%CRYPTO-6-IKMP_NOT_ENCRYPTED: IKE packet from 112.175.x.x was not encr

[김선명]

Hi.

I'm reaching out because I'm having trouble setting up tunneling.

If I am doing gre over ipsec between cisco 2911 <-> cisco 2911, there is no problem.

There is no problem with ipsec between Cisco 2911 <-> ASA5520.

However, when I try to tunnel between Cisco 2911<->Cisco 8200 and ASA5520<->Cisco 8200 with the same settings, the tunneling fails and I get the following log.

112.175.X.X : ASA5520
123.140.x.x : c2911
221.156.x.x : c8200

- LOG
%CRYPTO-6-IKMP_NOT_ENCRYPTED: IKE packet from 112.175.x.x was not encrypted and it should've been.

- LOG
%CRYPTO_ENGINE-3-CSDL_COMPLIANCE_FAIL: Cisco PSB security compliance violation is detected. Use of MD5 by Crypto IKMP is denied

[marce1000 · Accepted solution]

      - FYI : https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwb76866

 M.

[김선명]

Hi marce1000

I understand that some routers do not support MD5, as you mentioned.

When connecting C2911 and c8200 with IPSEC, it does not work even if you apply AES/SHA or 3DES/SHA512, AES256/SHA256.

However, it works with the same settings between C2911 and C2911.

[김선명]

@MHM Cisco World @marce1000

Thank you for your support.

I solved the problem by not using the DES algorithm and not encrypting the key exchange.

Thank you