Encryption between agent & core

Similar Questions

• Level of encryption between Wyse ThinOS and VMware View desktop

  Can someone help me determine the level of encryption between my Wyse thin clients and virtual desktops.

  I use the latest Wyse ThinOS and VMware View connection Server 4.0.

  I have a manual desktop pool configured with things THAT RDP disabled. I'm also using smart card authentication.

  With direct disabled RDP is a configuration of SSL tunnel for the connection to the server and the RDP session to the virtual desktop by tunnel through this SSL connection?

  Yes that's right, although strictly that you should say server/connection security as if you use a security server, then this is endpoint of the tunnel rather than the CS.

• VMotion between single core and dual core

  I have 2 Dell PE 6850's and according to the table of vmotion for cpu dell, they are compatible. But now the question is is there a problem if one of the servers has 4 core processors and the other has 4 duel procs and HA works correctly?

  If the processors are compatible vmotion, then you will be fine.  ESX is NUMA aware, so that he knows the difference between a core and a CPU socket and the implications of the memory of the two.

  -KjB

• Difference between vCPU & Core

  Hello

  I have a query in which I would like to know the conversion of physical to virtual server in the case of CPU

  -Difference between 2 vCPU and 1 vCPU & 1 kernel, 2 carrots, in terms of performance etc...

  -Also in the case of physical server with 2 physical processors and 8 virtual processors [4 virtual by UC] physical what will be the value creating virtual machines

  Please suggest

  Thank you

  Fox

  -Difference between 2 vCPU & 1 core & 1 vCPU 2 carrots, in terms of performance etc...

  Basically, it's a guest operating system compatibility and/or licensing examination that you are configuring. In both cases the virtual machine will be scheduled on two physical cores.

  -Also in the case of physical server with 2 processors and physical 8 virtual physical CPU [4 virtual by UC] what will be the value creating

  As much as necessary, but start down. Often physical hardware is oversized (it's actually one of the reasons for virtualization). If you discover that the VM does not expected and it is caused by the CPU, then you can always add additional vCPUs/core later. With the addition of too many vCPUs you likely to affect the physical set system and all the VMS on it.

  André

• Algorithms of different SSL encryption between 5525 x and x 5555?

  Good afternoon

  I have an ASA 5525 x and an ASA 5555 x.  Both of them run 9.4 (2.6).

  5525 x supports all the new encryptions that are discussed in the notes.

  lab-asa5525x# sh ssl ciphersCurrent cipher configuration:default (fips): ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-GCM-SHA384 DHE-RSA-AES256-GCM-SHA384 AES256-GCM-SHA384 ECDHE-ECDSA-AES256-SHA384 ECDHE-RSA-AES256-SHA384 DHE-RSA-AES256-SHA256 AES256-SHA256 ECDHE-ECDSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-GCM-SHA256 DHE-RSA-AES128-GCM-SHA256 AES128-GCM-SHA256 ECDHE-ECDSA-AES128-SHA256 ECDHE-RSA-AES128-SHA256 DHE-RSA-AES128-SHA256 AES128-SHA256 DHE-RSA-AES256-SHA AES256-SHA DHE-RSA-AES128-SHA AES128-SHAtlsv1 (fips): DHE-RSA-AES256-SHA AES256-SHA DHE-RSA-AES128-SHA AES128-SHAtlsv1.1 (fips): DHE-RSA-AES256-SHA AES256-SHA DHE-RSA-AES128-SHA AES128-SHAtlsv1.2 (custom): ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256 ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES256-SHA384 ECDHE-ECDSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES128-SHA256dtlsv1 (fips): DHE-RSA-AES256-SHA AES256-SHA DHE-RSA-AES128-SHA AES128-SHAlab-asa5525x# lab-asa5525x# sh runn all sslssl server-version tlsv1.2ssl client-version tlsv1.2ssl cipher default fipsssl cipher tlsv1 fipsssl cipher tlsv1.1 fipsssl cipher tlsv1.2 custom "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256"ssl cipher dtlsv1 fipsssl dh-group group24ssl ecdh-group group20ssl trust-point 2016-03.lab-asa Outsidessl certificate-authentication fca-timeout 2lab-asa5525x# 

  5555 x does not support encryption of elliptical curve which are discussed in the notes.

  ASA5555x-01# sh ssl ciphersCurrent cipher configuration:default (medium): DHE-RSA-AES256-SHA256 AES256-SHA256 DHE-RSA-AES128-SHA256 AES128-SHA256 DHE-RSA-AES256-SHA AES256-SHA DHE-RSA-AES128-SHA AES128-SHA DES-CBC3-SHAtlsv1 (medium): DHE-RSA-AES256-SHA AES256-SHA DHE-RSA-AES128-SHA AES128-SHA DES-CBC3-SHAtlsv1.1 (medium): DHE-RSA-AES256-SHA AES256-SHA DHE-RSA-AES128-SHA AES128-SHA DES-CBC3-SHAtlsv1.2 (medium): DHE-RSA-AES256-SHA256 AES256-SHA256 DHE-RSA-AES128-SHA256 AES128-SHA256 DHE-RSA-AES256-SHA AES256-SHA DHE-RSA-AES128-SHA AES128-SHA DES-CBC3-SHAdtlsv1 (medium): DHE-RSA-AES256-SHA AES256-SHA DHE-RSA-AES128-SHA AES128-SHA DES-CBC3-SHAASA5555x-01# ASA5555x-01# sh runn all sslssl server-version tlsv1.2ssl client-version tlsv1.2ssl cipher default mediumssl cipher tlsv1 mediumssl cipher tlsv1.1 mediumssl cipher tlsv1.2 mediumssl cipher dtlsv1 mediumssl dh-group group2ssl ecdh-group group19ssl trust-point 2016-03.ssl-vpn Outside_85ssl certificate-authentication fca-timeout 2ASA5555x-01# 

  I opened a case of TAC and 5585 9.4 (2.6) also running of the TAC engineer does not support encryption EC? Can someone help me understand what Miss me? X - platforms ASA should support the same features, right? Thank you Tim

  Hello

  Disable the Anyconnect essentials from the setting global webvpn, toured here.

  CLI:

  WebVPN

  No anyconnect essentials

  Thank you

• See Express Core cannot connect to the router UCM IM & P. XMPP: inactive

  I'll put up a teleconference environment (10.5 CUCM/IMP) with a few G2 MX300, SX20 and many Jabber clients. The solution is the new Express Core/Edge.

  It seems that I can't seem to make the core of the highway to connect to Unified Communications and more specifically with my presence and IM UCM environment. Everything is correctly configured in the Configuration > Unified Communications section. I see that the connection to the AAU itself is active but not at UCM MI of the P & I see the error "router XMPP: inactive.

  Each server name can be resolved by DNS, so there is no problem with that. Channel Express is in the same subnet (switch) with the AAU and AAU IM & P. passwords are configured corretly. There is not enable encryption between UCM IM & P and the core of the highway.

  Am I missing something? What I have to do additional configuration for the side IM & P? Can someone help me? I enclose some screenshots of my environment.

  Thank you, Stefanos

  Hi stavropouloss,

  So that the service becomes active, you will need to have the area between Highway C & E active.

  To have C & E traversal Expressway area active you should download on each server certificate signed by a trusted CA authority.

  Documentation on how to generate can be found here: http://www.cisco.com/c/dam/en/us/td/docs/voice_ip_comm/expressway/config...

  At soon buddy.

• Endpoint Agent vCAC 6.0 error!

  
  

  Dear Sirs,

  
  

  I have a question Agent wirth in vCAC 6.0, installation finished OK, but when I try to add a tissue of seeds of available computing resources, check my installation vCAC I noticed in the Agent connects to this entry, I try to reinstall the Agent but the error seems to happen again, any help will be appreciated!
  

  
  

  [Debug]: from Ping report

  [Debug]: this exception has been taken:

  System.Net.WebException: The request failed with HTTP 400 State: bad request.

  at System.Web.Services.Protocols.SoapHttpClientProtocol.ReadResponse (SoapClientMessage message, WebResponse response, Stream responseStream, Boolean asyncCall)

  at System.Web.Services.Protocols.SoapHttpClientProtocol.Invoke (String methodName, Object [] parameters)

  at VMware.vSphere.VimService.RetrieveServiceContent (ManagedObjectReference _this)

  at DynamicOps.Vrm.Agent.vSphere.VSphereSession.Connect (String username, String password)

  at DynamicOps.Vrm.Agent.vSphere.VSphereHypervisorServiceProvider.GetComputeResources (ManagementEndpoint managementEndpoint)

  at DynamicOps.Vrm.Agent.vSphere.VSphereAgentService.GetHostClusterList)

  at DynamicOps.Vrm.Agent.Core.VRMCoreAgent.SendPingReport)

  at DynamicOps.Vrm.Agent.Core.CoreAgentBase.SendPingReportLoop (Object sender, ElapsedEventArgs e)

  [Error]: <? XML version = "1.0" encoding = "utf-16"? >

  < Boolean > false < / Boolean >

  This exception has been taken:

  System.Net.WebException: The request failed with HTTP 400 State: bad request.

  at System.Web.Services.Protocols.SoapHttpClientProtocol.ReadResponse (SoapClientMessage message, WebResponse response, Stream responseStream, Boolean asyncCall)

  at System.Web.Services.Protocols.SoapHttpClientProtocol.Invoke (String methodName, Object [] parameters)

  at VMware.vSphere.VimService.RetrieveServiceContent (ManagedObjectReference _this)

  at DynamicOps.Vrm.Agent.vSphere.VSphereSession.Connect (String username, String password)

  at DynamicOps.Vrm.Agent.vSphere.VSphereHypervisorServiceProvider.GetComputeResources (ManagementEndpoint managementEndpoint)

  at DynamicOps.Vrm.Agent.vSphere.VSphereAgentService.GetHostClusterList)

  at DynamicOps.Vrm.Agent.Core.VRMCoreAgent.SendPingReport)

  at DynamicOps.Vrm.Agent.Core.CoreAgentBase.SendPingReportLoop (Object sender, ElapsedEventArgs e)

  
  

  More information, no FW between vCAC IaaS server and vCenter Server and vCAC VAPP and identity VAPP.
  

  
  

  Thank you!

  vRay
  

  Hello Peetam thanks for the answer.

  Here is my solution:

  This error makes reference to the bad connection to Agent, given that this Agent is installed on a different computer, virtual, I try to install an Agent in the same virtual machine as the server, Iaas and connection will be locally but trying to reach the VM for IaaS fqdn, it does not yet, I guess because there was something in relation to safety but no t properly a firewall something as Ironport or something (don't really know that they tell me everything) this device works as a firewall nextgen having a King of the policy of blocking agent connection/communication on network somehow, so I kindly ask (not really) security guys after thousands of approvals to let this VMs out of this policy After that everything works OK.

• I don't have any encryption under the options tab. This can be corrected? If this is not the case, how could access it?

  When I go to Options on the Advanced tab, there is no encryption between update tab and certificates. How would access the encryption info?

  There is no encryption tab in current versions of Firefox.

  The current releases of Firefox no longer have a setting in the user interface to disable TLS or SSL3 and you must make the change on the subject: config page and edit two prefs.
  
  SSL3 is enabled by default in the current version of Firefox (security.tls.version.min = 0) and TLS to TLS 1.2 versions (security.tls.version.max = 3).

  You can change the preferences of security.tls.version.min and security.tls.version.max to define what TLS versions are enabled.

  You will need to close and restart Firefox after you change these prefs.

  security.tls.version.min = 0 (1 will disable SSL3 and only enable TLS)
  security.tls.version.max = 2 (0 will disable TLS 1.0 and higher, leaving only SSL3 enabled)
  

  • http://KB.mozillazine.org/security.TLS.version. *

  0 means SSL 3.0, 1 means TLS 1.0, 2 means TLS 1.1, 3 means TLS 1.2 etc.
  

• 13 Firefox works in multithreaded mode and it can use the quad-core processors?

  When you buy a new PC, we choose between dual core vs quad core processors, and some people claim that Firefox work mode multithreaded mulch and treats each tab in a separate process and may fully use the advantage of a quad-core processor. Is this true?

  Firefox does not treat each tab in a separate process. If this can be a function in the future, I don't know of any plans to introduce any time soon. Obviously, buying a quad core processor will be significantly faster than a dual core, and your browser is usually less consume a lot of resources than other programs. I would not use it as your buying decision. Firefox will work just as well on a dual-core or a quad-core, but windows and other programs will work better with 4 cores.

• Jabber client - encryption of VCS Expressway with MRA

  Hi all

  I'm working on the implementation of MRA for a video solution existing. Version CUCM is 9.1.2 (no IM & P server), vcs - c and vcs-e 8.2.2.  Client Jabber is 11.5.x

  I finished most of the introduction and I am able to call internally and externally through MRA.

  I still have a few things to tweak.  One is the encryption of video calling once jabber connects from outside.  From my understanding, the thigh jabber call end point and VCS Expressway uses TLS. But when I run wireshark on the PC with Jabber client, I don't see the RTP stream as being encrypted.

  CUCM my jabber device does not use a secure profile.  Is it ok or not?

  Please let me know if more are needed.  Thank you

  You can confirm the call is encrypted from the client of jabber MRA by doing as follows (I used 11.5 jabber client, if you are using an older client, I can't guarantee this method):

  1. make a call from the client jabber ARM, once the call is configured and media is established, you can end the call.
  2. create a jabber client problem report (help > report a problem...)
  3. Enter the required details and save the .zip file.
  4 extract the file "jabber.log" from the .zip file. Since this file (at least since the version of client jabber 11.5) has the SIP messaging included in this document, you can use TranslatorX to view the file (you can also use a text editor if you wish).
  5 generate a diagram of the log file.

  translatorx - 01.png

  

  6. in the diagram of the scale, you should be able to locate the origin of the call. Search for an invitation, in my case a "RE-INVITE" and select it. A pop-up window will appear with the details of the SIP message.

  translatorx - 02.png

  

  7. read the content of the message prompt of the SIP protocol (focusing on the SDP - the component of negotiating media). I won't go into detail about how to read SIP messages (there's a good article here, it is not for jabber specifically, but the same concepts apply).

  translatorx - 03.png

  

  8. close the prompt message and open the message 'OK w/SDP' to examine the response of the VCS-E. The SDP response, we can confirm that the encryption settings have been accepted for the media (media will be encrypted).

  translatorx - 04.png

  

  For re - apply point Jamie, unless you run CUCM in mixed mode and using security profiles, signalling/media encryption stops on the thigh of CUCM/endpoint and the VCS - C respectively. See the diagram below for reference (mixed mode not implemented).

  MRA-media - flow.png

  

  You need not applied to the device of CSF security profiles to obtain the encryption between the client of jabber MRA and the VCS-E. If you can decode signaling and media packets in Wireshark your jabber client, you probably will not connect via ARM (ARM is always encrypted).

  Please let us know if that helps.

  -Jon

• LAN-to-LAN tunnel between VPN 3000 and Cisco 1721

  Hello

  I have a current LAN-to-LAN tunnel configuration between VPN 3000 (3.6) and Cisco 1721 (12.2 (11) T).

  When I use the encryption = authentication and Des-56 = ESP\MD5\HMAC-128 for the IPSec Security Association, everything works fine.

  However, I would like to Turn off encryption for some time getting the speed improvements, so I changed

  Encryption = null esp (in 1721) and to "null" in VPN-3000.

  Now the tunnel is setup but I can spend only ICMP traffic. When I pass the traffic UDP\TCP the message below appears the Cisco 1721

  % C1700_EM-1-ERROR: error in packet-rx: pad size error, id 75, hen offset 0

  Has anyone seen this behavior?

  All those put in place an IPSec Tunnel with only the ESP authentication and NO encryption between VPN-3000 and Cisco 1721?

  Thanx------Naman

  Naman,

  Disable you the vpn Accelerator? "no accel crypto engine. Sure that you can't do with a null module vpn.

  Kurtis Durrett

• router to router 2821 encryption

  How to secure this scenerio?

  (1) site A has a 2821 router and an IP connection to the site C. 2821 on another organizations IP network.

  (2) site B has a router 2821 with an MPLS connection at the site of the C-2821.

  It's pretty easy to connect and get plain text connections and tunnels WILL work, but I'm leaving my network open to other agencies or MPLS service provider.

  I think little flavor of encryption between routers with tunnels GRE routes real traffic.

  Thank you in advance for recommendations and examples of config.

  Hi Tod,

  You can deploy a separate acl on the physical interface, which allows only the tunnel itself (udp/500 and esp). The ACL in the VTI would control the traffic through the tunnel.

  Rgds,

  MiKa

• Encryption: "Apply crypto map interface.

  East - the best forum to discuss encryption?

  I want to implement a single aes encryption between an ISDN Bri1/0 port on a 2611xm and a 2811.

  I want to encrypt everything except telnet on the ISDN link between these routers. I want to telent between routers just in case the encryption locks himself. This is my requirement of customers.

  Question #1: Should I contact the card encryption the Ethernet port (as I have seen in many examples) or on the ISDN connection?

  Question #2: If I ask the encryption card to the ISDN connection, should I do the encryption the BRI port card or the dialer?

  Question #3: Assuming that both routers and all segments use the 10.0.0.0 network and are not connected to what anyone else, the following access list would work?

  access list 110

  deny ip any eq telnet

  allow an ip

  Thank you

  Mark

  Hi Mark,

  Apply the card encryption to your outgoing interface (Dialer)

  You probably will lock the router by putting

  an ip address allowed any one in your crypto access list

  you have probably even to add telnet deny entry in your access list if you are ready to open your session to the router

  I suggest you

  extended to remote IP access list

  deny ip any eq telnet

  ip licensing 10.0.1.0 0.0.0.255 10.0.2.0 0.0.0.255

  The remote site would have a mirror

  social-seat extended IP access list

  deny ip any eq telnet

  IP 10.0.2.0 allow 0.0.0.255 10.0.1.0 0.0.0.255

• Packages that do not receive encryption and decrypt IPSEC

  Hello world

  I have 2691 conencted to the Internet router and it does NAT.

  This connects to the 3550A shift that has the connection to the router 1811W.

  I have VPN installation between 1811W and 3550.

  3550 has connection to 2691 via ospf.

  OSPF is running between 1811w and 3550.

  1811

  1811w # sh crypto isakmp his

  IPv4 Crypto ISAKMP Security Association

  DST CBC conn-State id

  192.168.99.2 192.168.99.1 QM_IDLE 2005 ASSETS

  IPv6 Crypto ISAKMP Security Association

  1811w # sh crypto ipsec his

  Interface: FastEthernet0

  Tag crypto map: VPN_MAP, local addr 192.168.99.1

  protégé of the vrf: (none)

  local ident (addr, mask, prot, port): (192.168.0.0/255.255.0.0/0/0)

  Remote ident (addr, mask, prot, port): (192.168.99.0/255.255.255.0/0/0)

  current_peer 192.168.99.2 port 500

  LICENCE, flags is {origin_is_acl},

  #pkts program: encrypt 0, #pkts: 0, #pkts digest: 0

  #pkts decaps: 0, #pkts decrypt: 0, #pkts check: 0

  compressed #pkts: 0, unzipped #pkts: 0

  #pkts uncompressed: 0, #pkts compr. has failed: 0

  #pkts not unpacked: 0, #pkts decompress failed: 0

  #send 30, #recv errors 0

  local crypto endpt. : 192.168.99.1, remote Start crypto. : 192.168.99.2

  Path mtu 1500, mtu 1500 ip, ip mtu IDB FastEthernet0

  current outbound SPI: 0x0 (0)

  PFS (Y/N): N, Diffie-Hellman group: no

  SAS of the esp on arrival:

  the arrival ah sas:

  SAS of the CFP on arrival:

  outgoing esp sas:

  outgoing ah sas:

  outgoing CFP sas:

  3550A

  3550SMIA # sh crypto isakmp his

  IPv4 Crypto ISAKMP Security Association

  status of DST CBC State conn-id slot

  192.168.99.2 192.168.99.1 QM_IDLE 1001 ACTIVE

  IPv6 Crypto ISAKMP Security Association

  3550SMIA #sh cry

  3550SMIA #sh crypto ipsec his

  Interface: FastEthernet0/8

  Tag crypto map: VPN_MAP, local addr 192.168.99.2

  protégé of the vrf: (none)

  local ident (addr, mask, prot, port): (192.168.0.0/255.255.0.0/0/0)

  Remote ident (addr, mask, prot, port): (192.168.99.0/255.255.255.0/0/0)

  current_peer 192.168.99.1 port 500

  LICENCE, flags is {origin_is_acl},

  #pkts program: encrypt 0, #pkts: 0, #pkts digest: 0

  #pkts decaps: 0, #pkts decrypt: 0, #pkts check: 0

  compressed #pkts: 0, unzipped #pkts: 0

  #pkts uncompressed: 0, #pkts compr. has failed: 0

  #pkts not unpacked: 0, #pkts decompress failed: 0

  #send 15, #recv errors 0

  local crypto endpt. : 192.168.99.2, remote Start crypto. : 192.168.99.1

  Path mtu 1500, ip mtu 1500

  current outbound SPI: 0x0 (0)

  SAS of the esp on arrival:

  the arrival ah sas:

  SAS of the CFP on arrival:

  outgoing esp sas:

  As we have seen more top packets are not encrypted between 1811w and 3550.

  I used the same ACLs on 1811W and 3550A

  INTERESTING_TRAFFIC extended IP access list

  IP 192.168.0.0 allow 0.0.255.255 192.168.99.0 0.0.0.255 connect

  Reasons why packages do not encrypt and decrypt?

  Thank you

  MAhesh

  Hello

  Access-list for interesting traffic should be mirrored.

  Best regards

  Eugene

• IPsec VPN between two routers - mode ESP Transport and Tunnel mode

  Hi experts,

  I have this question about the Transport mode and Tunnel mode for awhile.

  Based on my understanding of 'Transport' mode is not possible because you always original "internal" private in the IP headers or IP addresses. They are always different as public IP on interfaces enabled with Crypto Card addresses. When encapsulated in the VPN tunnel, the internal IP addresses must be included or the remote VPN router won't know where to forward the packet.

  To test, I built a simple GNS3 with three routers laboratory. R1 and R3 are configured as VPN routers and the R2 must simulate Internet.

  My configs are also very basic. The R2 is routing between 1.1.1.0/24 and 2.2.2.0/24. It is defined as the gateway of R1 and R3.

  R1:

  crypto ISAKMP policy 100
  BA aes
  preshared authentication
  Group 2
  ISAKMP crypto key 123456 address 2.2.2.2
  !
  Crypto ipsec transform-set ESP_null null esp esp-sha-hmac
  !
  10 map ipsec-isakmp crypto map
  defined peer 2.2.2.2
  transformation-ESP_null game
  match address VPN

  !

  list of IP - VPN access scope
  ip permit 192.168.1.0 0.0.0.255 10.0.0.0 0.0.0.255
  !

  R3:

  crypto ISAKMP policy 100
  BA aes
  preshared authentication
  Group 2
  ISAKMP crypto key 123456 address 1.1.1.2
  !
  !
  Crypto ipsec transform-set ESP_null null esp esp-sha-hmac
  !
  10 map ipsec-isakmp crypto map
  defined peer 1.1.1.2
  transformation-ESP_null game
  match address VPN

  !

  list of IP - VPN access scope
  Licensing ip 10.0.0.0 0.0.0.255 192.168.1.0 0.0.0.255

  I configured transform-"null" value, while it will not encrypt the traffic.

  Then I tried the two 'transport' mode and mode "tunnel". I ping a host in the internal network of the R1 to another host in the internal network of the R3. I also tried 'telnet'. I also captured packets and carefully compared in both modes.

  Packets encapsulated in exactly the same way!

  It's just SPI + sequence No. + + padding

  I will attach my screenshots here for you guys to analyze it. I would be grateful for any explanation. I confused maybe just when it comes to the NAT...

  I guess my next step is to check if the two modes to make the difference when the GRE is used.

  Thank you

  Difan

  Hi Difan,

  As you point out the mode of transport is not always applicable (i.e. applicable if IP source and destination is equal to corresnpoding proxy IDs).

  A typical scenario in this mode of transport is used:

  -Encryption between two hosts

  -GRE tunnels

  -L2TP over IPsec

  Even if you set "transport mode" this does not mean that it will be used. IOS routers and I blieve also ASA will perform backup even if the mode of transport is configured but does not apply in tunnel mode.

  I can take a look at your traces to sniff, but all first can you please check if you transport mode on your ipsec security associations? "See the crypto ipsec his" exit you will show the tunnel or transport mode.

  HTH,

  Marcin