MPLS TE, booking badwidth Tunnel?

Similar Questions

• Admission control TE MPLS

  Hi people,

  I'm pretty new to the topic of MPLS TE, and I have a question for which I can't find an answer on my reading

  mpls_te.PNG

  

  Suppose we have the topology in the attached diagram

  IS - IS is used as the IGP; MP - BGP for VPN, EP to THIS eBGP East traffic

  Each link is a link 10 Mbps, 6 Mbps are used by YOU.

  each node has a master tunnel which has a default tunnel and a tunnel LLQ

  the metric of YOU was left by the default value (to the IGP metric)

  every single node a tunnel to all other nodes (mesh full tunnels)

  all tunnel interfaces have the config below

  interface Tunnel10

  Description you RX (Master)

  bandwidth 10000

  IP unnumbered Loopback0

  way of tunnel mpls traffic-eng

  tunnel destination 169.254.1.2

  highway tunnel mpls traffic-eng announce

  Master of exp-bundle tunnel mpls traffic-eng

  tunnel mpls traffic-eng exp-bundle Member Tunnel11

  tunnel mpls traffic-eng exp-bundle Member Tunnel12

  !

  interface Tunnel11

  Description you Rx (default)

  bandwidth 6000

  IP unnumbered Loopback0

  load-interval 60

  way of tunnel mpls traffic-eng

  tunnel destination 169.254.1.2

  highway tunnel mpls traffic-eng announce

  tunnel mpls traffic-eng 7 7 priority

  tunnel mpls traffic-eng bandwidth 4000

  dynamics of path-option 10 mpls traffic-eng tunnels

  mpls traffic-eng record-road tunnel

  mpls traffic-eng fast-diversion tunnel

  tunnel of mpls traffic-eng auto-bw frequency 300 setting threshold 5 max - bw 4000 min - bw 1000

  tunnel mpls traffic-eng default exp

  !

  interface Tunnel12

  Description you RX (LLQ)

  bandwidth 4000

  IP unnumbered Loopback0

  way of tunnel mpls traffic-eng

  tunnel destination 169.254.1.2

  highway tunnel mpls traffic-eng announce

  tunnel mpls traffic-eng 7 7 priority

  tunnel mpls traffic-eng bandwidth under pool 2000

  dynamics of path-option 10 mpls traffic-eng tunnels

  mpls traffic-eng record-road tunnel

  mpls traffic-eng fast-diversion tunnel

  tunnel mpls traffic-eng exp 5

  My Questions are

  1. have the MPLS TE metric by default equal to the IGP metric and assuming that the path will R9 in R8 is still the best path from the point of view of the PGI

  the LSP used to get R1 to R9 is R1-R8-R9 and all the available bandwidth was used (6 Mbps), so we have 4 Mbit/s left on the R8 - R9

  R2-R8-R9 is the best way (best metric IGP/TE)

  When RSVP is reported the LSP to go to R2 to R9 is the FSA will be built using a least favorite way in terms of metrics or control that result in and admitted failure?

  2. bandwidth is sous-pool dedicated interface of main tunnel or Tunnel 12?

  Thank you very much in advance for your help

  Kind regards

  Mehdi

  HI Maria,

  I think Yes, because when RSVP message the way it send on all possible paths, in this case the best way not enough bandwidth and suboptimal Yes, the LSP is even on the suboptimal way.

  Who is King

• Targeted LDP sessions

  I have a question about targeted LDP sessions - as I in red MPLS Fundamentals book we can configure mpls ldp discovery targeted Hello parameter. Which makes me doubt this is - why we need discovery of the LDP for targeted session?

  If I understand the function of discovery LDP is to discover LDP neighbor and get him information such as the ip transport to establish the LDP neighborship. But for the targeted session, we can define statically neighbor. So from my point of view I don't see reason to send messages of discovery between targeted neighbors - why not immediately establish neighborship?

  Kind regards

  Alexey,

  LSR triggering a tLDP session must first understand or otherwise takes the remote side supported a targeted LDP session. To do this, DSL will be unicast Hello with R bit set. If it receives a response from the remote node, on to the next step in the creation of the session.

  By my knowledge, it's a kind of security check that node unintented establish tLDP session and to avoid to try creating unsuccessful if neighbouring TCP session is not interested

  HTH,

  Mr. Nagendra

• MPLS TE tunnel broadband bandwidth and ip rsvp bandwidth

  I have a few questions about how to reserve bandwidth in MPLS TE environment.

  1. we need IP RSVP bandwidth in any concern in MPLS TE environment interface, right?

  2. What is the purpose of ip rsvp bandwidth?

  3 tunnel MPLS traffic engineering connection XXX, the define command band bandwidth flow initiated by head, if sending more than XXX flow, how it works? Drop excessive packet in the stream?

  Any point is welcome! Thank you!

  Hello

  (A1) to the right.

  A2) with the "ip rsvp bandwidth" it indicates how much bandwidth on an interface can be booked by MPLS TE tunnels.

  A3) characteristic misuderstood most probably is MPLS TE. It is a pure function of the control plan. So, there's comparison of reserved bandwidth compared to actual bandwidth used or nocheck.

  You can configure an MPLS TE tunnel with 1 Kbps ("mpls traffic engineering tunnel 1") and send 10 Gbps on the way and NONE will be given.

  Where there is an interface in the path, that is supported, then packets will be handled independently having a tag to tunnel or not.

  You might ask: what the point of MPLS TE, then if I have can´t give guarantees of bandwidth with it? Answer: MPLS allows YOU a selection more complex and controllable path in MPLS environment. In addition features such as Fast ReRoute (FRR) are interesting.

  I hope this helps! Please note all messages.

  Regards, Martin

• 1 single MPLS tunnel between routers directly connected. Traffic routes and others not?

  Hello

  I have a unusual problem, I can not explain.

  I have a simple scenario

  LAN1 = 4500 = OSPF = R1_6500 = OSPF = R2_6500 = tunnel mpls TE with Highway = R3_2900 = 1900 = LAN2

  1 enable MPLS TE tunnel between the Router R2 6500 and 2900 router

  2. everything is ok until I have activate the router R3 2900 highway. LAN1 can reach the printers in Lan2 via the web. ŒUVRES of ICMP in all CASES!, however, (172 bytes) ICMP packets generated by the Solarwinds network browser find only 30% of the Lan2 network...

  Once you turn off highway on 2900, it works normally...

  3. I have the implicit null label on 2900 and R2 6500 (if I activate highway on two tunnels), CEF seems to be ok, OSPF routes are present, however, some of the traffic simply does not pass through

  4. I have it fixed construction of a second tunnel of 2900 to 6500 R1 and it works well, but I don't understand what in fact behave this way?

  Hello Vadym,

  Perfect :)

  Why should I activate targeted Hello

  [Akash]

  Connected nondirectly MPLS LDP sessions

  The DSL is more than one bond of his neighbor, if non-connected directly to his neighbor. For these nondirectly neighbors connected, DSL text Hello targeted as a UDP packet, but as a message specifically addressed to this DSL unicast. DSL connected nondirectly meets the Hello message and the two routers are starting to establish an LDP session. This is the so-called scope of discovery.

  The default behavior of an LSR is to ignore the other DSL applications that send targeted messages to Hello. You can configure a DSL to meet the demands of targeted Hello messages by publishing the discovery ldp targeted Hello mpls accept small order.

  Why do you think that the LSP is broken, if we do not use the LDP

  [Akash]  If LDP is not enabled on the tunnel, R2 will not any label R3 on the tunnel interface broadcast and R3 sends the traffic untagged to R2 [only rsvp label which is implicit null], and ip lookup will happen on R2, so this is not end-to-end LSP. If ip loopup happening on the router of the base, I would say that LSP is broken here. But if LDP is enabled on the tunnel, R2 will announce a local label R3 more targeted LDP session. L3 will send labeled package [implicit null for RSVP, label IGP announced by R2] R2 and R2 will make label swapping and send traffic to R1. All the way labels switching and LSP is intact.

  If it would have been scenario L3vpn, traffic would have been blackholed on router core cases get end of tunnel. In your case all core routers have routes with destination so accessibility is there but LSP divided again.

  Kind regards

  Assani

• supported vs IPSec VRF taking crypto maps for several tunnels

  Hi all!

  I came to know that we can use the same public ip address for the creation of several tunnels to different websites using crypto-cards featuring many lines each representing a reference to a particular tunnel and using vrf aware IPsec, but I would like to know what are the differences / advantages / cautions.

  Thanks for your time

  Murali.

  Murali

  That I understand the feature essentially allows you to have multiple IPSEC tunnels and traffic in the tunnel that is to say. source and destination IP of the high-end devices can be in different VRF.

  So it works mainly with the MPLS VPN IE. If you had several MPLS VPN each with their own VRF you can then run ISPEC tunnels on the MPLS network and when packets are received, they are automatically in the correct VRF.

  You could not do that normal crypto cards IE. You can cancel again several IPSEC tunnels on a public IP address but then everything would be traffic in the same global routing table.

  If the benefit is basically the same that you get with any VRF installation IE. logical separation of traffic on a single device.

  Can't really say much about the warnings as I've never used it but there are some restrictions.

  See this link for more details-

  http://www.Cisco.com/c/en/us/TD/docs/iOS-XML/iOS/sec_conn_ikevpn/configuration/XE-3s/asr1000/sec-IKE-for-IPSec-VPNs-XE-3s-asr1000-book/sec-VRF-aware-IPSec.html

  Jon

• HTTP connection fails systematically with dns and tunnel errors

  I read this article:

  http://supportforums.BlackBerry.com/T5/Java-development/different-ways-to-make-an-HTTP-or-socket-con...

  I want to connect to a url through http, but I always get failure DNSException or tunnel. I tried all kinds of connection string suffix = '; deviceside = true ","; deviceside = false ', '; deviceside = true; "apn = apn I pulled from service book which was"blackberry.net "", ""; deviceside = true; ConnectionUID = "once what I found in the book of service using the method of section" yet.

  The device is bold 9780 with data plan. I can open the url of the browser

  The same code works on 9000 "BOLD" without mistakes and I can access the url

  Any suggestions

  It turns out that you can't create a connection during a phone conversation, connection all attempts fail after the time-out is reached and after the end of the phone call connections are successful.

• Add PIX VPN to the already established network of MPLS

  I have a client who operates the site three on a MPLS cloud. Now they want to add more security between these different places. A place internet offers to the United Nations. However, all sites can communicate securely with each other.

  Each location has its own 10... subnet.

  They believe as a PIX at every place on every 10. / subnet and VPN tunnels between each PIX, it's what it takes.

  Is there a third party place connections between these PIX on their MPLS VPN cloud?

  Thanks cowtan. Please mark as resolved post, which might be useful for others. response rate (s) If you found useful responses...

• Problem with HttpConnection when it connects only not to wifi - java.io.IOException: Tunnel failed

  Hi all

  I develop an application that communicates with a database MySQL via PHP stored on the server scripts. Until today I've developed using the Simulator, and everything has been fine. I now started to test on a device and, while being connected to wifi, everything is still fine. However, the minute I turn off wifi and let the network provider, O2 UK, I get:

  "Request failed: reason: java.io.IOException: Tunnel failed".

  The source of the connection code is as follows:

     public void run() {
         // The following code will only build under JDE 4.5 and later
  
         try {
             String connectionParameters = "";
             // JDE 4.3 is required to get WLANInfo
             if (WLANInfo.getWLANState() == WLANInfo.WLAN_STATE_CONNECTED) {
                 // Connected to a WiFi access point
                 connectionParameters = ";interface=wifi";
             } else {
                 int coverageStatus = CoverageInfo.getCoverageStatus();
                 ServiceRecord record = getWAP2ServiceRecord();
                 if (record != null
                         // In JDE 4.5 CoverageInfo changed the name of
  COVERAGE_CARRIER to COVERAGE_DIRECT
                         // The constant value for both is the same,
  '1', so you can use that to avoid any
                         // dependency on JDE 4.5
                         && (coverageStatus & CoverageInfo.COVERAGE_DIRECT) ==
                         CoverageInfo.COVERAGE_DIRECT) {
                     // Have network coverage and a WAP 2.0 service book record
                     connectionParameters = ";deviceside=true;ConnectionUID="
                             + record.getUid();
                 } else if ((coverageStatus & CoverageInfo.COVERAGE_MDS) ==
                         CoverageInfo.COVERAGE_MDS) {
                     // Have an MDS service book and network coverage
                     connectionParameters = ";deviceside=false";
                 } else if ((coverageStatus & CoverageInfo.COVERAGE_DIRECT) ==
                         CoverageInfo.COVERAGE_DIRECT) {
                     // Have network coverage but no WAP 2.0 service book record
                     connectionParameters = ";deviceside=true";
                 }
             }
  
             // Pop up a dialog showing the parameters chosen
             UiApplication.getUiApplication().invokeLater(
                     new DialogRunner("Connection Params: "
                             + connectionParameters));
  
             HttpConnection connection = (HttpConnection) Connector.open(url
                     + connectionParameters);
  
             connection.setRequestMethod(method);
             if (method.equals("POST") && postData != null) {
                 connection.setRequestProperty("Content-type",
                         "application/x-www-form-urlencoded");
                 OutputStream requestOutput = connection.openOutputStream();
                 requestOutput.write(postData);
                 requestOutput.close();
             }
             int responseCode = connection.getResponseCode();
             if (connection instanceof HttpsConnection) {
                 HttpsConnection secureConnection = (HttpsConnection) connection;
                 String issuer = secureConnection.getSecurityInfo()
                         .getServerCertificate().getIssuer();
                 UiApplication.getUiApplication().invokeLater(new
  DialogRunner("Secure Connection! Certificate issued by: " + issuer));
  
             }
             // Really you should check for more than just HTTP_OK
             if (responseCode != HttpConnection.HTTP_OK) {
                 screen.requestFailed("Unexpected response code: "
                         + responseCode);
                 connection.close();
                 return;
             }
  
             String contentType = connection.getHeaderField("Content-type");
             ByteArrayOutputStream baos = new ByteArrayOutputStream();
  
             InputStream responseData = connection.openInputStream();
             byte[] buffer = new byte[10000];
             int bytesRead = responseData.read(buffer);
             while (bytesRead > 0) {
                 baos.write(buffer, 0, bytesRead);
                 bytesRead = responseData.read(buffer);
             }
             baos.close();
             connection.close();
  
             screen.requestSucceeded(baos.toByteArray(), contentType);
         } catch (IOException ex) {
             screen.requestFailed(ex.toString());
         }
     }
  

  I scoured these forums and tried everything I can find. I tried different settings, including changing the APN settings both wap and mobile options for O2. Nothing seems to solve this problem.

  Any help would be appreciated!

  Thank you

  Jack

  OK, good news. Fixed. Thanks a lot for your answers. I would have understood the connection settings as they appear to have been the problem.

  I don't remember exactly which it generated, but I decided to try replacing it with the generator of connectionParameter above with the snippet connSuffix here:
  http://supportforums.BlackBerry.com/T5/Java-development/connecting-your-BlackBerry-http-and-socket-c...

  Worked like a dream, so I'm very indebted to all those who contributed to this. It now seems to work little matter the type of connection is available including BES.

  In case anyone is interested, however, I tried all combinations of settings APN bloody O2, but it came to nothing. I am disappointed that it was the connection settings I developed that a book by Apress, and I followed this particular part, Word for Word.

  Thank you all for the world of useful information here!

• VPN tunnel action

  HELO all

  I'm in this situation:

  I have a tunnel VPN setup and running on a router 1800.
  Our customer wants a tunnel of intervention similar to this (with other peer IP of course).

  When the main vpn tunnel has dropped the other will take over.

  My question: can I put a second peer who will take over when the first falls:

  Nome-240 crypto map ipsec-isakmp crypto
  VPN CLIENT description
  defined by peer 201.94.151.141
  defined by peer 201.94.151.142
  86400 seconds, life of security association set
  the value of the transform-set 3des-sha
  match the address vpn_intlfcstone

  or

  I have to make another card encryption as follows (using the same access list)?

  Nome- 240 crypto map ipsec-isakmp crypto
  VPN CLIENT description
   defined by peer 201.94.151.141 -(main post)
  86400 seconds, life of security association set
  the value of the transform-set 3des-sha
  address for correspondence vpn_intlfcstone

  Nome- 250 crypto map ipsec-isakmp crypto
  VPN CLIENT description
   defined by peer 201.94.151.142 -(second peer)
  86400 seconds, life of security association set
  the value of the transform-set 3des-sha
  address for correspondence vpn_intlfcstone

  The two Tunnel VPN must be on the same router (unfortunately) (1800).

  Hello edilson.silva1,

  You can configure a second IP for backup VPN peer.

  http://www.Cisco.com/c/en/us/TD/docs/iOS-XML/iOS/sec_conn_vpnav/configuration/XE-3s/asr1000/sec-VPN-availability-XE-3s-asr1000-book/sec-IPSec-pref-peer.html#GUID-527C42AE-44EC-4178-BBC3-B65189329B03

  Creating a different sequence in the encryption for the same traffic map will generate a problem that overlap.

• Is there a way to force the router to re-enroll with to take down the tunnel?

  Hi all

  I have the following configuration:

  Crypto pki trustpoint mycompany.com
  number of registration attempts 5
  retry registration period 3
  Enrollment url http://x.x.x.x:80
  Serial number no
  domain name full routername.mycompany.com
  IP address no
  password
  name of the object l = Denver, c = US
  revocation checking no
  automatic registration of the 70s

  Scenario of

  If the certificate has already reached 70 percent of his time of life and the router has already tried 5 times to get a new failure.

  1. is there a way to know how many times the router tried to re-enroll?

  2. is there a way to force the router to re-register without down tunnels?

  3. If the router has already tried, I can increase auto-enrollment to 90 - would this work?

  Thank you very much in advance for your answers.

  See you soon!

  mguzman4158:

  Question 1

  The following command output may indicate failures of re-registration after that as they occur.

  HQ-edg01 #sh crypto pki timers

  PKI timers
  |  1:59:35.732 2D
  |  2D 1:59:35.732 CRL cannot display the COP
  | 353d 8:31:22.880 SURVIVOR CA.domain.null

  Question 2

  This chapter: setting up registration of certificate for a public key infrastructure

  http://www.Cisco.com/en/us/docs/iOS/sec_secure_connectivity/configuration/guide/sec_cert_enroll_pki.PDF

  ... and this chapter: set up and manage a server of Cisco IOS for the deployment of public key infrastructure certificates

  http://www.Cisco.com/en/us/docs/iOS/sec_secure_connectivity/configuration/guide/sec_cfg_mng_cert_serv.PDF

  ... from this Book: Guide of the Cisco IOS Security Configuration: connectivity secure, release 12.4 T

  http://www.Cisco.com/en/us/docs/iOS/sec_secure_connectivity/configuration/guide/12_4t/sec_secure_connectivity_12_4t_book.PDF

  .. could help.

  Question 3

  In my opinion, I think that you would be able to revive the reinstatement at a later date by incrementing the percentage argument.

  Best regards
  Mike

• Tunnel VPN S2S when there is no firewall remote site

  We have a situation where one of our sites (site A) has no firewall. All site a goes on MPLS network to access internet to site B. Site B connects to the rest of our MPLS private including the C Site.

  The MPLS network and routers are all managed provider. This site needs to access a website which is another private company accessible only via a tunnel.

  I know that we can create a tunnel from Site C to site D, but would be possible around site to use this tunnel to get to the site D?

  ccess-list outside_20_cryptomap extended permit ip 10.51.22.224 255.255.255.224 10.22.43.0 255.255.255.0
  access-list outside_20_cryptomap extended permit ip 10.92.0.0 255.255.0.0 10.22.43.0 255.255.255.0
  

  For the second line, everything is OK, assuming 10.92.0.0/16 is the subnet of the site has traffic where should go throug the tunel.

  For the first line, you said that 10.51.22.224/27's wan interface. This interface, I guess that will be used as a tunnel endpoint, so you do not have to include in your ACL crypto (but if you really the intent/need to do, you can do it).

  Just decide what which subnets traffic/traffic should pass through the tunnel for you and include it in your proxy ACL.

  What networks will site D need to config as interesting subnets so that 10.92 at site A can actually access 10.22.43 at site D?
  

  Access between site D and site A, proxy-ID on the website should be the reflection of the second ACE you provided in the ACL on the site c. i.e.:

  access-list outside_20_cryptomap extended permit ip  10.22.43.0 255.255.255.0 10.92.0.0 255.255.0.0 

• DMVPN versus MPLS

  Hello world

  An interesting question for the community.

  If a router is configured with a DMVPN (or simply a VPN) tunnel and at the same time has an ethernet MPLS even remote desktop connection which route is a priority and why?

  Thank you

  Tom

  Hello

  the link I provided above described the idea how this is possible, if you are looking for the MPLS cloud and cloud DMVPN using EIGRP, then I suggest you do the following

  in each router configure two EIGRP (AS) autonomous systems to be used on MPLS and the other to be used on DMVPN and follow the recommendations below

  -to advertise networks in each AS EIGRP that should be available through (assuming that the same networks will be announced on both)

  -do not redistribute between these two EIGRP AS

  -use EIGRP offset-list of roads through the DMVPN tunnel interface make which the metric is higher and less preferred see below link to eigrp offset-list configuration

  http://www.Cisco.com/en/us/Tech/tk365/technologies_tech_note09186a00800c2d96.shtml#modifycompositemetric

  -You can use other methods other than delay llike ofset-list

  for the other config design and recommendations please refer to the example of design in the previous post

  If have any question just after her here

  HTH

  pls note the useful messages

• peer found setting up ipsec tunnel

  I'm trying to configure the vpn between a 6.3 (5) 7.2 (4) pix and asa. everything looks good to me and I can't understand why the tunnel came not.

  PIX

  --------------------------------------

  inside_outbound_nat0_acl ip 10.10.130.0 access list allow 255.255.255.0 10.10.134.0 255.255.255.0

  inside_outbound_nat0_acl ip 10.10.130.0 access list allow 255.255.255.0 10.10.130.20 255.255.255.254

  inside_outbound_nat0_acl ip 10.10.132.0 access list allow 255.255.255.0 10.10.130.20 255.255.255.254

  inside_outbound_nat0_acl ip 10.10.132.0 access list allow 255.255.255.0 10.10.134.0 255.255.255.0

  inside_outbound_nat0_acl ip 10.10.130.0 access list allow 255.255.255.0 10.220.0.0 255.255.255.0

  inside_outbound_nat0_acl ip 10.10.130.0 access list allow 255.255.255.0 10.10.130.160 255.255.255.248

  inside_outbound_nat0_acl ip 10.10.130.0 access list allow 255.255.255.0 10.220.3.0 255.255.255.0

  inside_outbound_nat0_acl ip 10.10.130.0 access list allow 255.255.255.0 10.220.252.0 255.255.255.0

  inside_outbound_nat0_acl ip 10.10.130.0 access list allow 255.255.255.0 10.220.248.0 255.255.252.0

  outside_cryptomap_20 ip 10.10.130.0 access list allow 255.255.255.0 10.10.134.0 255.255.255.0

  outside_cryptomap_20 ip 10.10.130.0 access list allow 255.255.255.0 10.220.0.0 255.255.255.0

  outside_cryptomap_20 ip 10.10.130.0 access list allow 255.255.255.0 10.220.3.0 255.255.255.0

  outside_cryptomap_20 ip 10.10.130.0 access list allow 255.255.255.0 10.220.252.0 255.255.255.0

  outside_cryptomap_20 ip 10.10.130.0 access list allow 255.255.255.0 10.220.248.0 255.255.252.0

  outside_cryptomap_dyn_20 ip access list allow any 10.10.130.20 255.255.255.254

  outside_cryptomap_40 ip 10.10.130.0 access list allow 255.255.255.0 10.10.134.0 255.255.255.0

  outside_cryptomap_40 ip 10.10.132.0 access list allow 255.255.255.0 10.10.134.0 255.255.255.0

  lscctx_splitTunnelAcl ip 10.10.130.0 access list allow 255.255.255.0 any

  outside_cryptomap_dyn_40 ip access list allow any 10.10.130.160 255.255.255.248

  outside_cryptomap_dyn_60 ip access list allow any 10.130.254.0 255.255.255.0

  outside_cryptomap_60 ip 10.10.130.0 access list allow 255.255.255.0 10.130.16.0 255.255.255.0

  outside_cryptomap_60 ip 10.10.132.0 access list allow 255.255.255.0 10.130.16.0 255.255.255.0

  outside_cryptomap_60 ip 10.10.134.0 access list allow 255.255.255.0 10.130.16.0 255.255.255.0

  Permitted connection ipsec sysopt

  Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac

  Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac

  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

  Dynamic crypto map outside_dyn_map 20 match address outside_cryptomap_dyn_20

  Crypto-map dynamic outside_dyn_map 20 the transform-set ESP-DES-MD5 value

  Dynamic crypto map outside_dyn_map 40 correspondence address outside_cryptomap_dyn_40

  Crypto-map dynamic outside_dyn_map 40 the transform-set ESP-3DES-MD5 value

  Dynamic crypto map outside_dyn_map 60 match address outside_cryptomap_dyn_60

  Crypto-map dynamic outside_dyn_map 60 the transform-set ESP-3DES-MD5 value

  outside_map 20 ipsec-isakmp crypto map

  card crypto outside_map 20 match address outside_cryptomap_20

  peer set card crypto outside_map 20 208.77.70.98

  outside_map crypto 20 card value transform-set ESP-3DES-SHA

  outside_map 60 ipsec-isakmp crypto map

  card crypto outside_map 60 match address outside_cryptomap_40

  peer set card crypto outside_map 60 10.130.254.6

  card crypto outside_map 60 the transform-set ESP-3DES-MD5 value

  map outside_map 65535-isakmp ipsec crypto dynamic outside_dyn_map

  client authentication card crypto outside_map LOCAL

  outside_map interface card crypto outside

  ISAKMP allows outside

  ISAKMP key * address 66.15.x, x netmask 255.255.255.255 No.-xauth-no-config-mode

  ISAKMP key * address 208.125.x.x netmask 255.255.255.255 No.-xauth-no-config-mode

  ISAKMP key * address 209.125.x.xnetmask 255.255.255.255 No.-xauth-no-config-mode

  ISAKMP key * address 12.49.x.x netmask 255.255.255.255 No.-xauth-no-config-mode

  ISAKMP key * address 208.77.x.x netmask 255.255.255.255 No.-xauth-no-config-mode

  ISAKMP key * address 10.130.254.2 netmask 255.255.255.255 No.-xauth No. config-mode

  ISAKMP key * address 10.130.254.6 netmask 255.255.255.255 No.-xauth No. config-mode

  ISAKMP identity address

  ISAKMP nat-traversal 60

  part of pre authentication ISAKMP policy 10

  ISAKMP policy 10 3des encryption

  ISAKMP policy 10 sha hash

  10 2 ISAKMP policy group

  ISAKMP life duration strategy 10 86400

  part of pre authentication ISAKMP policy 20

  encryption of ISAKMP policy 20

  ISAKMP policy 20 md5 hash

  20 2 ISAKMP policy group

  ISAKMP duration strategy of life 20 86400

  part of pre authentication ISAKMP policy 40

  ISAKMP policy 40 3des encryption

  ISAKMP policy 40 md5 hash

  40 2 ISAKMP policy group

  ISAKMP duration strategy of life 40 86400

  ASA

  --------------------------

  Access extensive list ip 10.130.16.0 OUTSIDE_CRYPTOMAP allow 255.255.255.0 10.10.130.0 255.255.255.0

  Access extensive list ip 10.130.16.0 OUTSIDE_CRYPTOMAP allow 255.255.255.0 10.10.132.0 255.255.255.0

  Access extensive list ip 10.130.16.0 OUTSIDE_CRYPTOMAP allow 255.255.255.0 10.10.134.0 255.255.255.0

  Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac

  card crypto OUTSIDE_MAP 1 corresponds to the address OUTSIDE_CRYPTOMAP

  card crypto OUTSIDE_MAP 1 set peer 10.10.133.10

  OUTSIDE_MAP 1 transform-set ESP-3DES-MD5 crypto card game

  OUTSIDE_MAP interface card crypto outside

  crypto isakmp identity address

  crypto ISAKMP allow outside

  crypto ISAKMP policy 10

  preshared authentication

  3des encryption

  md5 hash

  Group 2

  life 86400

  tunnel-group 10.10.133.10 type ipsec-l2l

  IPSec-attributes tunnel-group 10.10.133.10

  pre-shared-key *.

  !

  !

  PIX of debugging

  ------------------------------------

  CT - PIX #.

  crypto_isakmp_process_block:src:10.130.254.6, dest:10.10.133.10 spt:500 dpt:500

  Exchange OAK_MM

  ISAKMP (0): treatment ITS payload. Message ID = 0

  ISAKMP (0): audit ISAKMP transform 1 against the policy of priority 10

  ISAKMP: default group 2

  ISAKMP: 3DES-CBC encryption

  ISAKMP: MD5 hash

  ISAKMP: preshared auth

  ISAKMP: type of life in seconds

  ISAKMP: lifespan (IPV) 0 x 0 0 x 1 0 x 51 0x80

  ISAKMP (0): atts are not acceptable. Next payload is 0

  ISAKMP (0): audit ISAKMP transform 1 against 20 priority policy

  ISAKMP: default group 2

  ISAKMP: 3DES-CBC encryption

  ISAKMP: MD5 hash

  ISAKMP: preshared auth

  ISAKMP: type of life in seconds

  ISAKMP: lifespan (IPV) 0 x 0 0 x 1 0 x 51 0x80

  ISAKMP (0): atts are not acceptable. Next payload is 0

  ISAKMP (0): audit ISAKMP transform 1 against the 40 priority policy

  ISAKMP: default group 2

  ISAKMP: 3DES-CBC encryption

  ISAKMP: MD5 hash

  ISAKMP: preshared auth

  ISAKMP: type of life in seconds

  ISAKMP: lifespan (IPV) 0 x 0 0 x 1 0 x 51 0x80

  ISAKMP (0): atts are acceptable. Next payload is 0

  ISAKMP (0): load useful treatment vendor id

  ISAKMP (0): ITS been pre-shared key, using id ID_IPV4_ADDR type authentication

  to return to the State is IKMP_NO_ERROR

  ISAKMP (0): retransmission of the phase 1 (0)...

  crypto_isakmp_process_block:src:10.130.254.6, dest:10.10.133.10 spt:500 dpt:500

  Peer VPN: ISAKMP: Peer Info for 10.130.254.6/500 not found - peer: 0

  ISAKMP: its larva is found

  ISAKMP (0): retransmission of the phase 1 (1)...

  ISAKMP (0): retransmission of the phase 1 (2)...

  crypto_isakmp_process_block:src:10.130.254.6, dest:10.10.133.10 spt:500 dpt:500

  Peer VPN: ISAKMP: Peer Info for 10.130.254.6/500 not found - peer: 0

  ISAKMP: its larva is found

  ISAKMP (0): retransmission of the phase 1 (3)...

  crypto_isakmp_process_block:src:10.130.254.6, dest:10.10.133.10 spt:500 dpt:500

  Peer VPN: ISAKMP: Peer Info for 10.130.254.6/500 not found - peer: 0

  ISAKMP: its larva is found

  ISAKMP (0): retransmission of the phase 1 (4)...

  ISAKMP (0): delete SA: src 10.130.254.6 dst 10.10.133.10

  ISADB: Reaper checking HIS 0 x 1143144, id_conn = 0 DELETE IT!

  Peer VPN: ISAKMP: Peer Info for 10.130.254.6/500 not found - peer: 0

  ASA of DEUG

  --------------------------------------

  CT-STEPHEN-ASA # 18 Jul 20:08:23 [IKEv1 DEBUG]: pitcher: a message key acquisition, spi 0 x 0

  18 Jul 20:08:23 [IKEv1]: IP = 10.10.133.10, initiator of IKE: New Phase 1, Intf inside, IKE Peer 10.10.133.10 address local proxy 10.130.16.0, address remote Proxy 10.10.130.0, Card Crypto (OUTSIDE_MAP)

  18 Jul 20:08:23 [IKEv1 DEBUG]: IP = 10.10.133.10, build the payloads of ISAKMP security

  18 Jul 20:08:23 [IKEv1 DEBUG]: IP = 10.10.133.10, construction of Fragmentation VID + load useful functionality

  18 Jul 20:08:23 [IKEv1]: IP = 10.10.133.10, IKE_DECODE SEND Message (msgid = 0) with payloads: HDR + HER (1), SELLER (13) + (0) NONE total length: 108

  SENDING PACKETS to 10.10.133.10

  ISAKMP header

  Initiator COOKIE: 28 31 24 50 42 4-5 ba has

  Responder COOKIE: 00 00 00 00 00 00 00 00

  Next payload: Security Association

  Version: 1.0

  Exchange type: Protection of identity (Main Mode)

  Indicators: (none)

  MessageID: 00000000

  Length: 108

  Payload security association

  Next payload: Vendor ID

  Booked: 00

  Payload length: 56

  DOI: IPsec

  Situation: (SIT_IDENTITY_ONLY)

  Proposal of payload

  Next payload: no

  Booked: 00

  Payload length: 44

  Proposal #: 1

  Protocol-Id: PROTO_ISAKMP

  SPI size: 0

  number of transformations: 1

  Transformation of the payload

  Next payload: no

  Booked: 00

  Payload length: 36

  Transform #: 1

  Transform-Id: KEY_IKE

  Reserved2: 0000

  Description of the Group: Group 2

  Encryption algorithm: 3DES-CBC

  The hashing algorithm: MD5

  Authentication method: pre-shared key

  Type of life: seconds

  Life (Hex): 00 01 51 80

  Vendor ID payload

  Next payload: no

  Booked: 00

  Payload length: 24

  Data (in hexadecimal):

  40 48 b7 d5 6th e8 85 25 e7 7f 00 c2 d3 d6 bc

  C0 00 00 00

  18 Jul 20:08:25 [IKEv1 DEBUG]: pitcher: a message key acquisition, spi 0 x 0

  18 Jul 20:08:25 [IKEv1]: IP = 10.10.133.10, Queuing KEY-ACQUIRE messages are treated when SA P1 is finished.

  18 Jul 20:08:27 [IKEv1 DEBUG]: pitcher: a message key acquisition, spi 0 x 0

  18 Jul 20:08:27 [IKEv1]: IP = 10.10.133.10, Queuing KEY-ACQUIRE messages are treated when SA P1 is finished.

  18 Jul 20:08:29 [IKEv1 DEBUG]: pitcher: a message key acquisition, spi 0 x 0

  18 Jul 20:08:29 [IKEv1]: IP = 10.10.133.10, Queuing KEY-ACQUIRE messages are treated when SA P1 is finished.

  18 Jul 20:08:31 [IKEv1]: IP = 10.10.133.10, IKE_DECODE new SEND Message (msgid = 0) with payloads: HDR + HER (1), SELLER (13) + (0) NONE total length: 108

  ISAKMP header

  Initiator COOKIE: 28 31 24 50 42 4-5 ba has

  Responder COOKIE: 00 00 00 00 00 00 00 00

  Next payload: Security Association

  Version: 1.0

  Exchange type: Protection of identity (Main Mode)

  Indicators: (none)

  MessageID: 00000000

  Length: 108

  Payload security association

  Next payload: Vendor ID

  Booked: 00

  Payload length: 56

  DOI: IPsec

  Situation: (SIT_IDENTITY_ONLY)

  Proposal of payload

  Next payload: no

  Booked: 00

  Payload length: 44

  Proposal #: 1

  Protocol-Id: PROTO_ISAKMP

  SPI size: 0

  number of transformations: 1

  Transformation of the payload

  Next payload: no

  Booked: 00

  Payload length: 36

  Transform #: 1

  Transform-Id: KEY_IKE

  Reserved2: 0000

  Description of the Group: Group 2

  Encryption algorithm: 3DES-CBC

  The hashing algorithm: MD5

  Authentication method: pre-shared key

  Type of life: seconds

  Life (Hex): 00 01 51 80

  Vendor ID payload

  Next payload: no

  Booked: 00

  Payload length: 24

  Data (in hexadecimal):

  40 48 b7 d5 6th e8 85 25 e7 7f 00 c2 d3 d6 bc

  C0 00 00 00

  18 Jul 20:08:31 [IKEv1 DEBUG]: pitcher: a message key acquisition, spi 0 x 0

  18 Jul 20:08:31 [IKEv1]: IP = 10.10.133.10, Queuing KEY-ACQUIRE messages are treated when SA P1 is finished.

  18 Jul 20:08:39 [IKEv1]: IP = 10.10.133.10, IKE_DECODE new SEND Message (msgid = 0) with payloads: HDR + HER (1), SELLER (13) + (0) NONE total length: 108

  ISAKMP header

  Initiator COOKIE: 28 31 24 50 42 4-5 ba has

  Responder COOKIE: 00 00 00 00 00 00 00 00

  Next payload: Security Association

  Version: 1.0

  Exchange type: Protection of identity (Main Mode)

  Indicators: (none)

  MessageID: 00000000

  Length: 108

  Payload security association

  Next payload: Vendor ID

  Booked: 00

  Payload length: 56

  DOI: IPsec

  Situation: (SIT_IDENTITY_ONLY)

  Proposal of payload

  Next payload: no

  Booked: 00

  Payload length: 44

  Proposal #: 1

  Protocol-Id: PROTO_ISAKMP

  SPI size: 0

  number of transformations: 1

  Transformation of the payload

  Next payload: no

  Booked: 00

  Payload length: 36

  Transform #: 1

  Transform-Id: KEY_IKE

  Reserved2: 0000

  Description of the Group: Group 2

  Encryption algorithm: 3DES-CBC

  The hashing algorithm: MD5

  Authentication method: pre-shared key

  Type of life: seconds

  Life (Hex): 00 01 51 80

  Vendor ID payload

  Next payload: no

  Booked: 00

  Payload length: 24

  Data (in hexadecimal):

  40 48 b7 d5 6th e8 85 25 e7 7f 00 c2 d3 d6 bc

  C0 00 00 00

  18 Jul 20:08:47 [IKEv1]: IP = 10.10.133.10, IKE_DECODE new SEND Message (msgid = 0) with payloads: HDR + HER (1), SELLER (13) + (0) NONE total length: 108

  ISAKMP header

  Initiator COOKIE: 28 31 24 50 42 4-5 ba has

  Responder COOKIE: 00 00 00 00 00 00 00 00

  Next payload: Security Association

  Version: 1.0

  Exchange type: Protection of identity (Main Mode)

  Indicators: (none)

  MessageID: 00000000

  Length: 108

  Payload security association

  Next payload: Vendor ID

  Booked: 00

  Payload length: 56

  DOI: IPsec

  Situation: (SIT_IDENTITY_ONLY)

  Proposal of payload

  Next payload: no

  Booked: 00

  Payload length: 44

  Proposal #: 1

  Protocol-Id: PROTO_ISAKMP

  SPI size: 0

  number of transformations: 1

  Transformation of the payload

  Next payload: no

  Booked: 00

  Payload length: 36

  Transform #: 1

  Transform-Id: KEY_IKE

  Reserved2: 0000

  Description of the Group: Group 2

  Encryption algorithm: 3DES-CBC

  The hashing algorithm: MD5

  Authentication method: pre-shared key

  Type of life: seconds

  Life (Hex): 00 01 51 80

  Vendor ID payload

  Next payload: no

  Booked: 00

  Payload length: 24

  Data (in hexadecimal):

  40 48 b7 d5 6th e8 85 25 e7 7f 00 c2 d3 d6 bc

  C0 00 00 00

  18 Jul 20:08:55 [IKEv1 DEBUG]: IP = 10.10.133.10, case of mistaken IKE MM Initiator WSF (struct & 0x1d24750) , : MM_DONE, EV_ERROR--> MM_WAIT_MSG2, EV_RETRY--> MM_WAIT_MSG2, EV_TIMEOUT--> MM_WAIT_MSG2 NullEvent--> MM_SND_MSG1, EV_SND_MSG--> MM_SND_MSG1, EV_START_TMR--> MM_SND_MSG1, EV_RESEND_MSG--> MM_WAIT_MSG2, EV_RETRY

  18 Jul 20:08:55 [IKEv1 DEBUG]: IP = 10.10.133.10, IKE SA MM:50243128 ending: flags 0 x 01000022, refcnt 0, tuncnt 0

  18 Jul 20:08:55 [IKEv1 DEBUG]: IP = 10.10.133.10, sending clear/delete with the message of reason

  18 Jul 20:08:55 [IKEv1]: IP = 10.10.133.10, Removing peer to peer table has no, no match!

  18 Jul 20:08:55 [IKEv1]: IP = 10.10.133.10, error: cannot delete PeerTblEntry

  Sorry, just trying to think why it cannot find the peer, with the following error message:

  Peer VPN: ISAKMP: Peer Info for 10.130.254.6/500 not found - peer: 0

  While, in fact 10.130.254.6 is configured as directed by your post.

  Configuration seems correct to me. You might want to try to reload the PIX.

• LAN to LAN VPN by MPLS

  

  We have 2 sites HQ and remote connected with MPLS as pictured above. There are applications in the DMZ s who need to talk to each other, but the communication goes through the remote local network (DMZ - LAN HQ - HQ DMZ) but we do not want the DMZ to communicate with each other via the local network. We want to configure a VPN tunnel between Headquarters and remote Firewalls so that all communications between the DMZ through a VPN MPLS tunnel via the LAN. Is this considered a Layer2 VPN or Layer 3 VPN model and also is there a special setup that needs to be done other than config normal site-to-site VPN Firewall.

  Thank you

  This is the layer 3 VPN and no special configuration required on the firewall other than the normal site-to-site VPN. Just activate the isakmp and apply crypto map to the LAN interface.