Hello,
I was testing a particular configuration with dynamic maps for soho routers and it worked well... see this post for the conf: https://supportforums.cisco.com/message/3265755
Since a few days I'm trying to port this configuration on a productive appliance (ASA5510 - v8.22) and it's not working.
The only difference is that the ASA5510 is already configured to allow access to users with vpn client.
The Zyxel router is telling this: (read it from bottom to up)
Send<:[HASH][DEL]>
Recv<:[HASH][NOTFY:NO_PROP_CHOSEN]>
Send<:[HASH][SA][NONCE][ID][ID]>
Start Phase 2: Quick Mode
Phase 1 IKE SA process done
The show isa sa on the ASA it telling this:
IKE Peer: ***.***.***.***
Type : L2L Role : responder
Rekey : no State : AM_WAIT_MSG3
And this is a piece of the conf:
crypto ipsec transform-set trmset1 esp-aes-256 esp-sha-hmac
crypto ipsec transform-set dynset esp-3des esp-md5-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map map2 10 set transform-set trmset1
crypto dynamic-map map2 10 set security-association lifetime seconds 28800
crypto dynamic-map map2 10 set security-association lifetime kilobytes 4608000
crypto dynamic-map DN3710 2 match address ST_3710
crypto dynamic-map DN3710 2 set transform-set dynset
crypto map yyymap 10 ipsec-isakmp dynamic map2
crypto map yyymap 11 ipsec-isakmp dynamic DN3710
crypto map yyymap interface outside
crypto isakmp enable outside
crypto isakmp policy 1
authentication pre-share
encryption 3des
hash md5
group 1
lifetime 86400
crypto isakmp policy 2
authentication pre-share
encryption 3des
hash md5
group 2
lifetime 86400
crypto isakmp policy 10
authentication pre-share
encryption aes-256
hash sha
group 2
lifetime 86400
crypto isakmp policy 65535
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
I can't figure out where the problem is. Any idea will be appreciated!!!
Thanks in advance for a help.
Regards,
Luca
