IPSEC- peer address not found

[mohsen961]

Can anybody explain what does cisco means by the following comment on the error "peer address xxxx not found":

The error message below normally appears with the corresponding VPN 3000 Concentrator error message "Message: No proposal chosen(14)". This is a result of the connections being host-to-host. The router configuration had the IPSec proposals in an order such that the proposal chosen for the router matched the access list, but not the peer. The access list had a larger network that included the host that was intersecting traffic. To correct this, make the router proposal for this concentrator-to-router connection first in line, so that it matches the specific host first."

Thanks

[umedryk]

It means that you need to have the host in a more specific way in the ACL

[brianj]

I agree that it does have to do with ACL's. I encountered this error message when I was recently configuring a 4 site hub and spoke topology using pix 501's. What I found was I had something similiar to this:

PIX A:

access-list 120 permit ip 10.0.1.0 255.255.255.0 10.0.2.0 255.255.255.0

access-list 120 permit icmp any any

access-list 130 permit ip 10.0.1.0 255.255.255.0 10.0.3.0 255.255.255.0

access-list 130 permit icmp any any

PIX B:

access-list 110 permit ip 10.0.2.0 255.255.255.0 10.0.1.0 255.255.255.0

access-list 110 permit icmp any any

I was using the permit icmp any any to test the vpn remotely and this acl saw the icmp traffic as interesting therefore bringing up the tunnel.

The problem was that since I had the permit icmp any any more than once the pix didn't like like it. As soon as I removed those ACE's from the ACL's the errors went away.

I then learned (by some nice person on this forum) that IOS version 6.34 has a command "management-address inside" which allows you to ping the remote site using the "ping 10.0.2.1 inside" command to bring the tunnel up and test.

Don't know if any of that pertains to you but thought that I would share.

Brian

[aftermath]

Hi Brian,

Were you able to get this resolved?

This is simply an ACL mismatch.

Also, if you want, you can contact me at

tony_askew2003@yahoo.com