Hi, I have a some ikev1 ipsec tunnels to remote locations and we are replacing our 3945s with 8300s. The issue is that we are currently using a ipsec transform-set with both ah and esp. IOS-XE does not support that. The goal is to configure the remote router locally, ship it, and then have on-site support physically install and then move the cables over. The hope was to use the same VPN tunnel configs on the local router and when the new remote router was connected the tunnel would come just come up. Unfortunately our current tunnel is using a ipsec transform-set of: ah-sha256-hmac esp-aes 256 esp-sha256-hmac.
Is there anyway to get the tunnel up on my new router while the local retains its current config?
current crypto 3945 configs:
crypto isakmp policy 10
encr aes 256
hash sha256
authentication pre-share
group 14
crypto isakmp key XXXXX address xxx.xxx.xxx.xxx
crypto ipsec transform-set xxxxxx ah-sha256-hmac esp-aes 256 esp-sha256-hmac
mode tunnel
crypto map xxxx 20 20 ipsec-isakmp
set peer xxx.xxx.xxx.xxx
set transform-set xxxxxx
set pfs group14
match address 123
