08-01-2012 12:16 PM
I had to edit an ACL on an active S2S VPN today because traffic was being denied from a host onsite to a host on the remote site (port 449). After I made the change, we tried to make the connection again, but it was still denied. Do we need to tear down the S2S vpn for the change to the ACL to take effect?
Also, what if we just wait for the connection to rekey itself? Will it work after that?
TIA.
Dan
08-01-2012 09:58 PM
Hi Dan,
Please use the "crypto ipsec sa peer xxxx.xxxx.xxxx.xxxx" command to renegotiate Phase II, it is the recommended action.
Let me know.
Please rate any post you find useful.
08-01-2012 11:14 PM
Hi Dan,
Kindly use the 'clear crypto sa peer a.b.c.d' command. Make sure you've got 'mirrored' crypto ACL on both ends of the VPN. Also, make use of the 'debug crypto' commands to dig deeper.
Sent from Cisco Technical Support iPhone App
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide