Packet Tracer - multiple VPNs working, but only one can run at a time

[rbelusko1]

This is a strange issue.... I have a Cisco Packet Tracer simulation configured to connect 3 networks with a virtual internet in the middle.

Each site router has a VPN to the main router.

192.168.9.0/24 - Router A (main router)

192.168.2.0/24 - Router B - VPN with Router A

192.168.3.0/24 - Router C - VPN with Router A

For some reason, I can only have one of these VPNs running at the same time. I close/reopen PT and test pings from A to C and eventually the VPN comes up and works fine (as expected). However, in the same session pings from A to B never work.

Likewise, in the same configuration, if I open PT and start pings from A to C it comes up just fine after a few pings, but A to B will not work until PT is closed/reopened. Why is this? I have posted relevant portions of the configs for each below.

Thanks!

Bob

[rbelusko1]

Router A:

crypto isakmp policy 1

hash md5

authentication pre-share

!

crypto isakmp policy 10

hash md5

authentication pre-share

!

crypto isakmp key vpnuser address 38.2.10.1

crypto isakmp key vpnuser address 42.10.1.2

!

!

!

crypto ipsec transform-set myset esp-des esp-md5-hmac

!

crypto map mymap 1 ipsec-isakmp

set peer 42.10.1.2

set transform-set myset

match address ann

!

crypto map mymap 10 ipsec-isakmp

set peer 38.2.10.1

set transform-set myset

match address parents

!

!

!

!

!

!

spanning-tree mode pvst

!

!

!

!

!

!

interface FastEthernet0/0

ip address 38.1.10.1 255.255.255.0

ip nat outside

duplex auto

speed auto

crypto map mymap

!

interface FastEthernet0/1

ip address 192.168.9.1 255.255.255.0

ip nat inside

duplex auto

speed auto

!

interface Vlan1

no ip address

shutdown

!

ip nat inside source list 101 interface FastEthernet0/0 overload

ip classless

ip route 0.0.0.0 0.0.0.0 38.1.10.2

!

ip flow-export version 9

!

!

ip access-list extended ann

permit ip 192.168.9.0 0.0.0.255 192.168.3.0 0.0.0.255

ip access-list extended parents

permit ip 192.168.9.0 0.0.0.255 192.168.2.0 0.0.0.255

access-list 101 remark == [Control NAT Service]==

access-list 101 deny ip 192.168.9.0 0.0.0.255 192.168.2.0 0.0.0.255

access-list 101 deny ip 192.168.9.0 0.0.0.255 192.168.3.0 0.0.0.255

access-list 101 permit ip 192.168.0.0 0.0.255.255 any

Router B

crypto isakmp policy 10

hash md5

authentication pre-share

!

crypto isakmp key vpnuser address 38.1.10.1

!

!

!

crypto ipsec transform-set myset esp-des esp-md5-hmac

!

crypto map mymap 10 ipsec-isakmp

set peer 38.1.10.1

set transform-set myset

match address ann

!

!

!

!

!

!

spanning-tree mode pvst

!

!

!

!

!

!

interface FastEthernet0/0

ip address 38.2.10.1 255.255.255.0

ip nat outside

duplex auto

speed auto

crypto map mymap

!

interface FastEthernet0/1

ip address 192.168.2.1 255.255.255.0

ip nat inside

duplex auto

speed auto

!

interface Vlan1

no ip address

shutdown

!

ip nat inside source list 101 interface FastEthernet0/0 overload

ip classless

ip route 0.0.0.0 0.0.0.0 38.2.10.2

!

ip flow-export version 9

!

!

ip access-list extended ann

permit ip 192.168.2.0 0.0.0.255 192.168.9.0 0.0.0.255

access-list 101 remark == [Control NAT Service]==

access-list 101 deny ip 192.168.2.0 0.0.0.255 192.168.9.0 0.0.0.255

access-list 101 permit ip 192.168.0.0 0.0.255.255 any

Router C

crypto isakmp policy 1

hash md5

authentication pre-share

!

crypto isakmp key vpnuser address 38.1.10.1

!

!

!

crypto ipsec transform-set myset esp-des esp-md5-hmac

!

crypto map mymap 1 ipsec-isakmp

set peer 38.1.10.1

set transform-set myset

match address ann

!

!

!

!

!

!

spanning-tree mode pvst

!

!

!

!

!

!

interface FastEthernet0/0

ip address 42.10.1.2 255.255.255.0

ip nat outside

duplex auto

speed auto

crypto map mymap

!

interface FastEthernet0/1

ip address 192.168.3.1 255.255.255.0

ip nat inside

duplex auto

speed auto

!

interface Vlan1

no ip address

shutdown

!

ip nat inside source list 101 interface FastEthernet0/0 overload

ip classless

ip route 0.0.0.0 0.0.0.0 42.10.1.1

!

ip flow-export version 9

!

!

ip access-list extended ann

permit ip 192.168.3.0 0.0.0.255 192.168.9.0 0.0.0.255

access-list 101 remark == [Control NAT Service]==

access-list 101 deny ip 192.168.3.0 0.0.0.255 192.168.9.0 0.0.0.255

access-list 101 permit ip 192.168.0.0 0.0.255.255 any

[Richard Bradfield]

can you try  a different PSK for each site. And is the routing setup correctly in your simulated Internet?

[rbelusko1]

Hi Richard,

I changed the key to on the 192.168.3.0/24 tunnel but it didn't fix this. Yes, I am certain that my internet simulation is correct as both endpoints can ping each other and they are on different networks.

This is what happens from the main router when I initiate pings. One is always "MM_NO_STATE", but it's always the 2nd tunnel I bring up, regardless of which site.

BobRouter01#show crypto isakmp sa

IPv4 Crypto ISAKMP SA

dst src state conn-id slot status

42.10.1.2 38.1.10.1 QM_IDLE 1028 0 ACTIVE

38.2.10.1 38.1.10.1 MM_NO_STATE 0 0 ACTIVE (deleted)

[Richard Bradfield]

I know on older versions of IOS ( what is yours?) that need the no-xauth added to the crypto isakmp key as below

crypto isakmp key vpnuser address 38.2.10.1 no-xauth

crypto isakmp key vpnuser address 42.10.1.2 no-xauth

[rbelusko1]

Hi guys,

Just to provide some closure here, I have figured this out. I was able to reproduce this several times with a restart of Packet Tracer in between so I now it's working for sure now.

I made two changes:

1) I added a second ISAKMP policy with a different encryption method to each of the 3 routers with, each with unique ID. (I was previously unaware that isakmp is a global policy that is not tied to a specific crypto map).

2) I WAITED and let the pings run for about 20 minutes, and finally the 2nd tunnel came up.

I think the solution was #2. It seems that perhaps it just took some time for that second tunnel to establish itself, regardless if the 2nd tunnel was 192.168.2.x or 192.168.3.x. I am not sure why...

Thanks

Bob