I have remote devices creating a vpn to an IOS device- we are getting the following errors in the logs- the VPN will die and not come back up: Jun 13 13:34:18 hostname1558: [syslog@9 s_id ="hostname:514"]: Jun 13 12:36:45.714 CDT: %CRYPTO-4-RECVD_PKT_INV_SPI: decaps: rec'd IPSEC packet has invalid spi for Jun 13 13:34:18 hostname 1559: [syslog@9 s_id ="hostname:514"]: #011destaddr=10.10.15.126, prot=50, spi=0x8BE6E93A(2347166010), srcaddr=10.10.184.76 We used the command "crypto isakmp invalid-spi-recovery" but as shown in several cisco articles- they arent designed for dynamic crypto maps.  This is causing a HUGE issue for us- what can be done to resolve the problem? Thanks Greg ... View more

Attached is the basic diagram of our scenario here.  EIGRP is fully deployed throughout the network.  If the link between corpcoresw01 and XO Router-Dallas goes down, it will bring up a VPN between the 2 firewalls (Cisco 5520's- IPSEC).  Once the VPN comes up- how will corpcoresw01 and dalcoreswp01 share their routes?  Does a GRE tunnel need to be established to bring up the peering relationship?  What is the best practice way to accomplish this? Thanks Greg ... View more

I am trying to terminate 2 clients (2 different VRF's) on the same router.  Im having a couple of issues- How do you match each VPN connection (hostname?  user/fqdn?) without using an IP address because each one will have a dynamic IP address- not static. Secondly,  how do I set up the 2nd vpn?  Attached is the working config with the 1 VPN. Thanks Greg crypto keyring preshared pre-shared-key address 0.0.0.0 0.0.0.0 key password12345 ! crypto isakmp policy 10 encr aes 256 authentication pre-share group 5 crypto isakmp profile Customer1 vrf Customer1 keyring preshared match identity address 0.0.0.0 ! crypto ipsec security-association lifetime seconds 28800 ! crypto ipsec transform-set aes-256-sha esp-aes 256 esp-sha-hmac ! crypto dynamic-map Customer1Dyn 10 set transform-set aes-256-sha set pfs group5 set isakmp-profile Customer1 reverse-route ! ! ! crypto map outsidemap1 local-address Vlan651 crypto map outsidemap1 1000 ipsec-isakmp dynamic Customer1Dyn ... View more

I have a router config at a client site where this is the relevant config interface GigabitEthernet0/0.3005 encapsulation dot1Q 3005 ip address 10.250.0.34 255.255.255.252 ! interface GigabitEthernet0/0.3005998 encapsulation dot1Q 3005 second-dot1q 998 ip address 10.252.0.2  255.255.255.252 ! interface GigabitEthernet0/0.3005999 encapsulation dot1Q 3005 second-dot1q 999 ip vrf forwarding Public ip address XX.XX.XX.142 255.255.255.252 When you are dealing with a 6509- where these circuits come into an NNI (Trunk with multiple VLANS)- and VLAN virtual interfaces-  how do you do the config on that side? Thanks Greg ... View more

I have a router config at a client site where this is the relevant config interface GigabitEthernet0/0.3005 encapsulation dot1Q 3005 ip address 10.250.0.34 255.255.255.252 ! interface GigabitEthernet0/0.3005998 encapsulation dot1Q 3005 second-dot1q 998 ip address 10.252.0.2  255.255.255.252 ! interface GigabitEthernet0/0.3005999 encapsulation dot1Q 3005 second-dot1q 999 ip vrf forwarding Public ip address XX.XX.XX.142 255.255.255.252 When you are dealing with a 6509- where these circuits come into an NNI (Trunk with multiple VLANS)- and VLAN virtual interfaces-  how do you do the config on that side? Thanks Greg ... View more

I have an ASA 5505 connecting in via EasyVPN to an ASA 5510.  The tunnel comes up (both ISAKMP and IPSEC create a security association)- traffic is not flowing both ways.  If I ping from the network with the hub (5510)- I can ping a node on the remote network (5505) side.  If I ping the other way around- I cannot ping devices on the hub network.  Here is the relevant configs:   ASA5510: crypto dynamic-map dynmap 10 set transform-set 3des-md5 3des-sha des-md5 des-sha aes-256-md5 crypto dynamic-map dynmap 10 set reverse-route crypto map VPN 20 ipsec-isakmp dynamic dynmap crypto map VPN interface outside crypto isakmp identity address  crypto isakmp enable outside  crypto isakmp policy 73  authentication pre-share  encryption 3des  hash sha       group 2  lifetime 86400 crypto isakmp nat-traversal 3600 crypto isakmp ipsec-over-tcp port 10000   group-policy MPEZvpn internal group-policy MPEZvpn attributes  dns-server value 192.168.36.2 192.168.253.3  dhcp-network-scope 172.16.64.0  vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn  split-tunnel-policy tunnelall  default-domain value morganusa.local  nem enable  webvpn   svc keep-installer installed   svc ask enable default webvpn timeout 5 username fort worth password XXXXXX encrypted tunnel-group MPEZvpn type remote-access tunnel-group MPEZvpn general-attributes  address-pool mpezvpn  default-group-policy MPEZvpn  dhcp-server 192.168.253.3 tunnel-group MPEZvpn webvpn-attributes  radius-reject-message  group-alias MPEZvpn enable tunnel-group MPEZvpn ipsec-attributes  pre-shared-key *   and the show crypto ipsec sa:     Crypto map tag: dynmap, seq num: 10, local addr: XX.XX.XX.XX       local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)       remote ident (addr/mask/prot/port): (192.168.136.0/255.255.255.0/0/0)       current_peer: 66.60.73.202, username: fortworth       dynamic allocated peer ip: 0.0.0.0       #pkts encaps: 110, #pkts encrypt: 110, #pkts digest: 110       #pkts decaps: 3282, #pkts decrypt: 3282, #pkts verify: 3282       #pkts compressed: 0, #pkts decompressed: 0       #pkts not compressed: 110, #pkts comp failed: 0, #pkts decomp failed: 0       #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0       #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0       #send errors: 0, #recv errors: 0       local crypto endpt.: XX.XX.XX.XX/4500, remote crypto endpt.: XX.XX.XX.XX/4500       path mtu 1500, ipsec overhead 66, media mtu 1500       current outbound spi: 308103ED     inbound esp sas:       spi: 0xA9A6DA42 (2846284354)          transform: esp-3des esp-md5-hmac none           in use settings ={RA, Tunnel,  NAT-T-Encaps, }          slot: 0, conn_id: 258048, crypto-map: dynmap          sa timing: remaining key lifetime (sec): 26480          IV size: 8 bytes          replay detection support: Y     outbound esp sas:       spi: 0x308103ED (813761517)          transform: esp-3des esp-md5-hmac none           in use settings ={RA, Tunnel,  NAT-T-Encaps, }          slot: 0, conn_id: 258048, crypto-map: dynmap          sa timing: remaining key lifetime (sec): 26480          IV size: 8 bytes          replay detection support: Y   ASA 5505 side: vpnclient server XX.XX.XX.XX vpnclient mode network-extension-mode vpnclient vpngroup MPEZvpn password ******** vpnclient username fortworth password ******** vpnclient management tunnel 192.168.136.0 255.255.255.0 vpnclient enable     Crypto map tag: _vpnc_cm, seq num: 10, local addr: 192.168.123.126       access-list _vpnc_acl permit ip 192.168.136.0 255.255.255.0 any       local ident (addr/mask/prot/port): (192.168.136.0/255.255.255.0/0/0)       remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)       current_peer: XX.XX.XX.XX, username: XX.XX.XX.XX       dynamic allocated peer ip: 0.0.0.0       #pkts encaps: 3391, #pkts encrypt: 3391, #pkts digest: 3391       #pkts decaps: 110, #pkts decrypt: 110, #pkts verify: 110       #pkts compressed: 0, #pkts decompressed: 0       #pkts not compressed: 3391, #pkts comp failed: 0, #pkts decomp failed: 0       #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0       #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0       #send errors: 0, #recv errors: 0       local crypto endpt.: 192.168.123.126/4500, remote crypto endpt.: XX.XX.XX.XX/4500       path mtu 1500, ipsec overhead 66, media mtu 1500       current outbound spi: A9A6DA42     inbound esp sas:       spi: 0x308103ED (813761517)          transform: esp-3des esp-md5-hmac none          in use settings ={RA, Tunnel,  NAT-T-Encaps, }          slot: 0, conn_id: 1, crypto-map: _vpnc_cm          sa timing: remaining key lifetime (sec): 26287          IV size: 8 bytes          replay detection support: Y     outbound esp sas:       spi: 0xA9A6DA42 (2846284354)          transform: esp-3des esp-md5-hmac none          in use settings ={RA, Tunnel,  NAT-T-Encaps, }          slot: 0, conn_id: 1, crypto-map: _vpnc_cm          sa timing: remaining key lifetime (sec): 26287          IV size: 8 bytes          replay detection support: Y       Once again- I can ping devices from the main network to the remote network- but not the other way around.  Any ideas on what changes need to be made?  The remote network is behind another firewall (ASA5505)- doing NAT- but has all ports open on a static translate to the EasyVPN firewall.   Thanks! ... View more

Im trying to get the rest of this config together-  Im having trouble with where the interface information (inside and outside the VPN) should go.     Here is the relevant config information: 172.16.10.57 represents the remote peer.  10.10.5.5 represents the public peer point on our side.  The MPLS Network is going to be 192.168.10.0/24 on our side / 192.168.11.0/24 remote.  This config is to be the VPNs in VRF Mode without Tunnel Protection.   ip vrf CompanyA  description VRF for CompanyA  rd AAAAA:1  route-target export AAAAA:1001  route-target import AAAAA:1001   mls mpls tunnel-recir crypto engine mode vrf   access-list 2001 permit ip 192.168.10.0 0.0.0.255 192.168.11.0 0.0.255.255   vlan 500  name outside-peer-addresses   vlan 501  name vrf-CompanyA ! !  crypto keyring CompanyA vrf CompanyA   pre-shared-key address 172.16.10.57 key PPJJPcPh]z9)"2wV ! crypto isakmp policy 16  encr aes 256  hash md5  authentication pre-share crypto isakmp profile CompanyA    vrf CompanyA    keyring CompanyA    match identity address 172.16.10.57 255.255.255.255  ! ! crypto ipsec transform-set aes-256-md5 esp-aes 256 esp-md5-hmac  ! crypto map outside local-address Vlan500 crypto map outside 2001 ipsec-isakmp   set peer 172.16.10.57  set transform-set aes-256-md5   set isakmp-profile CompanyA  match address 2001   interface Vlan500  ip address 10.10.5.5 255.255.255.224     I still have to apply this to the interfaces within the 6500 switch, as well as the interfaces on the SPA-IPSEC-2G- I just don't know what is supposed to go where.  Any ideas?   ... View more

I have a Sup720-3B- it is using the same version of code as my other 6500 series switches that are supporting LDP/MPLS.  Here is the sh mod:   Mod Ports Card Type                              Model              Serial No. --- ----- -------------------------------------- ------------------ -----------   1   24  CEF720 24 port 1000mb SFP              WS-X6724-SFP       SAD08290FLG   2   16  16 port 1000mb GBIC ethernet           WS-X6416-GBIC      SAD04240LDR   3   16  16 port 1000mb GBIC ethernet           WS-X6416-GBIC      SAD041406L9   4   48  48-port 10/100/1000 RJ45 EtherModule   WS-X6148A-GE-TX    SAL09507UST   5    2  Supervisor Engine 720 (Active)         WS-SUP720-3B       SAL1208GTEL Mod MAC addresses                       Hw    Fw           Sw           Status --- ---------------------------------- ------ ------------ ------------ -------   1  0011.9210.1774 to 0011.9210.178b   2.1   12.2(18r)S1  12.2(33)SXI1 Ok   2  00d0.d3a4.c5dd to 00d0.d3a4.c5ec   1.1   5.3(1)       12.2(33)SXI1 Ok   3  0030.19d8.59c8 to 0030.19d8.59d7   1.1   5.3(1)       12.2(33)SXI1 Ok   4  0016.4778.7600 to 0016.4778.762f   1.1   8.4(1)       12.2(33)SXI1 Ok   5  0016.c848.3880 to 0016.c848.3883   5.6   8.5(2)       12.2(33)SXI1 Ok Mod  Sub-Module                  Model              Serial       Hw     Status  ---- --------------------------- ------------------ ----------- ------- -------   1  Distributed Forwarding Card WS-F6700-DFC3A     SAL08290N34  2.2    Ok   5  Policy Feature Card 3       WS-F6K-PFC3B       SAL1208GUY6  2.3    Ok   5  MSFC3 Daughterboard         WS-SUP720          SAL1208GSV6  3.1    Ok Mod  Online Diag Status  ---- -------------------   1  Pass   2  Pass   3  Pass   4  Pass   5  Pass   and the code version:   Uptime for this control processor is 5 days, 19 hours, 50 minutes Time since Br03-CORE-6506-1 switched to active is 5 days, 19 hours, 49 minutes System returned to ROM by  power cycle at 15:33:41 UTC Wed Apr 30 2014 (SP by power on) System restarted at 16:03:27 CDT Tue Jun 10 2014 System image file is "sup-bootdisk:s72033-adventerprisek9_wan-mz.122-33.SXI13.bin" Last reload reason: reload   for some reason it's not supporting "mpls label protocol ldp"   any ideas?   Thanks Greg     ... View more