Crypto map has incomplete entries message

[jason.williams]

I'm working on building a configuration on a 5540 running 9.1.2 for L2L VPN.  When I reload the device, I get this message:

.WARNING: crypto map has incomplete entries

*** Output from config line 10665, "crypto map L2LVPN interf..."

I seems it's giving me the error on the line where the crypto map is assigned to the outside interface.  Unfortunately this message really is not very helpful.  I do not have this in production yet. Is there any way I can find out where my problem may be?

Thanks.

Jason

[Jouni Forss · Accepted solution]

Hi,

This usually indicates that one L2L VPN connection Crypto Map configuration is missing some essential parameter to make it complete.

So issue the command

show run crypto map

Then make sure that the following lines exists

crypto map

crypto map

crypto map

If any of the 3 things mentioned above are missing then the crypto map configuration is deemed incomplete and doesnt have the information needed for that L2L VPN to function.

Atleast this is what it seems to me.

Hope it helps

- Jouni

[jason.williams]

That was it.  I was missing a match ACL line.  I just wish it would have been more specific.  I had over 100 crypto maps in there.  It could say "hey it looks like something is missing in crypto map x"?

Thanks for your help.

[Jouni Forss]

Hi,

Glad it got solved.

I do agree that there are several things on the ASA alone with regards to error messages (and other messages) that could provide a lot more information to help you determine what the actual problem is.

- Jouni

[ehayric1320]

I am practicing with ASA for the first time in Packet Tracer and I am encountering the same error however I have verified that I have defined the three items listed above. Any ideas?

sh run...

crypto map outside_map 1 match address outside_1_cryptomap

crypto map outside_map 1 set peer 192.168.0.12 255.255.255.0

crypto map outside_map 1 set ikev1 transform-set ESP-AES-SHA

crypto ikev1 enable outside

-output parsed-

ciscoasa1(config)#crypto map outside_map interface outside

WARNING: crypto map has incomplete entries

[daniel.constantinescu]

got the same error..however once i ping the network on teh other side of tunnel, vpn start working..