IPSEC is not forming and IKE is forming.Please see the configuration and help to resolve.
CISCO ASR1006 Configuration
--------------------
crypto isakmp policy 10
encr 3des
hash md5
authentication pre-share
crypto isakmp key xx.x.x address 0.0.0.0
crypto isakmp keepalive 10
!
crypto ipsec security-association lifetime seconds 86400
!
crypto ipsec transform-set FE_TS esp-3des esp-sha-hmac
mode tunnel
!
!
!
crypto dynamic-map FE_D 9998
set transform-set FE_TS
!
crypto map FEM_MAP 9999 ipsec-isakmp dynamic FE_D
!
interface GigabitEthernet0/0/0
crypto map FEM_MAP redundancy IPSEC
!
------------------------------
Exit Path Table - status: enable, current entry 48, deleted 0, max allow 50
Error(20217): QM FSM invalide state transitions.
-Traceback= 1#2afbea86c6f2cb228d35a1c42581945e :400000+7EB803B :400000+7EB7EA2 :400000+7D161A0 :400000+7D16258 :400000+7D85213 :400000+7D7FF7F
Error(20245): IPSEC validate proposal failed.
[conn id 40816, local 10.xx.xx.3:500 remote 10.xx.254.92:500]
error 8
-Traceback= 1#2afbea86c6f2cb228d35a1c42581945e :400000+7EB803B :400000+7EB7EA2 :400000+7D465AA :400000+7D426DE :400000+7D5F132 :400000+7D145B0 :400000+80624C8 :400000+8062457 :400000+7D16169 :400000+7D16258 :400000+7D85213 :400000+7D7FF7F
Error(1451): Failed to access account record.
-Traceback= 1#2afbea86c6f2cb228d35a1c42581945e :400000+7EB803B :400000+7EB7EA2 :400000+7D17331 :400000+7D3817B :400000+7D38576 :400000+7D39F44 :400000+7D3A0BE :400000+7D72990 :400000+7D1262D :400000+80624C8 :400000+8062457 :400000+7D12C44 :400000+7D12B33 :400000+7D80126 :400000+7D7FD24
Error(2480): Failed to send delete, peer isn't authenticated.
[conn id 0, local 10.xx.xx.3:500 remote 10.xx.254.92:500]
-------------------------------
JUNIPER SRX-320 Configuration
proposal IKE_PROPOSAL-1 {
authentication-method pre-shared-keys;
dh-group group1;
authentication-algorithm md5;
encryption-algorithm 3des-cbc;
lifetime-seconds 86400;
}
policy POLICY-1 {
mode main;
proposals IKE_PROPOSAL-1;
pre-shared-key ascii-text "$9$wqg4ZmPQn9poJQn/9pu8XxdYg"; ## SECRET-DATA
}
}
gateway TEST {
ike-policy POLICY-1;
address 10.xx.xx.3;
dead-peer-detection interval 10;
external-interface lo0;
}
proposal IPSEC-PROPOSAL-1 {
protocol esp;
authentication-algorithm hmac-sha1-96;
encryption-algorithm 3des-cbc;
lifetime-seconds 86400;
}
policy IPSEC-POLICY-1 {
proposals IPSEC-PROPOSAL-1;
}
vpn VPN-3 {
bind-interface st0.0;
ike {
gateway TEST;
ipsec-policy IPSEC-POLICY-1;
}
establish-tunnels immediately;
}
unit 0 {
multipoint;
family inet
}
next-hop-tunnel 10.1.1.4 ipsec-vpn VPN-3;
address 10.1.1.1/24;
}
