I am trying to connect a L2L VPN using a PIX 515 and a 3005. I have the configurations set but am getting this result for the sh crypto ipsec sa which shows that traffic is received but not sent.
Crypto map tag: xxxxx, local addr. x.x.x.x
local ident (addr/mask/prot/port): (x.x.x.x/255.255.0.0/0/0)
remote ident (addr/mask/prot/port): (x.x.x.x/255.255.0.0/0/0)
current_peer: xxx.xxx.xxx.xxx
dynamic allocated peer ip: 0.0.0.0
PERMIT, flags={origin_is_acl,}
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest 0
#pkts decaps: 892, #pkts decrypt: 892, #pkts verify 892
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0
local crypto endpt.: xxx.xxx.xxx.xxx, remote crypto endpt.: xxx.xxx.xxx.xxx
path mtu 1500, ipsec overhead 56, media mtu 1500
current outbound spi: 4ada3bee
inbound esp sas:
spi: 0xd84f6f1(226817777)
transform: esp-des esp-md5-hmac ,
in use settings ={Tunnel, }
slot: 0, conn id: 2, crypto map: xxxxx
sa timing: remaining key lifetime (k/sec): (4607971/27993)
IV size: 8 bytes
replay detection support: Y
Along with this I have also seen this entry in the 3000 log file.
55031 02/18/2005 08:32:58.050 SEV=4 BMGT/29 RPT=11
Attempting to specify an Aggregate Group reservation [ 961150977 bps ] on Group
[ x.x.x.x ] Interface [ 2 ] which is outside the range of a minimum of [ 80
00 bps ] to a maximum of [ 100000000 bps ] (note: the true max is dependant upon
the interface link rate to which the group is applied).
I do NOT have BW management enabled on the 3005 and was wondering if anyone could point me in the right direction for fixing this issue. My 3000 is sending traffic but the PIX is not.
Thanks,
Terry
