No I don't have remote access to peer device. I actually think that might be the issue. The tunnel is coming up
But I get the following
Failure Reason(s)
A ping with data size of this VPN interface MTU size and 'Do not Fragment' bit set to the other end VPN device is failing. This may happen if there is a lesser MTU network which drops the 'Do not fragment' packets.
But I don't think the Cisco config professional is right..
If it helps though here is the debug info the first tunnel is working fine the second is where I am getting the errors
Cheers,
Alan
#show cry ipsec sa
interface: GigabitEthernet0/1
Crypto map tag: L2L, local addr 213.xx.xx.xx
protected vrf: (none)
local ident (addr/mask/prot/port): (172.16.20.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (192.168.0.0/255.255.255.0/0/0)
current_peer 188.xx.xx.xx port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 170164, #pkts encrypt: 170164, #pkts digest: 170164
#pkts decaps: 153422, #pkts decrypt: 153422, #pkts verify: 153422
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 5, #recv errors 0
local crypto endpt.: 213.xx.xx.xx, remote crypto endpt.: 188.xx.xx.xx
path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/1
current outbound spi: 0x8468A979(2221451641)
PFS (Y/N): N, DH group: none
inbound esp sas:
spi: 0xD5A52454(3584369748)
transform: esp-3des esp-sha-hmac ,
in use settings ={Tunnel, }
conn id: 2023, flow_id: Onboard VPN:23, sibling_flags 80000046, crypto map: L2L
sa timing: remaining key lifetime (k/sec): (4599317/2704)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
inbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0x8468A979(2221451641)
transform: esp-3des esp-sha-hmac ,
in use settings ={Tunnel, }
conn id: 2024, flow_id: Onboard VPN:24, sibling_flags 80000046, crypto map: L2L
sa timing: remaining key lifetime (k/sec): (4599309/2704)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
outbound ah sas:
outbound pcp sas:
protected vrf: (none)
local ident (addr/mask/prot/port): (172.16.20.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (192.168.100.0/255.255.255.0/0/0)
current_peer 212.xx.xx.xx port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 218, #pkts encrypt: 218, #pkts digest: 218
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 3, #recv errors 0
local crypto endpt.: 213.xx.xx.xx, remote crypto endpt.: 212.xx.xx.xx
path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/1
current outbound spi: 0x0(0)
PFS (Y/N): N, DH group: none
