site-site vpn

[M Mohammed]

trying to configure isakmp policy but cant see the option, please see below

fw/pri/act(config)# crypto isakmp ?

configure mode commands/options:
disconnect-notify Enable disconnect notification to peers
identity Set identity type (address, hostname or key-id)
nat-traversal Enable and configure nat-traversal
reload-wait Wait for voluntary termination of existing connections
before reboot

can't find the policy command

please advise

[GioGonza]

Hello @M Mohammed, 

For newer versions the command is with IKE, something like this: 

crypto ikev1/ikev2 policy ..

Try this and let me know. 

HTH

Gio

[M Mohammed]

Many thanks G

i have already used the below config, but still the vpn is not coming up

and when i check sh crypto ipsec sa nothing is showing up

crypto ikev1 policy 201
authentication pre-share
encryption aes
hash sha
group 2
lifetime 28800

does it have to be the ikev1 on the other end or they can have ISAKMP POLICY on their end?

[GioGonza]

Hello @M Mohammed, 

ISAKMP and IKEv1 are the same it doesn´t matter which one you have configured on your ASA and the other end, if the VPN tunnel doesn´t come up then turn on the debugs and let´s see what is happening: 

debug crypto ikev1 250

debug crypto ipsec 250

Share the outputs and let´s for from there. 

HTH

Gio

[M Mohammed]

HI @GioGonza,

there is no output after running those commands.

[Richard Burts]

If there is no output then it is likely that something in your config is not right. Can you post all the crypto parts of the config and perhaps we can help find the problem.

HTH

Rick

[M Mohammed · Accepted solution]

@Richard Burts, many thanks

crypto map was not enabled for outside interface, it is up now.

[Richard Burts]

Thank you for posting back to the forum and letting us know that you have fixed the problem. I am glad that our suggestions guided you toward identifying and fixing the problem.

HTH

Rick