HI trying to build a dmvpn with cert auth and think I'm missing a piece of glue on the Hub
everything seems to be going swimmingly - the Hub seem content with the certificate provided by the spoke but fails to find a certificate to send back - what am I missing?
i suspect its a bit of vrf glue n the profile but i've read a number of guides and thinks it correct
Debug output
.May 6 17:34:35.764: ISAKMP: (1029):SA authentication status:
authenticated
.May 6 17:34:35.764: ISAKMP: (1029):Process initial contact,
bring down existing phase 1 and 2 SA's with local 2.2.2.2 remote 1.1.1.1 remote port 500
.May 6 17:34:35.764: ISAKMP: (0):Trying to insert a peer 2.2.2.2/1.1.1.1/500/internet,
.May 6 17:34:35.764: ISAKMP: (0): and inserted successfully 316038B4.
.May 6 17:34:35.764: ISAKMP-AAA: (1029):Accounting is not enabled
.May 6 17:34:35.764: ISAKMP: (1029):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
.May 6 17:34:35.764: ISAKMP: (1029):Old State = IKE_R_MM5 New State = IKE_R_MM5
.May 6 17:34:35.764: ISAKMP: (1029):processing CERT_REQ payload.
.May 6 17:34:35.764: ISAKMP: (1029):peer wants a CT_X509_SIGNATURE cert
.May 6 17:34:35.764: ISAKMP: (1029):peer wants cert issued by cn=SR-CA
.May 6 17:34:35.764: CRYPTO_PKI: 0 matching trustpoints found
.May 6 17:34:35.764: ISAKMP-ERROR: (1029):(1029): FSM action returned error: 2
.May 6 17:34:35.764: ISAKMP: (1029):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
.May 6 17:34:35.764: ISAKMP: (1029):Old State = IKE_R_MM5 New State = IKE_P1_COMPLETE
***************cert extract******************
Certificate
Status: Available
Version: 3
Certificate Serial Number (hex): 30
Certificate Usage: Encryption
Issuer:
cn=SR-CA
************************************
Here is an extract of the hub config
********************Hub**********************************
!
ip vrf internet
rd 65013:1
!
crypto pki server SR-CA
no database archive
grant auto
lifetime certificate 1000
lifetime ca-certificate 7305
!
crypto pki trustpoint SR-CA
revocation-check crl
rsakeypair SR-CA
!
crypto pki trustpoint SR-CA-server
enrollment url http://10.b.c.d:80
serial-number
revocation-check none
source interface Loopback999
rsakeypair RSAIPSEC 2048
!
!
!
crypto pki certificate chain SR-CA
certificate ca 01
308204FE
******************redacted*****************************
9C3B
quit
crypto pki certificate chain SR-CA-server
certificate 30
30820411
***********************redacted*************************
31795EFA D8
quit
certificate ca 01
308204FE
***********************redacted*************************
9C3B
quit
l
license boot module c1900 technology-package securityk9
!
!
!
!
!
crypto isakmp policy 10
encr aes 256
hash sha512
group 24
crypto isakmp profile DMVPN
vrf internet
ca trust-point SR-CA-server
match identity host domain mydomain.com
!
!
crypto ipsec transform-set dmvpn ah-sha-hmac esp-aes 256
mode tunnel
!
crypto ipsec profile IPSEC-Profile
set transform-set DMVPN-TSSET
set ikev2-profile DMVPN-Profile
!
!
crypto ipsec profile dmvpn
set transform-set dmvpn
set isakmp-profile DMVPN
!
!
bridge irb
!
!
!
!
!
interface Tunnel0
description VPN Backup HQ02 (GRE DMVPN)
bandwidth 800000
ip address 10.1.2.3 255.255.255.0
no ip redirects
ip hold-time eigrp 1 35
no ip next-hop-self eigrp 1
no ip split-horizon eigrp 1
ip nhrp authentication dmvpn
ip nhrp map multicast dynamic
ip nhrp network-id 1
ip virtual-reassembly in
delay 150
tunnel source GigabitEthernet0/0.1005
tunnel mode gre multipoint
tunnel key 1
tunnel vrf internet
tunnel protection ipsec profile dmvpn
!
!
interface GigabitEthernet0/0.1005
encapsulation dot1Q 1005
ip vrf forwarding internet
ip address 4a.b.c.d 255.255.255.248
ip access-group Stealth-ACL in
ip flow ingress
ip flow egress
ip nat outside
ip virtual-reassembly in
!
