cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
452
Views
0
Helpful
0
Replies
danjor
Beginner

L2L VPN IPSEC only comming up only initated by 1 side

Hi,

I do have 2 routers that I want to connecte by L2L Tunnels.

My config works from site B to site A, I can bring the tunnel up and both site communicate in both way.
But the site A can't bring the tunnel UP. It seams that, as long as the IPSEC part stays to up, the router A can bring ISAKMP up but after IPSEC disapears, site A has no way to bring the tunnel up. It has to be again initiated by site B.

When router A has to initate the tunnel, the ACLs in nonat (ACL199) and trafic selection (ACL130) counts right the pakets but the debug gives no output on router A. For the test, site A has 192.168.1.x and site B has 10.1.2.x internal IP.

Site A:
Router 2611XM IOS c2600-advsecurityk9-mz.124-15.T14.bin

crypto keyring spokes
  pre-shared-key address yy.yy.yy.yy key abcdef
!
crypto isakmp policy 10
encr 3des
hash md5
authentication pre-share
group 2
!
crypto isakmp policy 100
encr 3des
hash md5
authentication pre-share
group 2
!
crypto isakmp policy 101
hash md5
authentication pre-share
crypto isakmp keepalive 10
crypto isakmp xauth timeout 90
!

****************

here are some easy VPN configuration

***************

crypto isakmp profile L2L
   description LAN-to-LAN for spoke router(s) connection
   keyring spokes
   match identity address yy.yy.yy.yy 255.255.255.255
crypto ipsec transform-set myset esp-3des esp-sha-hmac
crypto ipsec transform-set myset2 esp-3des esp-md5-hmac
!
crypto dynamic-map dynmap 3
set transform-set myset
set isakmp-profile VPNclient2
crypto dynamic-map dynmap 4
set transform-set myset
set isakmp-profile VPNclient3
crypto dynamic-map dynmap 5
set transform-set myset
set isakmp-profile VPNclient
crypto dynamic-map dynmap 10
set transform-set myset2
set isakmp-profile L2L
match address 130
!
crypto map mymap 10 ipsec-isakmp dynamic dynmap
!
interface FastEthernet0/0
description $FW_OUTSIDE$
ip address xx.xx.xx.xx 255.255.255.192
ip access-group 101 in
ip inspect DEFAULT100 out
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
crypto map mymap
!

interface FastEthernet0/1
ip address 192.168.1.50 255.255.255.0
ip nat inside
ip virtual-reassembly
duplex auto
speed auto

crypto map mymap 10 ipsec-isakmp dynamic dynmap
!
ip nat inside source route-map nonat interface FastEthernet0/0 overload

access-list 130 permit ip 192.168.1.0 0.0.0.255 10.1.2.0 0.0.0.255
access-list 130 permit ip 192.168.1.0 0.0.0.255 10.1.3.0 0.0.0.255

access-list 199 deny   ip 192.168.1.0 0.0.0.255 10.1.0.0 0.0.255.255
access-list 199 deny   ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
access-list 199 deny   ip 192.168.1.0 0.0.0.255 172.16.100.0 0.0.0.255
access-list 199 deny   ip 192.168.1.0 0.0.0.255 172.16.101.0 0.0.0.255
access-list 199 deny   ip 192.168.1.0 0.0.0.255 192.168.100.0 0.0.0.255
access-list 199 permit ip 192.168.1.0 0.0.0.255 any

**************************************************************************

Site B:

Router ISR 2821 IOS c2800nm-advipservicesk9-mz.150-1.M3.bin

crypto isakmp policy 5
hash md5
authentication pre-share
!
crypto isakmp policy 100
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key abcdef address xx.xx.xx.xx no-xauth
crypto isakmp keepalive 10
crypto isakmp xauth timeout 90

!
****************
Some EASYVPN client
****************
!
crypto ipsec transform-set myset esp-3des esp-md5-hmac
!
crypto dynamic-map dynmap 10
set transform-set myset
reverse-route
!
!
crypto map clientmap client authentication list userauthen
crypto map clientmap isakmp authorization list groupauthor
crypto map clientmap client configuration address respond
crypto map clientmap 10 ipsec-isakmp dynamic dynmap
crypto map clientmap 20 ipsec-isakmp
set peer xx.xx.xx.xx
set transform-set myset
match address 130
!
! The virtual interface is mandatory from ISP to have a fix IP adress
! This fix IP adress correspond to the designated IP yy.yy.yy.yy in router A

interface Virtual-PPP1
ip address negotiated
ip access-group 101 in
ip nat outside
ip inspect DEFAULT100 out
ip virtual-reassembly
ppp pap sent-username 12345 password 12345
ppp ipcp dns request accept
pseudowire 195.132.16.228 2 pw-class ISP
crypto map clientmap
!

interface GigabitEthernet0/0.2
encapsulation dot1Q 2
ip address 10.1.2.4 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip flow ingress
ip nat inside
ip virtual-reassembly
!
interface GigabitEthernet0/0.3
encapsulation dot1Q 3
ip address 10.1.3.4 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip flow ingress
ip virtual-reassembly

ip nat inside source list 102 interface Virtual-PPP1 overload

access-list 102 deny   ip any 192.168.0.0 0.0.255.255
access-list 102 deny   ip any 10.0.0.0 0.255.255.255
access-list 102 permit ip any any

access-list 130 permit ip 10.1.2.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 130 permit ip 10.1.3.0 0.0.0.255 192.168.1.0 0.0.0.255


So the result of a ping after clear counters from ACL gives:

comcomrt1#ping 10.1.2.4 source 192.168.1.50

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.2.4, timeout is 2 seconds:
Packet sent with a source address of 192.168.1.50
.....
Success rate is 0 percent (0/5)
comcomrt1#sh ip access-li 130
Extended IP access list 130
    10 permit ip 192.168.1.0 0.0.0.255 10.1.2.0 0.0.0.255 (5 matches)
    20 permit ip 192.168.1.0 0.0.0.255 10.1.3.0 0.0.0.255
comcomrt1#sh ip access-li 199
Extended IP access list 199
    10 deny ip 192.168.1.0 0.0.0.255 10.1.0.0 0.0.255.255 (5 matches)
    20 deny ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
    30 deny ip 192.168.1.0 0.0.0.255 172.16.100.0 0.0.0.255
    40 deny ip 192.168.1.0 0.0.0.255 172.16.101.0 0.0.0.255
    50 deny ip 192.168.1.0 0.0.0.255 192.168.100.0 0.0.0.255
    60 permit ip 192.168.1.0 0.0.0.255 any (2842 matches)
comcomrt1#


And debug cry isa + debug cry ipsec gives no output during the ping

Any idea why I do not have the initiation from tunnel?

Thanks for helping
Daniel

0 REPLIES 0