I cannot find anything wrong in the two configs. When I try to send traffic from the Cisco, this is what shows on the Adtran:
2014.08.01 09:30:57 CRYPTO_IKE.NEGOTIATION 105: Failed to select IPSec proposal
and this is what shows on the Cisco:
Aug 1 11:21:03: ISAKMP:(1018): processing NOTIFY PROPOSAL_NOT_CHOSEN protocol 3
I have lost count on how many times I've checked the settings and erased and put them back in.
Here is Cisco:
crypto isakmp policy 3
encr 3des
hash md5
authentication pre-share
group 2
lifetime 28800
crypto isakmp policy 30
encr aes 256
authentication pre-share
group 2
lifetime 28800
crypto isakmp key Pyx1s15Aw3s0me! address 205.x.x.x
crypto isakmp keepalive 120 30
crypto ipsec transform-set AES256_SHA esp-aes 256 esp-sha-hmac
crypto map VPN 12 ipsec-isakmp
set peer 205.x.x.x
set transform-set AES256_SHA
match address VPN_CareAltVA-ACL
Extended IP access list NAT
120 deny ip any 10.6.0.0 0.0.255.255
130 permit ip 172.20.121.0 0.0.0.255 any
140 permit ip 172.19.121.0 0.0.0.255 any
150 permit ip 172.18.121.0 0.0.0.255 any
Extended IP access list VPN_CareAltVA-ACL
10 permit ip host 172.18.121.19 host 10.6.0.166
20 permit ip 172.18.121.0 0.0.0.255 10.6.0.0 0.0.255.255
interface FastEthernet0/0
ip address 172.18.121.1 255.255.255.0
ip accounting output-packets
ip nat inside
ip virtual-reassembly
load-interval 30
duplex auto
speed auto
!
interface FastEthernet0/1/0
switchport access vlan 100
!
interface Vlan100
ip address 50.x.x.x 255.255.255.252
ip nat outside
ip virtual-reassembly
crypto map VPN
ip route 0.0.0.0 0.0.0.0 50.x.x.x
ip route 10.6.0.0 255.255.0.0 50.x.x.x
ip route 10.6.0.166 255.255.255.255 50.x.x.x
Here is Adtran:
crypto ike policy 105
initiate main
respond anymode
local-id address 205.x.x.x
peer 50.x.x.x
attribute 1
encryption aes-256-cbc
crypto ike remote-id address 50.x.x.x preshared-key Pyx1s15Aw3s0me! ike-policy 105 crypto map VPN 60 no-xauth
crypto ipsec transform-set AES256_SHA esp-aes-256-cbc esp-sha-hmac
mode tunnel
!
crypto map VPN 60 ipsec-ike
match address VPN_GlenBurnie-ACL
set peer 50.x.x.x
set transform-set AES256_SHA
set security-association lifetime seconds 3600
ike-policy 105
interface eth 0/1
ip address 10.6.0.254 255.255.0.0
access-policy Private
no shutdown
!
!
!
!
interface t1 1/1
description Qwest circuit
tdm-group 1 timeslots 1-24 speed 64
no shutdown
!
interface ppp 1
ip address 205.x.x.x 255.255.255.252
access-policy Public
crypto map VPN
no shutdown
cross-connect 1 t1 1/1 1 ppp 1
ip access-list extended VPN_GlenBurnie-ACL
permit ip host 10.6.0.166 host 172.18.121.19
permit ip 10.6.0.0 0.0.255.255 172.18.121.0 0.0.0.255
!
ip policy-class Private
allow list VPN-40-vpn-selectors
allow list VPN-30-vpn-selectors stateless
allow list VPN-20-vpn-selectors stateless
allow list VPN_CRANFORD
nat source list NAT_OUT address 205.x.x.x overload
nat source list web-acl-10 address 10.6.0.254 overload
allow list web-acl-11 policy Private
nat source list web-acl-13 address 10.6.0.254 overload
allow list VPN_ColonialHeights-ACL
allow list VPN_GlenBurnie-ACL
!
ip policy-class Public
allow reverse list VPN-40-vpn-selectors
allow reverse list VPN-30-vpn-selectors stateless
allow reverse list VPN-20-vpn-selectors stateless
allow list ADTRAN
allow list telnet-in
allow reverse list VPN_CRANFORD
allow list web-acl-12
allow reverse list VPN_ColonialHeights-ACL
allow reverse list VPN_GlenBurnie-ACL
