VPN between CISCO ISR4321 and CISCO1941

piotr.szymanski · ‎04-18-2017

Hi,

I am trying to set up a L2L between copuple Cisco routers (ISR4321 and 1941). In one of sites I try to replace old 1941 to new ISR4321 but I can't to connect to other sites. Three of tunnels was able to connected but others didn't. In debug mode was something like this:

Apr 14 13:33:47.531: ISAKMP-PAK: (0):received packet from 212.180.XXX.YYY dport 500 sport 500 Global (R) MM_SA_SETUP
Apr 14 13:33:47.531: ISAKMP: (0):phase 1 packet is a duplicate of a previous packet.
Apr 14 13:33:47.531: ISAKMP: (0):retransmitting due to retransmit phase 1
Apr 14 13:33:48.031: ISAKMP: (0):retransmitting phase 1 MM_SA_SETUP...
Apr 14 13:33:48.031: ISAKMP: (0):: incrementing error counter on sa, attempt 1 of 5: retransmit phase 1
Apr 14 13:33:48.031: ISAKMP: (0):retransmitting phase 1 MM_SA_SETUP
Apr 14 13:33:48.031: ISAKMP-PAK: (0):sending packet to 212.180.XXX.YYY 210 my_port 500 peer_port 500 (R) MM_SA_SETUP

And finaly got MM_NO_STATE

The configutration on ISR4321 (crypto map, peer, etc.) is the same as in the old router

Any help or advise will be greatly appreciated!

Regards

Philip D'Ath · ‎04-20-2017

There is not enough of the log to determine the issue. We also need the log from both ends while the issue is happening. We need both the ikev1/isakmp and ipsec debugging enabled.