Hi MHM
Removed the tunnel source. Output is enclosed at end of this message.
I guess the issue is ' down' protocol status of virtual-template interface. Because of that, the tunnel subnet is not showing as ' connected' in routing table and the router is unable to reach tunnel peer IP.
Virtual-Access1 unassigned YES unset up up
Virtual-Template1 172.19.100.1 YES manual up down
us-hou-R01#sh ip cef 172.19.100.2
172.19.100.2/32
nexthop 10.154.63.50 GigabitEthernet0/0/1
See, the tunnel peer ip is being learned from inside Lan interface instead of being shown as 'connected.
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
us-hou-R01#sh cry ikev2 sa
IPv4 Crypto IKEv2 SA
Tunnel-id Local Remote fvrf/ivrf Status
1 208.x.x.x/500 111.x.x.x/500 none/none READY
Encr: AES-CBC, keysize: 256, PRF: SHA256, Hash: SHA256, DH Grp:2, Auth sign: PSK, Auth verify: PSK
Life/Active Time: 43200/46 sec
IPv6 Crypto IKEv2 SA
us-houston-test-R01#sh cry ipsec sa
interface: Virtual-Access1
Crypto map tag: Virtual-Access1-head-0, local addr 208.x.x.x
protected vrf: (none)
local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
current_peer 111.x.x.x port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0
local crypto endpt.: 208.x.x.x, remote crypto endpt.: 111.x.x.x
plaintext mtu 1438, path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/0/0
current outbound spi: 0xC0B48B07(3233057543)
PFS (Y/N): N, DH group: none
inbound esp sas:
spi: 0x28C0E134(683729204)
transform: esp-256-aes esp-sha256-hmac ,
in use settings ={Tunnel, }
conn id: 3421, flow_id: ESG:1421, sibling_flags FFFFFFFF80000048, crypto map: Virtual-Access1-head-0
sa timing: remaining key lifetime (k/sec): (4608000/3593)
IV size: 16 bytes
replay detection support: Y
Status: ACTIVE(ACTIVE)
inbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0xC0B48B07(3233057543)
transform: esp-256-aes esp-sha256-hmac ,
in use settings ={Tunnel, }
conn id: 3422, flow_id: ESG:1422, sibling_flags FFFFFFFF80000048, crypto map: Virtual-Access1-head-0
sa timing: remaining key lifetime (k/sec): (4608000/3593)
IV size: 16 bytes
replay detection support: Y
Status: ACTIVE(ACTIVE)
outbound ah sas:
outbound pcp sas:
