on the 887 i had to change:
from: crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
to: crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-md5-hmac
it looks like the tunnel now is up/up, but i still dont get traffic flowing through it.
on 887:
WHCHBSRT02#show crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst src state conn-id status
157.xx.xx.211 157.xx.xx.163 QM_IDLE 2001 ACTIVE
IPv6 Crypto ISAKMP SA
WHCHBSRT02#sho crypto ipsec sa
interface: Dialer1
Crypto map tag: crypto_map_outside, local addr 157.xx.xx.163
protected vrf: (none)
local ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (10.50.0.0/255.255.0.0/0/0)
current_peer 157.xx.xx.211 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 14, #pkts encrypt: 14, #pkts digest: 14
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 1, #recv errors 0
local crypto endpt.: 157.xx.xx.163, remote crypto endpt.: 157.xx.xx.211
path mtu 1500, ip mtu 1500, ip mtu idb Dialer1
current outbound spi: 0x88BDDA92(2294143634)
PFS (Y/N): N, DH group: none
inbound esp sas:
spi: 0xE8DE852D(3906897197)
transform: esp-3des esp-sha-hmac ,
in use settings ={Tunnel, }
conn id: 1, flow_id: Onboard VPN:1, sibling_flags 80000046, crypto map: crypto_map_outside
sa timing: remaining key lifetime (k/sec): (7902/2040)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
inbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0x88BDDA92(2294143634)
transform: esp-3des esp-sha-hmac ,
in use settings ={Tunnel, }
conn id: 2, flow_id: Onboard VPN:2, sibling_flags 80000046, crypto map: crypto_map_outside
sa timing: remaining key lifetime (k/sec): (7899/2040)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
outbound ah sas:
outbound pcp sas:
interface: Virtual-Access1
Crypto map tag: crypto_map_outside, local addr 157.xx.xx.163
protected vrf: (none)
local ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (10.50.0.0/255.255.0.0/0/0)
current_peer 157.xx.xx.211 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 14, #pkts encrypt: 14, #pkts digest: 14
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 1, #recv errors 0
local crypto endpt.: 157.xx.xx.163, remote crypto endpt.: 157.xx.xx.211
path mtu 1500, ip mtu 1500, ip mtu idb Dialer1
current outbound spi: 0x88BDDA92(2294143634)
PFS (Y/N): N, DH group: none
inbound esp sas:
spi: 0xE8DE852D(3906897197)
transform: esp-3des esp-sha-hmac ,
in use settings ={Tunnel, }
conn id: 1, flow_id: Onboard VPN:1, sibling_flags 80000046, crypto map: crypto_map_outside
sa timing: remaining key lifetime (k/sec): (7902/2040)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
inbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0x88BDDA92(2294143634)
transform: esp-3des esp-sha-hmac ,
in use settings ={Tunnel, }
conn id: 2, flow_id: Onboard VPN:2, sibling_flags 80000046, crypto map: crypto_map_outside
sa timing: remaining key lifetime (k/sec): (7899/2040)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
outbound ah sas:
outbound pcp sas:
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
on ASA:
BetBaF01# sh crypto isakmp sa
Active SA: 3
Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
Total IKE SA: 3
1 IKE Peer: 157.xx.xx.163
Type : L2L Role : responder
Rekey : no State : MM_ACTIVE
BetBaF01# sh crypto ipsec sa
interface: outside
Crypto map tag: outside_map, seq num: 27, local addr: 157.xx.xx..211
access-list outside_27_cryptomap permit ip 10.50.0.0 255.255.0.0 192.168.1.0 255.255.255.0
local ident (addr/mask/prot/port): (10.50.0.0/255.255.0.0/0/0)
remote ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0)
current_peer: 157.xx.xx.163
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 14, #pkts decrypt: 14, #pkts verify: 14
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0
#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
#send errors: 0, #recv errors: 0
local crypto endpt.: 157.xx.xx.211, remote crypto endpt.: 157.xx.xx.163
path mtu 1500, ipsec overhead 58, media mtu 1500
current outbound spi: E8DE852D
inbound esp sas:
spi: 0x88BDDA92 (2294143634)
transform: esp-3des esp-sha-hmac none
in use settings ={L2L, Tunnel, }
slot: 0, conn_id: 3974, crypto-map: outside_map
sa timing: remaining key lifetime (kB/sec): (7598/2201)
IV size: 8 bytes
replay detection support: Y
outbound esp sas:
spi: 0xE8DE852D (3906897197)
transform: esp-3des esp-sha-hmac none
in use settings ={L2L, Tunnel, }
slot: 0, conn_id: 3974, crypto-map: outside_map
sa timing: remaining key lifetime (kB/sec): (7600/2201)
IV size: 8 bytes
replay detection support: Y
Ping from 887 to Client on ASA:
WHCHBSRT02#ping
Protocol [ip]:
Target IP address: 10.50.3.77
Repeat count [5]:
Datagram size [100]:
Timeout in seconds [2]:
Extended commands [n]: y
Source address or interface: vlan1
Type of service [0]:
Set DF bit in IP header? [no]:
Validate reply data? [no]:
Data pattern [0xABCD]:
Loose, Strict, Record, Timestamp, Verbose[none]:
Sweep range of sizes [n]:
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.50.3.77, timeout is 2 seconds:
Packet sent with a source address of 192.168.1.253
.....
Success rate is 0 percent (0/5)
But the problem is obvious:
WHCHBSRT02#sh ip int brie
Interface IP-Address OK? Method Status Protocol
Vlan1 192.168.1.253 YES NVRAM up down
WHCHBSRT02#sh int statu
Port Name Status Vlan Duplex Speed Type
Fa0 notconnect 1 auto auto 10/100BaseTX
Fa1 notconnect 1 auto auto 10/100BaseTX
Fa2 notconnect 1 auto auto 10/100BaseTX
Fa3 notconnect 1 auto auto 10/100BaseTX
Now i've got someone going out to the customer site in order to attach a test device so that Int vlan 1 gets available.
Until than thank you so far! i personaly think that this support forum is a great plattform for customers aswell as cisco partners!
It speeds up debugs on existing problems and thereby increasing the customer/partner satisfaction! great job!
thank you
