VPN is on, but no full routing

[AZaburdyayev]

Hello folks.

I working on VPN config ont my routers. Curently VPN seems to be up, but not all traffic goes through it.

Small drowing

  Spoke |---|ADSL modem, PPOE|----|Internet | ----|Hub| ----p2p---|Catalyst| --- |networks 1,2,3|

      DHCP                                                                                     172.16.31.1    172.16.31.0/

I have hub and spoke topology. In my case spoke is Cisco 2611XM, HUB is Cisco 3745.

Spoke is behind NAT, but it has full connectivity with hub. From spoke I can ping, ssh to HUB.

sh crypto ips sa , and sh crypto isa sa shows that tunnel is up, this confirms with ping ( I am able to ping internal HUB interface). But I cannot ping other networks( wich behind HUB).

My HUB router is connected to Cisco Catalyst with p2p network, Catayst has default gateway wich is HUB router. Behind Catayst 3 network, all has default gateway catalyst.

When I am pingin not local address from spoke I see errors in sh cry ips sa, and acctually do not what does it mean.

But there is no mention about descapsulating packets to remote networks in HUB output( but exists encaps or errors in spoke output).

Can someone tells me how routing descision occurs on HUB ?

Why does not it forwards packets to remote networks (checked with tcpdump on remote pc)?

How to debug this issue ?

[AZaburdyayev]

After some time, I found following in debug:

079638: Jul 10 14:16:37.840: ISAKMP:(1063):Old State = IKE_P1_COMPLETE  New State = IKE_P1_COMPLETE

079639: Jul 10 14:16:43.579: IPSEC(epa_des_crypt): decrypted packet failed SA identity check

079640: Jul 10 14:16:45.575: IPSEC(epa_des_crypt): decrypted packet failed SA identity check

079641: Jul 10 14:16:47.579: IPSEC(epa_des_crypt): decrypted packet failed SA identity check

079642: Jul 10 14:16:49.583: IPSEC(epa_des_crypt): decrypted packet failed SA identity check

079643: Jul 10 14:16:51.583: IPSEC(epa_des_crypt): decrypted packet failed SA identity check

079662: Jul 10 14:25:41.278: IPSEC(crypto_map_check_encrypt_core): mtree says we have SA but couldn't find current outbound SA. dropping pak.

but with this messages I still able to ping local HUB interface. What does this messages mean ? Where can be configuration mistake ?

[AZaburdyayev]

after changing transform set to following:

crypto ipsec transform-set ts_test esp-3des

mode transport

everything start work. Who can explain ? Why only with 3des I am able to ping remote networks, but with des I cannot( except localHUB interface)?

how I can make router to initiate vpn connection begind nat ?