How to troubleshoot an IPSec tunnel GRE?

Similar Questions

• How can I bypass ipsec tunnel when do ftp?

  Hello

  I would like to make an IPsec VPN tunnel between my breanch and Headquarters Office (VPN router). I do FTP specific ip on the Internet without IPsec tunnel. This should be happenning on my website. then when users try to ftp://125.7.123.46 it should work around the tunnel and connect directly?

  Can any one give me a heads up how do I do this on my router?

  Thanks in advance,

  Reza

  Reza,

  In order to achieve this the 192.168.10.0/24 network server, here's what you need:

  ##########################################

  access-list 150 deny ip 192.168.10.0 0.0.0.255 192.168.2.0 0.0.0.255

  access-list 150 permit ip 192.168.10.0 0.0.0.255 any

  overload of IP nat inside source list 150 interface Dialer0

  interface Ethernet0

  IP nat inside

  interface Dialer0

  NAT outside IP

  #########################################

  With the above configuration you have access to Internet in the 192.168.10.0/24 network without disturbing the IPsec traffic.

  You have this double threat?

  Federico.

• Problem on the establishment of a GRE/IPsec tunnel between 2 cisco routers

  Hello world

  I am trying to establish a GRE IPsec tunnel between two cisco routers (2620XM and a 836).

  I created a tunnel interfaces on both routers as follows.

  2620XM

  interface Tunnel0

  IP 10.1.5.2 255.255.255.252

  tunnel source x.x.x.x

  tunnel destination y.y.y.y

  end

  836

  interface Tunnel0

  IP 10.1.5.1 255.255.255.252

  tunnel source y.y.y.y

  tunnel destination x.x.x.x

  end

  and configuration of isakmp/ipsec as follows,

  2620XM

  crypto ISAKMP policy 10

  md5 hash

  preshared authentication

  ISAKMP crypto key {keys} address y.y.y.y no.-xauth

  !

  !

  Crypto ipsec transform-set esp - esp-md5-hmac to_melissia

  !

  myvpn 9 ipsec-isakmp crypto map

  defined peer y.y.y.y

  Set transform-set to_melissia

  match address 101

  2620XM-router #sh ip access list 101

  Expand the access IP 101 list

  10 permit host x.x.x.x y.y.y.y host will

  836

  crypto ISAKMP policy 10

  md5 hash

  preshared authentication

  ISAKMP crypto key {keys} address x.x.x.x No.-xauth

  !

  !

  Crypto ipsec transform-set esp - esp-md5-hmac to_metamorfosi

  !

  myvpn 10 ipsec-isakmp crypto map

  defined peer x.x.x.x

  Set transform-set to_metamorfosi

  match address 101

  836-router #sh access list 101

  Expand the access IP 101 list

  10 licences will host host x.x.x.x y.y.y.y

  Unfortunately I had no isakmp security associations at all and when I enter the debugging to this output.

  CRYPTO: IPSEC (crypto_map_check_encrypt_core): CRYPTO: removed package as currently being created cryptomap.

  Any ideas why I get this result? Any help will be a great help

  Thank you!!!

  I think it's possible. It seems to me that you are assuming that the address of the interface where goes the card encryption is peering address. While this is the default action, it is possible to configure it differently.

  As you have discovered the card encryption must be on the physical output interface. If you want the peering address to have a different value of the physical interface address outgoing, then you can add this command to your crypto card:

  card crypto-address

  so if you put loopback0 as the id_interface then he would use loopback0 as peering address even if the card encryption may be affected on serial0/0 or another physical interface.

  HTH

  Rick

• Using Loopback Interface as Source GRE/IPSec tunnel

  Hi all:

  I need one to spend a working router to router VPN tunnel using an IP WAN IP interface loopback as a source.  I am able to ping the loopback from the other router.  As soon as I change the source of tunnel to use the loopback IP address, change the encryption ACL map, and move the cryptographic card of the WAN interface to the loopback interface, the tunnel will not come to the top.  If I remove all the crypto config, the tunnel comes up fine as just a GRE tunnel.  On the other router, I see the message that says that's not encrypting the traffic below.

  * 00:10:33.515 Mar 1: % CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd package not an IPSEC packet. (ip) vrf/adr_dest = 192.168.0.1, src_addr = 192.168.1.2, prot = 47

  What Miss me?  Is there something else that needs to be done to use the closure of a GRE/IPSec tunnel?

  I have install below config in the laboratory to see if I can get it even work in a non-production environment.

  R1 WAN IP: 192.168.0.1

  R2 WAN IP: 192.168.0.2

  R2 Closure: 192.168.1.2

  hostname R2

  !

  crypto ISAKMP policy 1

  BA 3des

  md5 hash

  preshared authentication

  Group 2

  ISAKMP crypto key abc123 address 192.168.0.1

  !

  Crypto ipsec transform-set esp-3des esp-md5-hmac T1

  transport mode

  !

  crypto map 1 VPN ipsec-isakmp

  Description remote control

  defined peer 192.168.0.1

  game of transformation-T1

  match address VPN1

  !

  interface Loopback0

  IP 192.168.1.2 255.255.255.255

  VPN crypto card

  !

  Tunnel1 interface

  IP 172.30.240.2 255.255.255.252

  IP mtu 1440

  KeepAlive 10 3

  tunnel source 192.168.1.2

  tunnel destination 192.168.0.1

  VPN crypto card

  !

  interface FastEthernet0

  IP 192.168.0.2 255.255.255.0

  !

  VPN1 extended IP access list

  allow ACCORD 192.168.1.2 host 192.168.0.1

  you have tried to add "card crypto VPN 1 - address Loopback0".

• GRE in IPSEC tunnel

  Hello

  I have a question where I nee to close a tunnel IPSEC and GRE on my hub, is this possible?

  The GRE tunnel will be in the IPSEC tunnel.

  No. I don't think that you can terminate a GRE tunnel on a concentartor. What you can do is to put an end to a GRE tunnel on a router behind the hub. The tunnel can go through the hub. You can specify the traffic between the source/destination as interetsting and things should work fine.

• GRE over IPSec tunnel cannot pass traffic through it

  I am trying to configure a GRE over IPSec tunnel between sites, we use the router cisco 7613 SUP720 (IOS: s72033-advipservicesk9_wan - mz.122 - 18.SXF15a.bin) and 3845 router (IOS:c3845 - advsecurityk9 - mz.124 - 25c.bin), we are facing problems when we use the tunnel because traffic is not passing through it. the configuration was working when we were using two routers cisco 3845 (IOS:c3845 - advsecurityk9 - mz.124 - 25c.bin), but for some reason, it doesn't work anymore when I paste the configuration on the new 7613 router.

  Head office

  crypto ISAKMP policy 10
  BA aes
  preshared authentication
  Group 5
  ISAKMP crypto key T3ST001 address 0.0.0.0 0.0.0.0
  !
  !
  Crypto ipsec transform-set IPSec_PLC aes - esp esp-sha-hmac
  transport mode
  !
  map PLC - CUM 10 ipsec-isakmp crypto
  defined by peer 167.134.216.89
  game of transformation-IPSec_PLC
  match address 100
  !
  !
  !
  Tunnel1 interface
  bandwidth 1984
  IP 167.134.216.94 255.255.255.252
  Mtu 1476 IP
  load-interval 30
  source of tunnel Serial0/1/0:0
  tunnel destination 167.134.216.89

  interface Serial0/1/0:0
  IP 167.134.216.90 255.255.255.252
  card crypto PLC - CUM

  access-list 100 permit gre 167.134.216.90 host 167.134.216.8

  Router eigrp 100
  network 167.134.216.92 0.0.0.3

  Directorate-General of the

  crypto ISAKMP policy 10
  BA aes
  preshared authentication
  Group 5
  ISAKMP crypto key T3ST001 address 0.0.0.0 0.0.0.0
  !
  !
  Crypto ipsec transform-set IPSec_PLC aes - esp esp-sha-hmac
  transport mode
  !
  map PLC - CUM 10 ipsec-isakmp crypto
  defined by peer 167.134.216.90
  game of transformation-IPSec_PLC
  match address 100

  Tunnel1 interface
  bandwidth 1984
  IP 167.134.216.93 255.255.255.252
  Mtu 1476 IP
  load-interval 30
  source of tunnel Serial1/0/0:1
  tunnel destination 167.134.216.90

  interface Serial1/0/0:1
  bandwidth 1984
  IP 167.134.216.89 255.255.255.252
  IP access-group 101 in
  load-interval 30
  no fair queue
  card crypto PLC - CUM

  access-list 100 permit gre 167.134.216.89 host 167.134.216.90

  ER-7600 #sh crypto isakmp his
  conn-id State DST CBC slot
  167.134.216.89 167.134.216.90 QM_IDLE 3 0

  ER-3845 #sh crypto isakmp his
  status of DST CBC State conn-id slot
  167.134.216.89 167.134.216.90 QM_IDLE 3 0 ACTIVE

  ER-3845 #sh active cryptographic engine connections

  Algorithm of address State IP Interface ID encrypt decrypt
  3 Serial0/1/0: 167.134.216.90 0 HMAC_SHA + AES_CBC 0 0 value
  3001 Serial0/1/0: 167.134.216.90 0 set AES + SHA 0 0
  3002 Serial0/1/0: 167.134.216.90 0 set AES + SHA 61 0

  ER-7600 #sh active cryptographic engine connections

  Algorithm of address State IP Interface ID encrypt decrypt
  3 Serial1/0/0:1 167.134.216.89 set HMAC_SHA + AES_CBC 0 0
  2000 Serial1/0/0:1 167.134.216.89 set HMAC_SHA + 0 66 AES_CBC
  2001 Serial1/0/0:1 167.134.216.89 set HMAC_SHA + AES_CBC 0 0

  I had this error on the er-3845: % CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd package not an IPSEC packet and this one on the IPSEC (epa_des_crypt) UH-7600: decrypted packet has no control of his identity

  Please help, it's so frustrating...

  Thanks in advance

  Oscar

  Here is a document from cisco, mentioning clearly for a card encryption on the two physical as tunnel interface well.

  http://www.Cisco.com/en/us/Tech/tk583/TK372/technologies_configuration_example09186a008009438e.shtml

  It may be useful

  Manish

• How to configure ASA5520 of Checkpoint IPsec tunnel configuration

  Hi guys and under tension, a lot of it!

  I have a problem, I set up an IPsec tunnel between my ASA5520 at a Checkpoint Firewall (PE) CONFIG below (not true FT)

  network of the ASA_MAPPED object

  4.4.4.0 subnet 255.255.255.0

  network of the CHECKPOINT_MAPPED object

  5.5.5.5.0 SUBNET 255.255.255.0

  OUT_CRYPTO extended access list permit ip object ASA_MAPPED object CHECKPOINT_MAPPED

  Crypto ipsec transform-set ikev1 CHECKPOINT_SET aes - esp esp-sha-hmac

  destination NAT (INSIDE, OUTSIDE) static source ALLNETWORKS(10.0.0.0/16) ASA_MAPPED CHECKPOINT_MAPPED of CHECKPOINT_MAPPED static

  NAT (INSIDE, OUTSIDE) source of destination ALLNETWORKS(10.0.0.0/16) static ASA_MAPPED static 4.4.4.11 5.5.5.11

  card crypto OUTSIDE_MAP 5 corresponds to the address OUT_CRYPTO

  OUTSIDE_MAP 5 set crypto map peer X.X.X.X

  card crypto OUTSIDE_MAP 5 set transform-set CHECKPOINT_SET ikev1

  card crypto OUTSIDE_MAP 5 defined security-association life seconds 3600

  CHECKPOINT_MAP interface card crypto OUTSIDE

  tunnel-group X.X.X.X type ipsec-l2l

  tunnel-group ipsec-attributes X.X.X.X

  IKEv1 pre-shared-key 1234

  ISAKMP crypto 10 nat-traversal

  Crypto ikev1 allow outside

  IKEv1 crypto policy 10

  preshared authentication

  aes encryption

  sha hash

  Group 5

  life 86400

  IPsec Tunnel is in place and I can access the server on the other side via the beach of NATTED, for example a server behind the checkpoint with the IP 10.90.55.11 is accessible behind the ASA as 4.4.4.11, the problem is that I have never worked on a Checkpoint Firewall and servers/Server 4.4.4.11 that I can't connect to my environment to that checkpoint is configured with a Tunnel interface that is also supposed to to make NAT because of the superimposition of networks, at one point, I added an access to an entire list and bidirectional routing has been reached, but I encountered a new problem, I could not overlook from my servers public became unaccessecable, since all traffic was encrypted and get dropped to VPN: ipsec-tunnel-flow... for now the Tunnel is up and I can access the server via NAT 4.4.4.11, but can't access my internal servers. What did I DO WRONG (also, I don't have access to the Checkpoint Firewall (PE)) how their installation would be or how it should be to allow bidirectional routing?

  ========================================================

  Tag crypto map: CHECKPOINT_MAP, seq num: 5, local addr: X.X.X.X

  Access extensive list ip 4.4.4.0 OUT_5_CRYPTO allow 255.255.255.0 5.5.5.0 255.255.255.0

  local ident (addr, mask, prot, port): (4.4.4.0/255.255.255.0/0/0)

  Remote ident (addr, mask, prot, port): (5.5.5.0/255.255.255.0/0/0)

  current_peer: X.X.X.X

  #pkts program: 3207, #pkts encrypt: 3207, #pkts digest: 3207

  #pkts decaps: 3417, #pkts decrypt: 3417, #pkts check: 3417

  compressed #pkts: 0, unzipped #pkts: 0

  #pkts uncompressed: 3207, model of #pkts failed: 0, #pkts Dang failed: 0

  success #frag before: 0, failures before #frag: 0, #fragments created: 0

  Sent #PMTUs: 0, #PMTUs rcvd: 0, reassembly: 20th century / of frgs #decapsulated: 0

  #send errors: 0, #recv errors: 0

  local crypto endpt. : X.X.X.X/0, remote Start crypto. : X.X.X.X/0

  Path mtu 1500, fresh ipsec generals 74, media, mtu 1500

  current outbound SPI: 5254EDC6

  current inbound SPI: 36DAB960

  SAS of the esp on arrival:

  SPI: 0x36DAB960 (920303968)

  transform: aes - esp esp-sha-hmac no compression

  running parameters = {L2L, Tunnel}

  slot: 0, id_conn: 19099648, crypto-card: CHECKPOINT_MAP

  calendar of his: service life remaining (KB/s) key: (3914999/3537)

  Size IV: 16 bytes

  support for replay detection: Y

  Anti-replay bitmap:

  0 x 00000000 0x0000000F

  outgoing esp sas:

  SPI: 0x5254EDC6 (1381297606)

  transform: aes - esp esp-sha-hmac no compression

  running parameters = {L2L, Tunnel}

  slot: 0, id_conn: 19099648, crypto-card: CHECKPOINT_MAP

  calendar of his: service life remaining (KB/s) key: (3914999/3537)

  Size IV: 16 bytes

  support for replay detection: Y

  Anti-replay bitmap:

  0x00000000 0x00000001

  unless I include any any on my access-list and the problem with that is  that my Public servers then get encrypted from the OUTSIDE interface  unless you know of a way to bypass the VPN
  
  

  No, u certainly shouldn't allow 0.0.0.0 for proxy ACL. Again, your config is very good. In addition, package account, this show that traffic is going throug the tunnel in two ways:

  #pkts program: 3207

  #pkts decaps: 3417

  Also, looking at the meter, I can guess that some of the traffic comes from the other site, but does not return back (maybe that's where you can not connect from behing Checkpoint). If you say that 0.0.0.0 solved the problem, are there no other NAT rules for subnet behind ASA, so the server IP, for which you are trying to connect behind the checkpoint, translates into something else (not the beach, included in proxy ACL), when to come back?

• Setting KeepAlive on GRE over IPSEC tunnel

  Hello world

  Need to know if there are benefits of the KeepAlive on GRE over IPSEC implementation that goes over the Wan. ?

  We currently have no KeepAlive on GRE tunnel.

  If we config KeepAlive on both ends of the ACCORD it will cause any overload or the CPU load?

  Thank you

  MAhesh

  If you use a routing on the GRE tunnel protocol you should use KeepAlive WILL not, but I would probably recommend use KeepAlive WILL anyway for the following reasons:

  1. the overload caused by the GRE KeepAlive is quite small, it should not affect the ability to pass traffic

  2. If you ever want to use tracking interface for roads or the static routes that you can interface WILL detect it descend as quickly as possible

  I know that your IPSec device is separate, so I'd probably also enable KeepAlive on the IPSec tunnel as well.

• How to disable a particular IPSec tunnel on Cisco router

  Hi guys,.

  Someone knows a way to termporarily disable an IPSec tunnel on a Cisco router provided individual:

  -No configuration changes

  -Without affecting the other IPSec tunnels running

  -GRE is not used, so there is no tunnel interface to close

  Or in any event nearest to you to meet the requirement above?

  Thank you

  Andrew

  Andrew,

  There is no way to 'turn off' the tunnel without changing the config.

  I think the easiest would be to get the card crypto for this particular tunnel and remove the peer or the ACL:

  for example:

  labmap 10 ipsec-isakmp crypto map

  no counterpart set 10.0.0.1

  labmap 10 ipsec-isakmp crypto map

  no correspondence address 100

  or you can remove the key isakmp for this tunnel, that would, for example:

  No cisco123 key crypto isakmp 10.0.0.1 address

  That would prevent the tunnel to come without affecting the other tunnels.

  I hope this helps.

  Raga

• Tunnel GRE / IP Sec VPN firewall between the router Cisco and Fortigate

  Hello

  Can I do GRE Tunnel / VPN IP Sec between Cisco router and Fortigate Firewall?

  Thank you

  Hi zine,.

  As long as the Fortigate device support GRE over IPSEC, you will be able to create the tunnel between these 2 devices.

  Here is the config for the Cisco Site:

  https://supportforums.Cisco.com/document/16066/how-configure-GRE-over-IPSec-tunnel-routers

  Happy holidays!

  -Randy-

• I can weight of the IPSec Tunnels between ASAs

  Hello

  Remote site: link internet NYC 150 MB/s

  Local site: link internet Baltimore 400 MB/s

  Backup site: link internet Washington 200 Mb/s

  My main site and my backup site are connected via a gigabit Ethernet circuit between the respective base site switches.  Each site has its own internet connection and my OSPF allows to switch their traffic to the backup site if the main website is down.  We are opening an office in New York with one ASA unique connected to 150 Mbps FIOS internet circuit.  We want to set up an IPSec tunnel on the main site and the backup on the remote site, but want the remote site to prefer the tunnel in Baltimore, except if it is down.

  Interesting traffic would be the same for the two tunnels

  I know that ASA cannot be a GRE endpoint.  How can I force the New York traffic through the tunnel in Baltimore as long as it works?  An IPSec tunnel can be weighted?

  Thank you

  It is not in itself weighting, but you can create up to 10 backup over LAN to LAN VPN IPsec peers.

  For each tunnel, the security apparatus tried to negotiate with the first peer in the list. If this peer does not respond, the security apparatus made his way to the bottom of the list until a peer responds, or there is no peer more in the list.

  Reference.

• EIGRP plain IPsec tunnel?

  Hi all

  I was always under the impression that plain IPsec pass through the tunnel unicast IP traffic.

  When I need pass non-unicast or non - IP traffic, I created an IPsec with GRE or VTI.

  But I am currently on the customer site where all EIGRP routes are exchanged between sites that communicate through a single tunnel ordinary IPsec.

  I have added/changed/deleted routes on both sides, and the changes are reflected on the routing of the other table.

  The neighbors are not statically configured on the router, configuring EIGRP is simply 'no Auto-resume', then 'network 172.16.0.0'

  My question is...

  How is it all EIGRP traffic is going through the tunnel without any problem?

  Both are 2811 s 12.4 (18) running

  Thanks for any help!

  Federico.

  Federico

  Indeed, I believe that this is the case. It is quite clear according to the additional information that you have posted that these two routers are connected directly (in this case connected via FastEthernet) and connection interfaces running EIGRP, so that the EIGRP Hellos are sent the FastEthernet interfaces. The access list has failed for EIGRP, so there is no effort to encrypt the Hellos and they are sent in the clear. If routers become neighbors and EIGRP updates are sent through the FastEthernet interfaces. Data destinations that are learned traffic is sent on the FastEthernet interfaces, and when data traffic matches access list it is encrypted by IPSec.

  HTH

  Rick

• PIX IPSec tunnel - IOS, routing Options

  Hello

  I have an IPSec Tunnel between a PIX firewall and a router Cisco 1721.

  Have I not all options about any routing protocol can I use?

  Are there plans to add GRE support to PIX, so that EIGRP, OSPF can be used?

  ------Naman

  Here's a URL that tells how to configure GRE over IPSEC with OSPF. http://www.Cisco.com/warp/public/707/gre_ipsec_ospf.html

• WILL secure IPSec tunnel

  Hi all

  I have just set up an IPSec tunnel, except use debug crypto ipsec / isakmp how can I check IPSec works? When I configure the encryption card, can I use ip of the tunnel as the peer address.

  Thanks in advance.

  Banlan

  Hi Banlan,

  Thanks for your appreciation. I feel honoured!

  Back to your question about free WILL inside the IPSec, you must use the gre as the Protocol in the access list; This right, shud you get points for that! (because the ip packet is encapsulated by GRE and then AH / ESP headers are added). Also remember that the ip address as the destination of the tunnel should be globally routable. You cannot use tunneling as a destination of the tunnel (except of course when the routers are connected back to back)

  See the following configs for GRE inside IPSec.

  ! ON THE INITIATOR

  ...

  ...

  access-list 110 permit host WILL

  ...

  12 crypto isakmp policy

  preshared authentication

  !

  address ISAKMP crypto key xxxxx

  Crypto ipsec transform-set esp TS - a

  !

  card 11 CM ipsec-isakmp crypto

  defined by peers

  game of transformation-TS

  match address 110

  !

  tunnel1 interface

  IP unnumbered

  source of tunnel

  tunnel destination

  card crypto CM

  !

  interface

  card crypto CM

  !

  IP route x.x.x.x tunnel1

  ! ON THE ANSWERING MACHINE

  ...

  ...

  access-list 111 allow host WILL

  ...

  crypto ISAKMP policy 11

  preshared authentication

  !

  address ISAKMP crypto key xxxxx

  Crypto ipsec transform-set esp TS - a

  !

  Map 10 CM ipsec-isakmp crypto

  defined by peers

  game of transformation-TS

  match address 111

  !

  interface tunnels2

  IP unnumbered

  source of tunnel

  tunnel destination

  card crypto CM

  !

  interface

  card crypto CM

  !

  IP route x.x.x.x tunnels2

  I think you have the answer now. Catch me if you want something else.

  Cheers :-))

  Naveen

  [email protected] / * /.

• Voice and IPSEC Tunnels

  In which case I use a DMVPN IPSEC technology for branch connectivity, used ISP know what kind of traffic I run because it is encrypted in the end.

  DMVPN package use is first encapsulated in GRE and then encrypted with IPSEC authentication information. Because the ultimate traffic is IPSEC requires ISP/provider leave the port UDP 500 and ESP open. Once the tunnel is created I can pass any type of traffic because it will use ESP.

  Given what I saw a few deployments where we put in place this kind of solution and telephone traffic did not and ip phones were unable to register. Most of the guys have pointed out that it could possibly be because ISP blocks the SCCP traffic, but my concern is that if we have a branch at Headquarters IPSEC tunnel how the ISP can detect this thing and drop it.

  Please provide feedback on this.

  The provider cannot see inside the tunnel. Only, he could assume that it could be the voice traffic:

  The voice parameters the value DSCP-in IP header when they send traffic. These values are copied to the outer IP header when the traffic is encrypted. With this function you can also do QoS on encrypted traffic.

  But I do not think that a provider might filter on this traffic.

  --
  Don't stop once you have upgraded your network! Improve the world by lending money to low-income workers:
  http://www.Kiva.org/invitedBy/karsteni