving this two problems Sync Archive is running now with status "Successful". Jakob ... View more

Vinod Arya, thank you for your kind answer! Meanwhile we could solve the problem: A simple reboot of the Cisco Prime server helped to stop polling of the deleted component. Thanks again for your support! Jakob ... View more

Portu, ok - now I tried with a dynamic map as follows (I was not able to enter the commands exactly as you told me): crypto ipsec transform-set esp-aes esp-sha-hmac ! ! crypto dynamic-map 7 set transform-set ! ! crypto map VPN 4 ipsec-isakmp dynamic ! "esp-aes esp-sha-hmac" on the Bintec-site Crypto IPSEC debugging is on # *Mar  6 06:56:04.351: IPSEC(key_engine): got a queue event with 1 KMI message(s) *Mar  6 06:56:04.511: IPSEC(validate_proposal_request): proposal part #1 *Mar  6 06:56:04.511: IPSEC(validate_proposal_request): proposal part #1,   (key eng. msg.) INBOUND local= , remote= ,     local_proxy= /255.255.255.255/0/0 (type=1),     remote_proxy= /255.255.255.255/0/0 (type=1),     protocol= ESP, transform= NONE  (Tunnel),     lifedur= 0s and 0kb,     spi= 0x0(0), conn_id= 0, keysize= 128, flags= 0x0 *Mar  6 06:56:04.515: IPSEC(ipsec_process_proposal): transform proposal not supp orted for identity:     {esp-aes esp-sha-hmac } ! crypto ipsec transform-set esp-3des esp-md5-hmac ! "esp-aes esp-sha-hmac" on the Bintec-site *Mar  6 06:54:06.587: IPSEC(key_engine): got a queue event with 1 KMI message(s) *Mar  6 06:54:06.743: IPSEC(validate_proposal_request): proposal part #1 *Mar  6 06:54:06.743: IPSEC(validate_proposal_request): proposal part #1,   (key eng. msg.) INBOUND local= , remote= ,     local_proxy= /255.255.255.255/0/0 (type=1),     remote_proxy= /255.255.255.255/0/0 (type=1),     protocol= ESP, transform= NONE  (Tunnel),     lifedur= 0s and 0kb,     spi= 0x0(0), conn_id= 0, keysize= 128, flags= 0x0 *Mar  6 06:54:06.743: IPSEC(ipsec_process_proposal): transform proposal not supp orted for identity:     {esp-aes esp-sha-hmac } ! crypto ipsec transform-set esp-3des esp-md5-hmac ! "esp-3des esp-md5-hmac" on the Bintec-site *Mar  6 06:55:43.687: IPSEC(key_engine): got a queue event with 1 KMI message(s) *Mar  6 06:55:43.867: IPSEC(validate_proposal_request): proposal part #1 *Mar  6 06:55:43.867: IPSEC(validate_proposal_request): proposal part #1,   (key eng. msg.) INBOUND local= , remote= ,     local_proxy= /255.255.255.255/0/0 (type=1),     remote_proxy= /255.255.255.255/0/0 (type=1),     protocol= ESP, transform= NONE  (Tunnel),     lifedur= 0s and 0kb,     spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x0 *Mar  6 06:55:43.871: IPSEC(ipsec_process_proposal): transform proposal not supp orted for identity:     {esp-3des esp-md5-hmac } Jakob ... View more

Portu, we tried with different transform-set combinations.  When  I change the transform-set at the Cisco 876, "debug crypto ipsec"   shows the same error as you mentioned above (with the same parameters in   curly brackets). When the transform-set is changed at the Bintec,   "debug crypto ipsec" shows the changed parameters in curly brackets.   Nevertheless "show crypto ipsec transform-set" shows the parameters at   the Cisco 876. It seems as if I only have to enter the parameters  in brackets  (from "debug crypto ipsec") in the Cisco 876 "crypto ipsec   transform-set"-command. But even then, it does not function. Jakob ... View more

Here the desired outputs: Thanks for the kind help! Jakob ... View more

Hello, Portu, I asked the colleague of the remote site (the site that uses the Bintec VPN250) again concerning the ACL. He tells me that the 2 IP-Adresses that are entered in our ACL no. 135 are also reflected in the Bintec-router. So this seems not to be the problem. This seems to have been a misunderstanding between me and the colleague at the remote site. Jakob ... View more

Hello, Portu, thanks for the quick answer. No - the colleague of the remote site tells me that such a ACL is not configured for the VPN tunnel. Jakob ... View more