Hello Justin,   Thanks for the response. The CSV file was updated with host name, IP address, SN and Soft Version and uploaded in SNTC portal. I could able to view all other alerts except software. Please find the screenshot for reference. ... View more

Hello, Could someone please help me answer and make me to unserstand the reason ? ... View more

Hello , I found the issue and fixed it. Now it is working fine. But i have not understand how it works in the background, because it is working perfectly with older IOS version  c2900-universalk9-mz.SPA.152-2.T3.bin. The problem was that the vrf name was missing at the end of match identity statement in IKEv1 profile at Hub. IKEv1 PROFILE lan Ref Count = 6 Identities matched are: ip-address 0.0.0.0 Certificate maps matched are: Identity presented is: ip-address keyring(s): MYKEY trustpoint(s): <all> After adding VRF name at the end, it starts working with newer IOS as well. Identities matched are: ip-address 0.0.0.0 MYVRF Honestly, i did not know the reason why it started working after adding VRF. Could you pls explain me he following. how it was working without VRF name in the older version ? how it was not working without VRF in the newer IOS version ? ... View more

Hello, Thanks for the response. The problem has got resolved. The mathcing identitiy was not having VRF at the end, after adding, it works fine. ... View more

Hello, Spoke:- crypto isakmp policy 1 encr 3des hash md5 authentication pre-share group 2 crypto isakmp key XYZ123 address 0.0.0.0 ! crypto ipsec transform-set 3des esp-3des esp-md5-hmac mode tunnel ! IPSEC profile default Security association lifetime: 4608000 kilobytes/3600 seconds Security association idletime: 60 seconds Responder-Only (Y/N): N PFS (Y/N): N Mixed-mode : Disabled Transform sets={ default: { esp-aes esp-sha-hmac } , } ! crypto map MYVPN 1 ipsec-isakmp set peer X.X.X.X set transform-set 3des match address HUB to Spoke () ! HUB:- Crypto Map Template"ios" 1 ISAKMP Profile: lan No matching address list set. Security association lifetime: 4608000 kilobytes/3600 seconds Responder-Only (Y/N): N PFS (Y/N): N Transform sets={ 3DES: { esp-3des esp-md5-hmac } , } IKEv1 PROFILE lan Ref Count = 6 Identities matched are: ip-address 0.0.0.0 Certificate maps matched are: Identity presented is: ip-address keyring(s): MYKEY trustpoint(s): <all> crypto keyring MYKEY vrf MYVRF pre-shared-key address 0.0.0.0 0.0.0.0 key XYZ123 sh cryp ipsec profile IPSEC profile default Security association lifetime: 4608000 kilobytes/3600 seconds Responder-Only (Y/N): N PFS (Y/N): N Transform sets={ default: { esp-aes esp-sha-hmac } , } Could you please confirm if the following things can create the issue. 1) Mixed mode is missing at HUB. 2) Should i use vrfname at the end in match identity in IKEV1 profile (match identity address 0.0.0.0 vrfname). I have seen the similar output in the debugs on HUB, no issue at spoke. Jun 30 21:22:56.616 EDT: map_db_check_isakmp_profile profile did not match Jun 30 21:22:56.616 EDT: map_db_check_isakmp_profile profile did not match Jun 30 21:22:56.616 EDT: map_db_find_best did not find matching map Jun 30 21:22:56.616 EDT: IPSEC(ipsec_process_proposal): proxy identities not supported Jun 30 21:22:56.616 EDT: ISAKMP:(2001 ) : IPSec policy invalidated proposal with error 32 Jun 30 21:22:56.616 EDT: ISAKMP:(2001):Checking IPSec proposal 2 ... snip ... Jun 30 21:22:56.616 EDT: ISAKMP:(2001): phase 2 SA policy not acceptable! (local <hub-ip-physical> remote <spoke-ip-physical>) ... View more

Hello, Thanks for the response. I guess the issue could be more related to IPSec. After the upgrade on Hub router, i have ran debug isakmp/ipsec commands and found that ISAKMP has estabhlished but no IPSec peers. Spoke will initiate the connection as the Hub was config'ed as dynamic. ... View more