Hello.
During upgrade from 3925 router, to new 8300 router,
DMVPN tunnel2 and DMVPN tunnel 3 did not achieve an up state. They were stuck in IKE, and after investigation, it seems that the new 8300 is sending isakmp requests, but the 2950 DMVPN hub is receiving zero of these requests.
-It is true that DMVPNs were without symptoms before hardware replacement.
-It is true that new config was (basically) copy/pasted from old config.
-It is true that www connectivity is successful.
-It is true that the 2950 DMVPN hub can ping the public interface of the 8300 new spoke.
it is true that isakmp proposal tset details are identical in hub and spoke config.
-It is true that, unlike the old 3925, this new 8300 has security features such as zone based firewalls. Without effect, I inserted, "
-It is possible that this device circuit traverses and ASA.
From cisco literature...
"Security Configuration Guide: Zone-Based Policy Firewall - Zone-Based Policy Firewalls [Cisco ASR 1000 Series Aggregation Services Routers] - Cisco
"How do I turn off zone-based firewall?
To disable the zone-based firewall configurations that have been applied on the interfaces, use the platform inspect disable-all command. Similarly, to enable zone-based firewall on the interfaces, use the no platform inspect disable-all command. By default, zone-based firewall is always enabled."
QUESTION:
What is probable cause, or next troubleshoot step here?
Thank you.
