11-03-2013 06:41 AM - edited 02-21-2020 07:17 PM
Hi ,
I am want to crerate a GREover IPsec Tunnel between Cisco ASR 1002 and cisco 3900 i am getting the below error.
%CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd packet not an IPSEC packet. (ip) vrf/dest_addr= /x.x.x.x, src_addr= x.x.x.x, prot= 47
I have attached the configuration file as well currently working on tunnel 117.
Site A already have some tunnels up and running but only tunnel 117 is not working which i created now on ASR 1002.
CAN ANYONE LET ME KNOW WHAT I AM FACING AN ISSUE.
11-03-2013 01:11 PM
The first issue that I note is that you have applied the crypto map on the tunnel interface as well as on the physical interface. While there are perhaps still some examples that show this they are based on the operation of quite old IOS versions. The code that you are now running expects the crypto map to be applied only on the physical interface. I suggest that you remove the crypto map from the tunnel interfaces. Try that and let us know if the behavior changes.
HTH
Rick
01-30-2017 11:16 PM
Hi, Richard
Can i apply crypto map on a Loopback interface on IOS XE 3.16. (isr4451)?
01-31-2017 08:01 AM
I have not applied a crypto map to a loopback interface and so can not speak from experience about this. From a syntax perspective I would expect that the commands to apply the crypto map to a loopback interface would be accepted. I am not clear why you would want to do this and not sure how it would work.
In my original response I talked about applying the crypto map on tunnel interface and on physical interface because that is what was being done in the original post. Perhaps it would be beneficial to refine my explanation and talk about applying the crypto map on the exit interface (and take "physical" out of consideration). It is not very important whether the interface is physical or virtual. What is important is that it is the interface through which the packet is forwarded out of the device. So I would expect that the crypto map could be applied successfully on a physical interface, on an SVI, or on a loopback interface, as long as that interface is the interface through which the encrypted packets will be sent.
Remember that what is happening is that IOS examines packets as they are sent out the interface and if a crypto map is applied to that interface then IOS evaluates whether the packet matches the conditions of the crypto map and determines whether the packet should be encrypted or not.
So is your loopback interface the exit interface for encrypted traffic?
HTH
Rick
02-01-2017 11:39 PM
Hi, sorry for the long time answer
>So is your loopback interface the exit interface for encrypted traffic?
yes
See example, it works on old IOS version 12.4
crypto isakmp key TEST-IPSEC address XX.XX.XX.XX
It is necessary that from my side for the new crypto map was a new IP, IP source, not the destination
02-06-2017 08:34 AM
Thanks for sending the example. Am I correct in understanding that this does work?
I do not understand what you mean when you say "It is necessary that from my side for the new crypto map was a new IP, IP source, not the destination" Can you clarify for me?
HTH
Rick
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide