I am having a terrible time with this. I have managed to get the VPN tunnel to initiate, but only from location 1. Traffic coming from X.X.X.254 does not start a tunnel. All routing appears to be correct; if I remove the Crypto map from both interfaces pings flow. However, once the tunnel is established pings do not work either direction.
{EDIT}
So VPN tunnel is not the problem. I have a routing issue... The setup has dual 4503 serving as routers, they have HSRP VLANs on them. The issues is that the host device is connected to SW2 (the secondary HSRP) for this VLAN/VRF, and so the packet is sent to Y.Y.Y but the wrong "gateway" IP is in the packet header. This explains why the packet arrives, but not IPSEC.
Would a policy map help me prohibit L3 routing on SW2, I need all L2 VLAN 998 packets to be processed by L3 (SW1)?
The peculiar thing is that once the VPN tunnel is up, X.X.X.254 is still sending packets, but not via IPSEC.
%CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd packet not an IPSEC packet. (ip) vrf/dest_addr= /Y.Y.Y.171, src_addr= X.X.X.254, prot= 1
LOCATION 1
Cisco IOS Software, 2800 Software (C2800NM-ADVIPSERVICESK9-M), Version 15.1(4)M9, RELEASE SOFTWARE (fc3)
rtr-lab-oma#sh run | s cry
crypto pki token default removal timeout 0
crypto keyring PSK-CTYOMA
pre-shared-key address X.X.X.193 key !*!*!*!*
pre-shared-key address X.X.X.194 key !*!*!*!*
pre-shared-key address X.X.X.195 key !*!*!*!*
crypto isakmp policy 1
encr 3des
hash md5
authentication pre-share
group 2
lifetime 28000
crypto isakmp profile PROF-CTYOMA
keyring PSK-CTYOMA
match identity address X.X.X.193 255.255.255.128
crypto ipsec transform-set TSET-CTYOMA esp-des esp-md5-hmac
crypto map VPN-CTY-IPSEC 10 ipsec-isakmp
set peer X.X.X.195
set transform-set TSET-CTYOMA
set isakmp-profile PROF-CTYOMA
match address VPN-TRAFFIC-CTYOMA
reverse-route
crypto map VPN-CTY-IPSEC
interface FastEthernet0/0
description OUTSIDE WORLD
ip address Y.Y.Y.170 255.255.255.248
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
crypto map VPN-CTY-IPSEC
end
Extended IP access list VPN-TRAFFIC-CTYOMA
10 permit ip host X.X.X.254 host Y.Y.Y.171 log
20 permit ip host Y.Y.Y.171 host X.X.X.254 log (108 matches)
LOCATION 2
Cisco IOS Software, IOS-XE Software, Catalyst 4500 L3 Switch Software (cat4500e-UNIVERSALK9-M), Version 03.06.05.E RELEASE SOFTWARE (fc2)
Supervisor 7L-E (license Level: entservices)
sw-wdc-02#sh run | s cry
service password-encryption
crypto keyring PSK-CTYOMA vrf V998:INTERNET
pre-shared-key address Y.Y.Y.170 key !*!*!*!*
crypto isakmp policy 1
encr 3des
hash md5
authentication pre-share
group 2
lifetime 28000
crypto isakmp profile PROF-CTYOMA
vrf V998:INTERNET
keyring PSK-CTYOMA
match identity address Y.Y.Y.170 255.255.255.255 V998:INTERNET
local-address Vlan998
crypto ipsec transform-set TSET-CTYOMA esp-des esp-md5-hmac
mode tunnel
crypto map VPN-CTY-IPSEC local-address Vlan998
crypto map VPN-CTY-IPSEC 10 ipsec-isakmp
set peer Y.Y.Y.170
set transform-set TSET-CTYOMA
set isakmp-profile PROF-CTYOMA
match address VPN-TRAFFIC-CTYOMA
reverse-route
interface Vlan998
description CENTURYLINK not FW
vrf forwarding V998:INTERNET
ip address X.X.X.195 255.255.255.192
standby 1 ip X.X.X.193
standby 1 priority 105
standby 1 preempt
standby 1 name V998HA
standby 1 track 1 decrement 10
crypto map VPN-CTY-IPSEC redundancy V998HA
end
Extended IP access list VPN-TRAFFIC-CTYOMA
10 permit ip host Y.Y.Y.171 host X.X.X.254 log
20 permit ip host X.X.X.254 host Y.Y.Y.171 log
sw-wdc-02#sh vrf V998:INTERNET
Name Default RD Protocols Interfaces
V998:INTERNET <not set> ipv4 Vl998
sw-wdc-02#sh ip route vrf V998:INTERNET
Routing Table: V998:INTERNET
[...]
Gateway of last resort is 65.120.78.245 to network 0.0.0.0
S* 0.0.0.0/0 [1/0] via 65.120.78.245
63.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C X.X.X.192/26 is directly connected, Vlan998
L X.X.X.195/32 is directly connected, Vlan998
65.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C A.A.A.4/30 is directly connected, GigabitEthernet3/2
L A.A.A.6/32 is directly connected, GigabitEthernet3/2
VPN RESULTS
LOCATION 1
rtr-lab-oma#sh cry session
Crypto session current status
Interface: FastEthernet0/0
Profile: PROF-CTYOMA
Session status: UP-ACTIVE
Peer: X.X.X.195 port 500
IKEv1 SA: local Y.Y.Y.170/500 remote X.X.X.195/500 Active
IPSEC FLOW: permit ip host Y.Y.Y.171 host X.X.X.254
Active SAs: 2, origin: crypto map
rtr-lab-oma#sh cry route
VPN Routing Table: Shows RRI and VTI created routes
Codes: RRI - Reverse-Route, VTI- Virtual Tunnel Interface
S - Static Map ACLs
Routes created in table GLOBAL DEFAULT
X.X.X.254/255.255.255.255 [1/0] via X.X.X.195 tag 0
on FastEthernet0/0 RRI
LOCATION 2
sw-wdc-02#sh cry session
Crypto session current status
Interface: Vlan998
Profile: PROF-CTYOMA
Session status: UP-ACTIVE
Peer: Y.Y.Y.170 port 500
Session ID: 0
IKEv1 SA: local X.X.X.195/500 remote Y.Y.Y.170/500 Active
IPSEC FLOW: permit ip host X.X.X.254 host Y.Y.Y.171
Active SAs: 2, origin: crypto map
sw-wdc-02#sh cry route
VPN Routing Table: Shows RRI and VTI created routes
Codes: RRI - Reverse-Route, VTI- Virtual Tunnel Interface
S - Static Map ACLs
Routes created in table V998:INTERNET
Y.Y.Y.171/255.255.255.255 [1/0] via Y.Y.Y.170 tag 0 count 1 rtid 7
on Vlan998 RRI
