Yes, we want to do GRE within IPSEC.
Re: Keepalives ... R2 does have other tunnels built to it that are working, and I think they may require the keepalives. The tunnel I'm building uses VTI but the others were built before I got here and are not using VTI. In any case, I've removed the keepalive statements from the tunnel I'm working on. That hasn't changed the tunnel states.
Here are the router configs and some show commands. I've removed lines of output that I thought weren't needed, if there's something I left out that you want to see let me know. Also, you may notice at the R2 side there's a bridged /30 from the ISP and then our own /29 inside our network. Due to some quirkiness with how that /30 routes I've had to use the /30 IP in some places and the /29 in others. I'm not sure if this is part of the problem or not. I have modified IP addresses for security and removed passwords.
**************************************************
**************************************************
R2
crypto pki token default removal timeout 0
!
crypto isakmp key hunter2 address 3.5.7.1
crypto isakmp invalid-spi-recovery
crypto isakmp nat keepalive 20
!
crypto ipsec transform-set R2-R4-SET esp-3des esp-sha-hmac
crypto ipsec nat-transparency spi-matching
!
crypto ipsec profile R2-R4-VTI
set transform-set R2-R4-SET
set pfs group2
!
interface Tunnel4
description R4(Tu4)
bandwidth 300000
ip address 2.5.6.1 255.255.255.252
tunnel source GigabitEthernet0/0.21
tunnel mode ipsec ipv4
tunnel destination 3.5.7.1
tunnel path-mtu-discovery
tunnel protection ipsec profile R2-R4-VTI
!
interface GigabitEthernet0/0.21
description XO
encapsulation dot1Q 201
ip address 5.7.1.0 255.255.255.252
ip nat outside
!
ip route 3.5.7.1 255.255.255.255 GigabitEthernet0/0.21 5.7.1.9
**************************************************
**************************************************
R2 show commands
R2#sh cry ses rem 3.5.7.1 det
Crypto session current status
Interface: Tunnel4
Session status: DOWN-NEGOTIATING
Peer: 3.5.7.1 port 500 fvrf: (none) ivrf: (none)
Desc: (none)
Phase1_id: (none)
IKEv1 SA: local 5.7.1.0/500 remote 3.5.7.1/500 Inactive
Capabilities:(none) connid:0 lifetime:0
IPSEC FLOW: permit ip 0.0.0.0/0.0.0.0 0.0.0.0/0.0.0.0
Active SAs: 0, origin: crypto map
Inbound: #pkts dec'ed 0 drop 0 life (KB/Sec) 0/0
Outbound: #pkts enc'ed 0 drop 0 life (KB/Sec) 0/0
Interface: GigabitEthernet0/0.21
Session status: UP-IDLE
Peer: 3.5.7.1 port 500 fvrf: (none) ivrf: (none)
Phase1_id: 3.5.7.1
Desc: (none)
IKEv1 SA: local 9.7.3.0/500 remote 3.5.7.1/500 Active
Capabilities:D connid:4521 lifetime:23:39:18
R2#sh cry eng conn act | i 9.7.3.0
ID Type Algorithm Encrypt Decrypt LastSeqN IP-Address
4521 IKE SHA+3DES 0 0 0 9.7.3.0
R2#sh cry is sa | i 9.7.3.0
dst src state conn-id status
9.7.3.0 3.5.7.1 QM_IDLE 4521 ACTIVE
R2#sh cry ips sa peer 3.5.7.1
interface: Tunnel4
Crypto map tag: Tunnel4-head-0, local addr 5.7.1.0
protected vrf: (none)
local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
current_peer 3.5.7.1 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0
local crypto endpt.: 5.7.1.0, remote crypto endpt.: 3.5.7.1
path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/0.21
current outbound spi: 0x0(0)
PFS (Y/N): N, DH group: none
Crypto Map IPv4 "Tunnel4-head-0" 65536 ipsec-isakmp
Profile name: R2-R4-VTI
Security association lifetime: 4608000 kilobytes/3600 seconds
Responder-Only (Y/N): N
PFS (Y/N): Y
DH group: group2
Transform sets={
R2-R4-SET: { esp-3des esp-sha-hmac } ,
}
Crypto Map IPv4 "Tunnel4-head-0" 65537 ipsec-isakmp
Map is a PROFILE INSTANCE.
Peer = 3.5.7.1
Extended IP access list
access-list permit ip any any
Current peer: 3.5.7.1
Security association lifetime: 4608000 kilobytes/3600 seconds
Responder-Only (Y/N): N
PFS (Y/N): N
Transform sets={
R2-R4-SET: { esp-3des esp-sha-hmac } ,
}
Always create SAs
Interfaces using crypto map Tunnel4-head-0:
Tunnel4
**************************************************
**************************************************
R4
crypto pki token default removal timeout 0
!
crypto isakmp key hunter2 address 9.7.3.0
crypto isakmp keepalive 10
!
crypto ipsec transform-set R4-R2-SET esp-3des esp-sha-hmac
!
crypto ipsec profile R4-R2-VTI
set transform-set R4-R2-SET
set pfs group2
!
interface Tunnel4
description R2(Tu4)
bandwidth 300000
ip address 2.5.6.2 255.255.255.252
tunnel source GigabitEthernet0/0.71
tunnel destination 9.7.3.0
tunnel mode ipsec ipv4
tunnel path-mtu-discovery
tunnel protection ipsec profile R4-R2-VTI
!
interface GigabitEthernet0/0.71
description FIOS-MODEM
ip address 3.5.7.1 255.255.255.0
ip nat outside
!
ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0.71 3.5.7.1
ip route 9.7.3.0 255.255.255.255 GigabitEthernet0/0.71 3.5.7.1
**************************************************
**************************************************
R4#sh cry sess det
Crypto session current status
Code: C - IKE Configuration mode, D - Dead Peer Detection
K - Keepalives, N - NAT-traversal, X - IKE Extended Authentication
Interface: Tunnel4
Session status: UP-IDLE
Peer: 9.7.3.0 port 500 fvrf: (none) ivrf: (none)
Phase1_id: 9.7.3.0
Desc: (none)
IKE SA: local 3.5.7.1/500 remote 9.7.3.0/500 Active
Capabilities:D connid:4016 lifetime:23:34:27
IPSEC FLOW: permit ip 0.0.0.0/0.0.0.0 0.0.0.0/0.0.0.0
Active SAs: 0, origin: crypto map
Inbound: #pkts dec'ed 0 drop 0 life (KB/Sec) 0/0
Outbound: #pkts enc'ed 0 drop 0 life (KB/Sec) 0/0
Interface: GigabitEthernet0/0.71
Session status: DOWN-NEGOTIATING
Peer: 5.7.1.0 port 500 fvrf: (none) ivrf: (none)
Desc: (none)
Phase1_id: (none)
IKE SA: local 3.5.7.1/500 remote 5.7.1.0/500 Inactive
Capabilities:(none) connid:0 lifetime:0
R4#sh cry eng conn act
Crypto Engine Connections
ID Interface Type Algorithm Encrypt Decrypt IP-Address
4016 Tu40 IKE SHA+3DES 0 0 3.5.7.1
R4#sh cry ips sa
interface: Tunnel4
Crypto map tag: Tunnel4-head-0, local addr 3.5.7.1
protected vrf: (none)
local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
current_peer 9.7.3.0 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0
local crypto endpt.: 3.5.7.1, remote crypto endpt.: 9.7.3.0
path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/0.71
current outbound spi: 0x0(0)
R4#sh cry map
Crypto Map "Tunnel4-head-0" 65536 ipsec-isakmp
Profile name: R4-R2-VTI
Security association lifetime: 4608000 kilobytes/3600 seconds
PFS (Y/N): Y
DH group: group2
Transform sets={
R4-R2-SET,
}
Crypto Map "Tunnel4-head-0" 65537 ipsec-isakmp
Map is a PROFILE INSTANCE.
Peer = 9.7.3.0
Extended IP access list
access-list permit ip any any
Current peer: 9.7.3.0
Security association lifetime: 4608000 kilobytes/3600 seconds
PFS (Y/N): Y
DH group: group2
Transform sets={
R4-R2-SET,
}
Interfaces using crypto map Tunnel4-head-0:
Tunnel4
