Hi Friends,
I've created a site to site VPN between cisco devices. VPN tunnels are coming up, but traffic is getting encryted only at side.
Anyone any idea why it's?
Output from local device:
Router#show crypto isa
CRPvtMUScingh01#show crypto isakmp sa | in 204.75.145.14
216.143.142.69 204.75.145.14 QM_IDLE 33 0 ACTIVE
Router#sh crypto ipsec sa | be 204.75.145.14
current_peer 204.75.145.14 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0
local crypto endpt.: 216.143.142.69, remote crypto endpt.: 204.75.145.14
path mtu 1412, ip mtu 1412
current outbound spi: 0x0(0)
inbound esp sas:
inbound ah sas:
inbound pcp sas:
outbound esp sas:
outbound ah sas:
outbound pcp sas:
local crypto endpt.: 216.143.142.69, remote crypto endpt.: 204.75.144.14
path mtu 1412, ip mtu 1412
current outbound spi: 0x0(0)
inbound esp sas:
inbound ah sas:
inbound pcp sas:
outbound esp sas:
outbound ah sas:
outbound pcp sas:
protected vrf: (none)
local ident (addr/mask/prot/port): (205.173.92.5/255.255.255.255/0/0)
remote ident (addr/mask/prot/port): (204.75.145.138/255.255.255.255/0/0)
current_peer 204.75.145.14 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 36, #pkts decrypt: 36, #pkts verify: 36
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0
local crypto endpt.: 216.143.142.69, remote crypto endpt.: 204.75.145.14
path mtu 1412, ip mtu 1412
current outbound spi: 0x111D7A8E(287144590)
inbound esp sas:
spi: 0x86F5054A(2264204618)
transform: esp-3des esp-sha-hmac ,
in use settings ={Tunnel, }
conn id: 3085, flow_id: Onboard VPN:85, crypto map: geshared
sa timing: remaining key lifetime (k/sec): (4378030/3492)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
inbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0x111D7A8E(287144590)
transform: esp-3des esp-sha-hmac ,
in use settings ={Tunnel, }
conn id: 3048, flow_id: Onboard VPN:48, crypto map: geshared
sa timing: remaining key lifetime (k/sec): (4378031/3492)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
outbound ah sas:
outbound pcp sas:
Output from remote devcie:
ud1-vpn-rtr01a#sh cry isa sa
IPv4 Crypto ISAKMP SA
dst src state conn-id status
216.143.142.69 204.75.145.14 QM_IDLE 14566 ACTIVE
ud1-vpn-rtr01a#sh cry ses bri
Status: A- Active, U - Up, D - Down, I - Idle, S - Standby, N - Negotiating
K - No IKE
ivrf = (none)
Peer I/F Username Group/Phase1_id Uptime Status
216.143.142.69 Gi0/2 216.143.142.69 00:08:55 UA
ud1-vpn-rtr01a#sh cry ipsec sa peer 216.143.142.69
interface: GigabitEthernet0/2
Crypto map tag: SMS, local addr 204.75.145.14
protected vrf: (none)
local ident (addr/mask/prot/port): (204.75.145.138/255.255.255.255/0/0)
remote ident (addr/mask/prot/port): (205.173.92.5/255.255.255.255/0/0)
current_peer 216.143.142.69 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 22, #pkts encrypt: 22, #pkts digest: 22
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
