Hi,   Few GM's registering to secondary can only happen when either primary KS is not reachable or on the specific GM, which KS is configured first.   So first verify what was the reason for GM registering to secondary KS ?    Changing from backup KS to primary KS, will cause a network disruption specific to that GM, as it will re-register itself. The configuration change is only needed on GM, where you change the order of KS.   Let me know if you have any further query.   Regards, Pulkit ... View more

Hi, Yes, this is an expected behavior. So basically when you add a new ACL in an existing crypto ACL, just rest or bounce the tunnel. You can do that by doing a "clear crypto ipsec sa x.x.x.x" and also phase 1 by "clear crypto isakmp sa x.x.x.x". Also to note, multiple crypto ACL's actually create different phase 2, so only when the interesting traffic is triggered then phase 2 will come up, else only phase 1 comes up. - Pulkit ... View more

Hi, The access-list SITE which is the crypto ACL is incorrect. It should be access-list SITE extended permit icmp 30.30.30.0 255.255.255.0 192.168.1.0 255.255.255.0 access-list SITE extended permit tcp 30.30.30.0 255.255.255.0 192.168.1.0 255.255.255.0 access-list SITE extended permit ip 30.30.30.0 255.255.255.0 192.168.1.0 255.255.255.0 access-list SITE extended permit icmp 192.168.1.0 255.255.255.0 30.30.30.0 255.255.255.0 access-list SITE extended permit tcp 192.168.1.0 255.255.255.0 30.30.30.0 255.255.255.0 access-list SITE extended permit ip 192.168.1.0 255.255.255.0 30.30.30.0 255.255.255.0 Or you can even just put : access-list SITE extended permit ip 192.168.1.0 255.255.255.0 30.30.30.0 255.255.255.0 as it includes TCP/IP/ICMP all. You do not need this : access-group SITE in interface outside Please do a : no access-group SITE in interface outside Also apply access-list on inside interface to allow traffic : access-list inside_access_in permit ip any any access-group inside_access_in in interface inside This completes ASA configuration. After this you should definitely see the tunnel trying to come up. Now on Router 3 : The ISAKMP policy needs to change, we need to have group 2 just like on ASA. crypto isakmp policy 10 encr 3des authentication pre-share group 2 The access-list 122 will be like : access-list 122 permit icmp 30.30.30.0 0.0.0.255 192.168.1.0 0.0.0.255 access-list 122 permit ip 30.30.30.0 0.0.0.255 192.168.1.0 0.0.0.255 access-list 122 permit tcp 30.30.30.0 0.0.0.255 192.168.1.0 0.0.0.255 After this tunnel should definitely come up and if not then for test purpose, remove ZBF configuration from the router. Just remove zone member from interfaces and you should be good. As of now, the IPSEC SA output on this router is of no use and there are no encaps/decaps. Please ensure when you remove ACL and apply it again, it is still linked to the VPN configuration. Let me know how it goes. Regards, Pulkit ... View more

Check this link out : https://supportforums.cisco.com/document/33921/asa-pre-83-83-nat-configuration-examples In the pre 8.3 section, the first two options is what you should be checking, Static NAT and Static PAT. Regards, Pulkit ... View more