We have a single CISCO2921/K9 and less than 10 spokes (all 881). Today, abruptly, all of the spokes lost connectivity. I'm really out of my element with this as I didn't implement this solution and maintaining it is not my responsibility. I only have my general knowledge and troubleshooting skills to fall back on. Here are some of the 'show' commands I've issued:
show crypto session
lists an entry for each of the spokes with "DOWN-NEGOTIATING" in the "Session status" field
show crypto isakmp peers
nothing
show crypto isakmp sa
lists a entry for each spoke, all with a state of "MM_KEY_EXCH" with a status of "ACTIVE"
show crypto ipsec sa
nothing
So at this point, not knowing much about IPSec, I figure it's not completing phase 1. So I figured that the next thing I should do is turn on isakmp debugging. I issued:
debug crypto isakmp
debug crypto ipsec
Nothing. I get nothing. Then I started wondering if I was even getting traffic from the spokes. I created an ACL to match the spoke IPs and issued:
debug ip packet 1 detail
Sure enough I'm getting plenty of udp/500 traffic from all of the spokes. However, nothing in the crypto debugs. Isn't that strange? Shouldn't I see something? I'm wondering if there's a hardware issue with the VPN module.
show crypto eli
Hardware Encryption : ACTIVE
Number of hardware crypto engines = 1
CryptoEngine Onboard VPN details: state = Active
Capability : IPPCP, DES, 3DES, AES, IPv6, GDOI, FAILCLOSE, HA
IPSec-Session : 0 active, 3600 max, 0 failed
Any thoughts? What should I do next?
Thanks,
Steven
