GET VPN - error on the key server

Hello:
When I apply a Crypto GDOI card to outgoing interface on the KEY SERVER, I see the following error message:

* 1 sep 19:46:07.707: % SYS-3-MGDTIMER: uninitialized timer, set_exptime, timer = 493007 B 8. -Process = "Exec", PW = 0, pid = 202, - traceback = 0x43220180z 0x43E49EA0z 0x43D8A89Cz 0x43DAE5DCz 0x43D907BCz 0x419ACEC4z 0x419D2F4Cz 0x43215824z 0x43215808z

This causes the crypto isakmp phase I to come. There are also IPsec SA of Phase II on the Member of the Group and is to encapsulate traffic. However, on the key server, I don't see that any SA Phase II IPSec defined.

I checked the same behavior on two different IOS routers acting as a key server.

2801 > sh ver

Cisco IOS software, 2801 Software (C2801-ADVSECURITYK9-M), Version 12.4 (24) T4, VERSION of the SOFTWARE (fc2)

2811 > sh ver

Cisco IOS software, 2800 Software (C2800NM-ADVIPSERVICESK9-M), Version 12.4 (24) T4, VERSION of the SOFTWARE (fc2)

I have generated RSA key pairs, defined in the ACL mirrored, static routes, isakmp, ipsec (including the transformation game) etc. correctly profile. The configs for the Group GDOI is as follows:

gdoi crypto group GDOI

Identification number 1

local server

generate a new passkey mypubkey rsa GDOI

generate a new key transport unicast

1.1.1.1 ipv4 address (interface WAN IP)

his 10 ipsec

match address ipv4 GDOI

Profile GDOI

!

card crypto GDOI 10 gdoi

set the Group GDOI

!

It was working a week ago and just started to happen. It is an off-production area. I'm stumped and looking for someone with answers. I don't see problems on BugKit tool from CISCO.

Thank you

Brian

Well a KS cannot be a GM to itself if your configuration it incorrectly.  You said that it worked, but I don't see how it could have been.  A KS should be a stand-alone router, do nothing, but acting as the KS for the GMs GET.

Tags: Cisco Security

Similar Questions

Maybe you are looking for