Solved: Re: IPSEC TUNNEL..HUB & SPOKE Problem - Page 2

sandeepkhera · ‎10-10-2010

Hi All,

I am facing a problem in site to site VPN in HUB and spoke topology.

Scenario : HUB routet (2811) is making Ipsec tunnel with 100 Spokes (851). with a common pre shared key. Around 90 tunnels are up but 10 tunnels are not coming up. There is similar config an IOS in each spoke router. DPD is enabled at HUB site.

HUB crypto config is same for all the sites and access-lists are mirrored in HUB and spoke..

During debug of one of spoke i got following msgs,,..

*Mar 2 09:37:59.847: ISAKMP:(0):found peer pre-shared key matching x.x.x.x

*Mar 2 09:37:59.847: ISAKMP:(0): constructed NAT-T vendor-rfc3947 ID

*Mar 2 09:37:59.847: ISAKMP:(0): constructed NAT-T vendor-07 ID

*Mar 2 09:37:59.847: ISAKMP:(0): constructed NAT-T vendor-03 ID

*Mar 2 09:37:59.847: ISAKMP:(0): constructed NAT-T vendor-02 ID

!

*Mar 2 09:37:59.887: ISAKMP:(0): sending packet to x.x.x.x my_port 500 peer_port 500 (I) MM_SA_SETUP

*Mar 2 09:37:59.887: ISAKMP:(0):Sending an IKE IPv4 Packet.

*Mar 2 09:37:59.887: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE

*Mar 2 09:37:59.887: ISAKMP:(0):Old State = IKE_I_MM2 New State = IKE_I_MM3

!

*Mar 2 09:38:01.887: ISAKMP:(0): phase 1 packet is a duplicate of a previous packet.

*Mar 2 09:38:01.887: ISAKMP:(0): retransmitting due to retransmit phase 1

*Mar 2 09:38:04.203: ISAKMP:(0): retransmitting phase 1 MM_SA_SETUP...

*Mar 2 09:38:04.203: ISAKMP (0:0): incrementing error counter on sa, attempt 1 of 5: retransmit phase 1

!(5 attemps)

*Mar 2 09:38:04.887: ISAKMP:(0):peer does not do paranoid keepalives.

*Mar 2 09:38:04.887: ISAKMP:(0):deleting SA reason "Death by retransmission P1" state (I) MM_SA_SETUP (peer x.x.x.x)

*Mar 2 09:38:04.887: ISAKMP: Unlocking peer struct 0x82182080 for isadb_mark_sa_deleted(), count 0

*Mar 2 09:38:04.887: ISAKMP: Deleting peer node by peer_reap for x.x.x.x: 82182080

*Mar 2 09:38:04.887: ISAKMP:(0):deleting node -653888495 error FALSE reason "IKE deleted"

*Mar 2 09:38:04.887: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PHASE1_DEL

*Mar 2 09:38:04.887: ISAKMP:(0):Old State = IKE_I_MM3 New State = IKE_DEST_SA

It is showng NAT-T in debug but there is no nating happening in between..??

Please share your thoughts and findings on that.

Regards

S.K

sandeepkhera · ‎10-27-2010

I am not using any special hardware VPN module at 3660 router. I am running it with default setting of software crypto engine.

How can I check the limit of that engine for encrypted tunnels.

Also what other thing matters in limitation of Ipsec tunnels on router?

SK

wzhang · ‎10-27-2010

Hi,

If you are running 12.4T IOS, then you could try the command "show crypto eli detail" to see the software crypto engine limit. With the software crypto engine, other than these hard coded SA limits, the CPU be another significant resource limitation when scaling IPSec. Hope this helps.

Thanks,

Wen

sandeepkhera · ‎11-02-2010

sh crypto eli detail results that there is no hardware vpn module present

Hardware Encryption : INACTIVE

Number of hardware crypto engines = 0

At present 100 tunnels are running ans it is not establishing more tunnels.

wt is the default number of tunnels for this 3660 Rou.

Regards

SK

wzhang · ‎11-02-2010

Hi,

Could you provide the complete "show version" and "show crypto eli detail" output? The default software crypto engine limit should be 100 IKE SA, 1000 IPSec SA, and 50 DH.

Thanks,

Wen

sandeepkhera · ‎11-02-2010

show version

Cisco IOS Software, 3600 Software (C3660-JK9O3S-M), Version 12.4(15)T5, RELEASE SOFTWARE (fc4)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2008 by Cisco Systems, Inc.
Compiled Wed 30-Apr-08 17:50 by prod_rel_team

ROM: System Bootstrap, Version 12.0(6r)T, RELEASE SOFTWARE (fc1)

Skyband-DLL-KBW uptime is 21 weeks, 3 hours, 1 minute
System returned to ROM by power-on
System restarted at 12:00:43 UTC Wed May 26 2010
System image file is "flash:c3660-jk9o3s-mz.124-15.T5.bin"

This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.

A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

If you require further assistance please contact us by sending email to
export@cisco.com.

Cisco 3660 (R527x) processor (revision 1.0) with 251904K/10240K bytes of memory.
Processor board ID JAB0412885A
R527x CPU at 225MHz, Implementation 40, Rev 10.0, 2048KB L2 Cache

3660 Chassis type: ENTERPRISE
2 FastEthernet interfaces
DRAM configuration is 64 bits wide with parity disabled.
125K bytes of NVRAM.
65536K bytes of processor board System flash (Read/Write)

Configuration register is 0x2102

it is not showing "show crypto eli detail" is not any command.

It is considering only "show crypto eli " and whose 2 lines output I already posted in last post.

BR.

SK

wzhang · ‎11-02-2010

Hi:

"show crypto eli detail" is a hidden command on the version you have, you should be able to enter it even though it's not shown in the parser. Please give it a try.

Thanks,

Wen

sandeepkhera · ‎11-02-2010

Thnx Wen I didnt know that we have some hidden commands too

Tried this one and here is output

Hardware Encryption : INACTIVE

Number of crypto engines = 2

CryptoEngine SRTP SW details: state = Active

Capability :

CryptoEngine Software Crypto Engine details: state = Active

Capability : IPPCP, DES, 3DES, AES, SEAL, RSA, IPv6, GDOI

IKE-Session : 99 active, 100 max, 49654 failed

IKEv2-Session : 99 active, 100 max, 49654 failed

DH : 2 active, 50 max, 0 failed

IPSec-Session : 194 active, 1000 max, 0 failed

0595: A IPSec (Decrypting)

SW replay check

0596: A IPSec (Encrypting)

0597: A IPSec (Decrypting)

SW replay check

0598: A IPSec (Encrypting)

0599: A IPSec (Decrypting)

SW replay check

0600: A IPSec (Encrypting)

.

.and so on.

As per above statistics we can have only 100 IKE sessions?

and could u pls tell me how 2 DH active? what it means

BR

SK

wzhang · ‎11-02-2010

Hi,

Yes this helped confirm you are limited to 100 IKE SA's. The DH count for the most part is an internal construct, so you don't have to worry too much about it. Hope this helps.

Thanks,

Wen

sandeepkhera · ‎11-02-2010

Thanx Wen for ur kind help on this..

we are planning to upgrade the router with AIM-VPN module soon..

thnx all for responding to query

Rgds

SK