Love tunnel SAs negotiated, but do not survive.

Background

We have a stable P2P GRE + IPSec configuration to multiple rays using signatures rsa for authentication ISAKMP and EIGRP as the routing protocol. We are in transition to a love (DMVPN) configuration. GRE P2P tunnel interfaces are administratively shutdown, cryptographic cards on physical interfaces have been removed and the cryptographic database has been erased.

Question

When implement us the interfaces of tunnel love (Star), we are able to complete the ISAKMP phase I and II (briefly). However, ~ 1-1/2 minutes more, we see a message from debug on the hub, such as:

13:56:49.601 Jul 21 EDT: IPSEC (cleanup_tun_decap_oce): Unlock and null to Tunnel0 tun_decap_oce 86742E48 of 86FB990C of ident

... and then the IPSec SAs are deleted, the tunnel down, IKE_PHASE2_DEL and IKE_PHASE1_DEL messages are generated and start with phase I ISAKMP negotiation.

Anyone know what the 'CEO '?

Highlights of debugging (ISAKMP and IPSec)

13:55:13.188 Jul 21 EDT: ISAKMP: (2597): SA authentication status: authenticated
13:55:13.236 Jul 21 EDT: ISAKMP: (2597): former State = new State IKE_R_MM5 = IKE_P1_COMPLETE
13:55:13.356 Jul 21 EDT: IPSEC (create_sa): its created.
13:55:13.356 Jul 21 EDT: IPSEC (create_sa): its created.
13:55:13.356 Jul 21 EDT: % CRYPTO-5-SESSION_STATUS: Crypto tunnel is MOUNTED.  Peer : 500 Id: spoke.domain.null
13:55:13.356 Jul 21 EDT: % DMVPN-7-CRYPTO_SS: Tunnel0- socket is in PLACE
13:55:13.700 Jul 21 EDT: ISAKMP: (2597): former State = new State IKE_QM_R_QM2 = IKE_QM_PHASE2_COMPLETE
13:56:49.601 Jul 21 EDT: IPSEC (cleanup_tun_decap_oce): Unlock and null to Tunnel0 tun_decap_oce 86742E48 of 86FB990C of ident
13:56:49.601 Jul 21 EDT: IPSEC (delete_sa): deletion of the SA.
13:56:49.601 Jul 21 EDT: IPSEC (delete_sa): deletion of the SA.
13:56:49.601 Jul 21 EDT: % CRYPTO-5-SESSION_STATUS: tunnel Crypto is out of SERVICE.  Peer : 500 Id: spoke.domain.null
13:56:49.601 Jul 21 EDT: ISAKMP: (2597): entry = IKE_MESG_FROM_IPSEC, IKE_PHASE2_DEL
13:56:49.605 Jul 21 EDT: ISAKMP: (2597): entry = IKE_MESG_INTERNAL, IKE_PHASE1_DEL

Note: A more complete debug output is attached.

General comments (sh crypto isakmp, ipsec crypto sh its)

ISAKMP Security Association reached a State of QM_IDLE and active status. However, the SA is removed and a new is generated on the breast of ~ minute.

IPSec security associations are negotiated on the hub and the spokes. However, only speak it a program package, and only the hub has decaps. Wireshark confirms that the hub does not all ESP packets on the wire. The IPSec SAs are deleted and the new spawn every minutes ~ 1-1/2.

See the output of the command

hub #sh cry ipsec profile
Profile IPSEC DMVPN
Life safety association: 4608000 Kbytes / 3600 seconds
Answering machine-only (Y/N): N
PFS (Y/N): Y
Diffie-Hellman group: group2
Transform sets = {eni-xfm-des: {esp - esp-sha-hmac}, eni-xfm-3des: {esp-3des esp-sha-hmac}}

hub #sh cry map
Card crypto isakmp-65536-"Head-Tunnel0-0" ipsec
Profile name: DMVPN
Life safety association: 4608000 Kbytes / 3600 seconds
Answering machine-only (Y/N): N
PFS (Y/N): Y
Diffie-Hellman group: group2
Transform sets = {eni-xfm-des: {esp - esp-sha-hmac}, eni-xfm-3des: {esp-3des esp-sha-hmac}}

Card 'Head-Tunnel0-0' 65537-isakmp ipsec crypto
Map is a PROFILE INSTANCE.
Peer =.
Extended IP access list
access-list allow accord host host
Current counterpart:
Life safety association: 4608000 Kbytes / 3600 seconds
Answering machine-only (Y/N): N
PFS (Y/N): Y
Diffie-Hellman group: group2
Transform sets = {eni-xfm-des: {esp - esp-sha-hmac}, eni-xfm-3des: {esp-3des esp-sha-hmac}}
Interfaces with card crypto Tunnel0-head - 0:Tunnel0

HQ-edg01 #sh cry session detail
Current state of the session crypto

Interface: Tunnel0
Duration: 00:00:10
The session state: UP-ACTIVE
Peer: port 500 fvrf: (none) ivrf: (none)
Phase1_id: spoke.domain.null
DESC: (none)
ITS IKE: local remote 500 500 Active
Capabilities: (None) connid:2682 life time: 23:59:47
ITS IKE: local remote 500 500 inactive
Capabilities: (None) connid:2681 life time: 0
FLOW IPSEC: allowed host 47 host
Active sAs: 2, origin: card crypto
On arrival: dec #pkts'ed 6 drop 0 life (KB/s) 4517257/3589
Outbound: #pkts enc'ed drop 0 0 life (KB/s) 4517258/3589

Material & IOS

C1811 (hub) - c181x-advipservicesk9 - mz.124 - 24.T
c1711 (spoken) - c1700-advipservicesk9 - mz.124 - 15.T9

Follow the relevant parts of crypto configurations DMVPN (hub / talk):

crypto ISAKMP policy 3
BA 3des
Group 2
life 86399

ISAKMP crypto identity hostname

Crypto ipsec transform-set eni-xfm-3des esp-3des esp-sha-hmac
transport mode
Crypto ipsec transform-set esp eni-xfm-des-esp-sha-hmac
transport mode

Profile of crypto ipsec DMVPN
3600 seconds, life of security association set
the value of the transform-set eni-xfm-des eni-xfm-3des
PFS group2 Set

interface Tunnel0
IP 255.255.255.0
Protection ipsec DMVPN tunnel profile

Note: PNDH, love, and no other settings have been chiselled.

Any help would be appreciated.

Best regards
Mike

You are right your comment.

The previous interface of p-BRMS (in your case) can get his information in to

the tunnel endpoint database (packages of controls tunnel) even if the

p BRMS tunnel is stopped.  It is also in the code a GRE packet

destined to the router will search a mathc with a p-BRMS tunnel before

Love tunnels. If the GRE tunnel packets were getting "caught".

by p-BRMS tunnel and then dropped.

If I really want a GRE tunnel to be 'down', I'll remove the "source of the tunnel...". ».

If I have two tunnels upwards at the same time, I do what you do, give

each of them a different tunnel key or a different source of tunnel.

Hope this helps to understand what was going on.

Mike.

PS. You should be able to mark it as answered present.

Tags: Cisco Security

Similar Questions

  • The link on cRIO speed settings do not survive restart

    I'm running a cRIO-9068 with firmware revision 1.0.0f1.  It is part of a static network including setting on autonegotiation link speeds.  However, if I put the cRIO to autonegotiation link speed, the cRIO fails to connect to the switch.  Fail lights and pings on the cRIO and switch activity doesn't show any activity.

    Curiously, the cRIO connects successfully when I set the connection speed to 100 Mbps/Full duplex or slower, and it is an acceptable workaround for me (for as far as the requirements of the project creep beyond 100 Mbps).  My problem is that this link speed setting does not survive a reboot cRIO.  After the reboot, the connection speed is reset to auto-negotiation and the cRIO is disconnected once more.

    I'm doing the link configuration changes via web interface of the cRIO speed.  I am logged in as an administrator and save my changes, and I get confirmation that the speed of the link has been set at 100/FDX.  Despite this, restarts always resets the cRIO to auto-negotiation.

    Another curiosity is the ratio of the switch that the cRIO is connected to 100/HDX.

    I tried to make a file of script in /etc/init.d with the command "ethtool speed 100 duplex full s.  I have updated using update - rc.d, but no joy.  Any script OR bat mine is either not using ethtool, or it is not dans/etc/init.d.  I don't know what else to watch because no where else to look at.

    Change the setting of switching to 100/FDX has solved the problem, but this setting is applied to individual ports.  This would force me to always use the same port for the cRIO, a restriction which I've had rather not commit.

    The problem is obviously the switch, because the cRIO connects to my development computer fine with auto-negotiation framework.  Unfortunately, the switch is a component not negotiable material project.  The fix should be done on the side of things cRIO.

    Any thoughts on why the cRIO doesn't remember it's link speed setting?

    Red evening,

    I found a known bug with this problem reported for LabVIEW 2013. I did a little test with LV 2014 shows that it is work as expected.

    You can try to upgrade to the latest NOR-RIO device driver? I could not find the details of it being fixed, so I don't know if its on the side of the LabVEW or the driver but its worth a shot.

    Car # is 464089 for your records.

    One last thing, you should switch to RIO 14.0.1 because there was a bug with disocvered with some components in the FPGA that fixed us that you need to upgrade.

    http://digital.NI.com/public.nsf/allkb/90AEA2EB87466CE786257D20005A3A44

  • TEREDO TUNNELING PSEUDO-INTERFACE DEVICE DOES NOT WORK CORRECTLY - ACCORDING TO AVG PC TUNE UP

    My laptop is a HP G7030EA - MS Windows Vista Home Basic 32-bit SP2 Intel Pentium Dual CPU T2330 @ 1.60 GHz, 1.0 GB RAM, Mobile Intel 965 Express Chipset Family, bought new in February 2008.  I have not changed any hardware, software, etc.  I do not use it for games, only for things such as e-mails and visit websites

    Until last month when my desktop computer broke, I used the laptop only occasionally as a backup of the computer.  It never quite worked and seems to be unable to handle several tasks at once, often taking minutes for Google to load.  When I get impatient and click the mouse too much I heard a horrible noise and the screen mouse cursor freeze for a minute or two.

    As the laptop has become my main computer at the moment, I downloaded AVG PC Tune Up to see if it would improve it performance has not helped.  I was surprised to see how much memory the AVG2013 anti virus program uses, but wonder if the speed of connection and freezing problems I experience result (AVG Tune Up conclusions on) the Teredo Tunneling pseudo-interface unit does not properly.

    I follow AVG on screen re boards: looking for a software driver update but none was found, and I got the message "the best driver for your device software is already installed.  Windows has determined that the driver software for your device is up-to-date, Tun Miniport, Microsoft Map.

    This left me confused.  If there is a problem with this device, no solution seems to exist.

    Any help that will allow my laptop to function normally is welcome.

    I understand that you want to know if the teredo adapter can cause performance problems.

    The teredo adapter should not cause performance problems.  It is really just used to allow devices work IPv4 with IPv6 Internet service provider.  If the ISP was using IPv6 and your system did not have the adapter teredo, so it wouldn't work properly with the service provider.  For now, IPv6 is a significant minority that the world continues to work on IPv4 as not all networks, Internet service providers, and businesses are not entirely passed to IPv6.

    This thread on the Microsoft forums goes into a little more detail about the adapter teredo including how to disable it so that you only see it in Device Manager.  Unless you are using IPv6, this shouldn't really be a problem.

    If you start in safe mode, the performance problem persists?  Turn on the computer and press F8 once per second for the Mode option, safe mode with networking.  This will help you to further isolate the performance problem.

    Furthermore, does this happen that the adapter is connected or not?

  • BlackBerry BlackBerry classic classic has not survived a plunge, how to put the backup on a new device.

    Like I said in the title of the topic, my classic BlackBerry did not survive a swim in the toilet. I did all the stuff found on the internet such as put in a sealed air box full of rice for 48 hours, but he simply no longer lights.

    So fortunately I seem to have a backup file .bbb on my desktop since 12/18/2015.

    1. is there a way to restore the data in a usable format (just the file .png etc)?

    2. is there a way to restore the data on a new classic of BlackBerry? I guess I can do that by choosing switching in BlackBerry link devices, connect the device again and put the old backup on that? I probably should update the new device to the latest version of BB10 before you transfer.

    Hello

    leejjon wrote:

    So fortunately I seem to have a backup file .bbb on my desktop since 12/18/2015.

    1. is there a way to restore the data in a usable format (just the file .png etc)?

    In native mode. Design of the BBB file intent should be used as source for restore to another device of BB. No other function is natively. But there are several 3rd party PC utilities that can extract the data and make it into a format usable otherwise. Never need such a utility, I have no recommendation... but a few seconds on your favorite Internet search engine should reveal many options from which you can choose (and many of them I believe are free).

    leejjon wrote:

    2. is there a way to restore the data on a new classic of BlackBerry? I guess I can do that by choosing switching in BlackBerry link devices, connect the device again and put the old backup on that? I probably should update the new device to the latest version of BB10 before you transfer.

    This is the intention of the exact design of the BBB... file to use as the source for restore to another device of BB. Reference:

    Good luck!

  • Cisco vpn client to connect but can not access to the internal network

    Hi all

    I have a VPN configured on cisco 5540. My vpn was working fine, but suddenly there is a question that the cisco vpn client to connect but can not access to the internal network

    Any help would be much appreciated.

    Hi Samir,

    I suggest that you go to the ASA and check the configuration to make sure that it complies with the requirements according to the reference below link:

    http://www.Cisco.com/en/us/products/ps6120/products_configuration_example09186a00805734ae.shtml

    (The link above includes split tunneling, but this is just an option.

    Please paste the output of "sh cry ipsec his" here so that we can check if phase 2 is properly trained. I would say as you go to IPSEC vpn client on your PC and check increment in packets sent and received in the window 'status '.

    Let me know if this can help,

    See you soon,.

    Christian V

  • ASA or 871 l2l ipsec to SSG - 140: tunnel is up, but no traffic

    Hello

    I am currently troubleshooting an ipsec VPN l2l between

    1. ASA 7.2 (4) SSG - 140

    2 cisco 871W to SSG - 140

    In both scenarios the tunnel is well established and the traffic is in the tunnel, but nothing comes out. Of all the encap, but no decap

    Looks a routing problem, but we cannot find anything on the two sites.

    So maybe I m running in a (known) problem between equipment cisco VPN and SSG-140?

    I've searched the forum, but can not find any idea on this subject.

    If anyone has an idea the most welcome.

    What is a proxy-id problem? Cause they set up stuff like 10.1.1.0/24 and I configure 10.1.1.0 0.0.0.255

    Thanks in advance!

    Tom, I have not seen the downloaded configs or poster. I would focus on the asa as it's easier to troubleshoot. You can use the ease of packet trace to verify that the syn is sent through the encrypted and external interface. Also gives you the ability to capture. Of course, the problem is that the traffic is encrypted. A syn packet is small and hard to distinguish. Try to send a ping from 10 to 1000 pkt size and see if you can locate in the capture (ipsec will add about 80 bytes). You will need to do a quiet moment to make it easier. Assuming that you can identify the packages, you can repeat the capture and ask someone to do the same thing at the remote end. Also, try to do the ping from the remote device and see if you can capture packets. My guess is that there is something wrong at the other end or a firewall drop packets (ip prot 50) esp. If you want to send the config, display, capture of the [email protected] / * / I can take a look. Matthew

  • Adobe Photoshop CC 2015 is compatible with Windows 10. The mine opens, but does not seem to work correctly... INCREDIBLY slow. Does not. Must I return to Windows 8?

    Adobe photoshop cc 2015 is compatible with windows 10? Just upgraded Windows 8 and PS opens but does not work properly. INCREDIBLY SLOW. What I can do or should I return to Windows 8? Windows love 10. Disappointed.

    Hi Ravenm,

    Could you please check and make sure that Photoshop is updated to the latest version 2015.1.2

    Also, please try the steps in the following article: Optimize performance Adobe Photoshop CC

    Let me know if it helps.

    Concerning

    Tanuj

  • I have iphone 5 c. I've updated new version 10.0.2. Now Weather app is working for different cities but does not not for my site which has already been demonstrated in latitude and longitude. Similarly maps application also does not work for my site

    I have iphone 5 c. I've updated new version 10.0.2. Now Weather app is working for different cities but does not not for my site which has already been demonstrated in latitude and longitude. Similarly maps application does not also work for my site.

    Settings > privacy > location Services > confirm you always give permission to these applications to use your location.

    If not, try these standard troubleshooting steps.

    -Reset: hold the Home and Power buttons until you see the logo Apple (10-15 seconds).

    -Restore your iDevice: https://support.apple.com/en-us/HT204184

    If your backup is in iTunes, make sure that it is encrypted.

  • My TV will not restore via itunes. Tried 2 x - says it is downloading software, but does not work

    My TV will not restore via iTunes - says it is downloading software, but is not complete the restore

    If your Apple TV fails to restore via iTunes...

    • Check that you have properly followed the instructions for your model of Apple TV.
    • If this is not the case, already, try using a powered USB port.
    • Repeat the process, but this time try to connect the cable while iTunes is closed.
    • Repeat the process with another cable.
    • Try to restore the Apple TV on another computer at another location.
  • I bought if sky was not So Far Away as ringtone but does not appear in my ringtones

    I bought if sky was not So Far Away as ringtone but does not appear in my ringtones

    I bought if sky was not So Far Away as ringtone but does not appear in my ringtones

  • I have a MBP of 2009 end. I updated the material to 8 GB of ram with an SSD of 240gig. I want to run the new OSX, but is not on the list approved for the update. Anyone know why?

    I have a MBP of 2009 end. I updated the material to 8 GB of ram with an SSD of 240gig. I want to run the new OSX, but is not on the list approved for the update. Anyone know why?

    It is a decision that was made by Apple.  El Capitan is the newest OSX that will support a 2009 MBP.

    This is not uncommon.  My 2006 MBP came with Tiger, but is limited to OSX Snow Leopard.

    Old hardware ends up by becoming obsolete with newer technology.

    Ciao.

  • It shows the logo, but is not on even a while it does, but for only 2 seconds then shows new logo

    It shows the logo, but is not on even a while it does, but for only 2 seconds then shows new logo

    Hello

    Follow the instructions here, including contacting Apple Support or your Genius Bar reservation if necessary:

    If your iPhone, iPad or iPod touch won't turn on - Apple Support

  • MY PHONE SCREEN IS BLACK, PHONE WILL RING AND ICAN HEAR THROUGH THE MESSAGES BUT CAN NOT SEE ANYTHING AT ALL

    MY PHONE SCREEN IS BLACK, PHONE WILL RING AND ICAN HEAR THROUGH THE MESSAGES BUT CAN NOT SEE ANYTHING AT ALL

    Try this restart your iPhone, iPad or iPod touch - Apple Support

    If this does not work, it may be a hardware problem.

    Hope this helps, good luck to you.

  • I can import my Canon XF100 files in FCP, I bought today. I downloaded Canon XF utility application, but do not understand how it works. Appreciate any suggestions of people perhaps!

    I can't import my Canon XF100 files in FCP. I downloaded the Canon XF utility, but do not understand how it works. I work with a 24 inch Mac (2009), 8 GB of memory running with El Capitan 10.11.6

    Make sure that the last formats video Prois installed.

    Russ

  • Options expenses, but are not accessible. Unusual small box described in the Center. Win 10 64 istalled operating system. Have you tried disableing extensions.

    Loads Options page but are not accessible. Small box (without text) appears in the middle of the page. Have you tried various installs Firefox (current edition of Foxstart). Tried to disable extensions. Win 10 64 operating system. Chrome is by default because it can not reset Firefox because of issue of Options.

    You may have a corrupted file xulstore.json .
    https://support.Mozilla.org/en-us/KB/changes-toolbars-and-window-sizes-are-not-saved

Maybe you are looking for

  • Activation helps in my ipad, lost email =)

    I bought my mini ipad nearly 3 years, but this problem is already 2 years old, I don't know what happened, it of just stop and seemed an ipad activation... I have try all the emails that I don't always have incorrect or bad password... I think I lost

  • D6400 firmware through engineering 1.0.1.22?

    After having some problems with my sporadic reboot D6400 (about once every 2-3 weeks), I did a factory reset. I put in place through the web page interface and all is well. At one point he checked for firmware updates and found none (current being 1.

  • Discoloration on the Yoga 3

    First time poster here. I have a white 3 of Yoga and its spots dyed quite bad developed my wrists to sit when I type. I tried some techniques recommended for white MacBook (toothpaste, plastic Eraser, savvy) cleaning, but nothing has worked so far. C

  • Upgrade to Windows windows 8.1 8.1 Preview and lost all the software pre-loaded HP

    Hello, I lost all the pre-loaded software that came with my HP Envy m6-1231ea which includes beats audio, AMD CCC for my graphics switchable, software Cyberlink etc. Also, I can't do the thing that scans my finger so I can connect to my laptop withou

  • Compact finding emails in Windows Mail

    I hope someone can help me.I compacted my emails with the feature of compact mail every 100 times to stop the program, but I need to recover some of these emails, which I cannot find.  I thought they would be in the same place as always but simply co