Isakmp with type 6 password

[Daniel Smith]

I need to update code on an asr1001x. This device has encrypted tunnels out to Amazon Web Services. We updated the Rommon and reloaded, then set up for the new code and reloaded again. Device came back fine but isakmp would not proceed to qm_idle state. No changes were made on the far end. A visual comparison of the password in the config of both ends indicated a match, however at the AWS side there was no indication of being a type 6. The person that got these going originally is no longer on staff so no help there. I hoping you have better understanding of this process than I. 

[MHM Cisco World]

Qm-idle meaning phaseI is success

Check 

Show crypto session details 

Show crypto ipsec sa 

MHM

[Daniel Smith]

Unfortunately, the session after reload and code upgrade does not get to the qm_idle state, that is the issue. I cannot gather specific details on this as we had to revert the code upgrade to get the tunnels back working.

[MHM Cisco World]

https://bst.cisco.com/bugsearch/bug/CSCvh12079?rfs=qvlogin

check this bug 

MHM

[M02@rt37]

Hello @Daniel Smith 

QM_IDLE means the SA remains authenticated with its peer and may be used for subsequent quick mode exchanges for additional IPsec SAs... so it seems to be good.

Please provide us outputs asked.