Hello, folks Can someone explain how to create EEM applet on router? What I need: automatically change tunnel source interface from one to another when  the first one goes down. I mean when one ISP goes down we will switch to another ISP manually but we want to switch automatically to another tunnel source interface (the interface on  which we will switch to backup ISP)   from: interface Tunnel0 ip address y.y.y.y tunnel source GigabitEthernet0 tunnel destination x.x.x.x to: interface Tunnel0 ip address y.y.y.y tunnel source FastEthernet1 tunnel destination x.x.x.x ... View more

Site-to-site vpn tunnel drops off suddenly (connection is flapping). I issued the 'debug crypto isakmp' command on this router and realized my connection was flapping. The problematic router (C897VA) is a new and configuration on it is the same with other already working routers (spoke routers) on the network. This router is going to be a new spoke on the network. There is only one vpn tunnel established on it. Configuring DMVPN using GRE over IPSec.  The next hop device Is ISP. The problematic router performs the NAT. Public IP  is pingable during both situation:  when the VPN is down, and when the VPN is up Software version is quite new.   crypto isakmp policy 1 encr aes authentication pre-share group 2 crypto isakmp key <removed> address 0.0.0.0 no-xauth crypto isakmp keepalive 20 3   Here is a debug output: ISAKMP-ERROR: (0):deleting SA reason "Death by retransmission P1" state (I) MM_NO_STATE ISAKMP: (0):Deleting peer node by peer_reap for X.X.X.X: 2866AA4 ISAKMP: (0):deleting node 1802653311 error FALSE reason "IKE deleted" ISAKMP: (0):deleting node -506512794 error FALSE reason "IKE deleted" ISAKMP: (0):Input = IKE_MESG_INTERNAL, IKE_PHASE1_DEL ISAKMP: (0):Old State = IKE_I_MM1 New State = IKE_DEST_SA   Typically, ISAKMP uses UDP as its transport protocol. ISAKMP traffic normally goes over UDP port 500, unless NAT-T is used in which case UDP port 4500 is used. When Phase 1 ISAKMP fails I noticed that the debug output shows ISAKMP traffic going over UDP port 500, not over UDP port 4500: ISAKMP: (0):beginning Main Mode exchange ISAKMP-PAK: (0):sending packet to X.X.X.X my_port 500 peer_port 500 (I) MM_NO_STATE ------------------------------------ When everything is ok with connection output of  the debug shows this line below:  ISAKMP-PAK: (2001):sending packet to X.X.X.X my_port 4500 peer_port 4500 (I) MM_KEY_EXCH  (… and so on)   When it’s not ok then it starts from this line: ISAKMP-PAK: (0):sending packet to X.X.X.X  my_port 500 peer_port 500 (I) MM_NO_STATE   (… and so on) ------------------------------------------ For more info open the attached files! All public IP-addresses given in the files are replaced with: X.X.X.X,  Y.Y.Y.Y,  Z.Z.Z.Z ... View more