Protection of IPSEC Tunnel and tunnel QOS shaping does no formatting.

Similar Questions

• Voice and IPSEC Tunnels

  In which case I use a DMVPN IPSEC technology for branch connectivity, used ISP know what kind of traffic I run because it is encrypted in the end.

  DMVPN package use is first encapsulated in GRE and then encrypted with IPSEC authentication information. Because the ultimate traffic is IPSEC requires ISP/provider leave the port UDP 500 and ESP open. Once the tunnel is created I can pass any type of traffic because it will use ESP.

  Given what I saw a few deployments where we put in place this kind of solution and telephone traffic did not and ip phones were unable to register. Most of the guys have pointed out that it could possibly be because ISP blocks the SCCP traffic, but my concern is that if we have a branch at Headquarters IPSEC tunnel how the ISP can detect this thing and drop it.

  Please provide feedback on this.

  The provider cannot see inside the tunnel. Only, he could assume that it could be the voice traffic:

  The voice parameters the value DSCP-in IP header when they send traffic. These values are copied to the outer IP header when the traffic is encrypted. With this function you can also do QoS on encrypted traffic.

  But I do not think that a provider might filter on this traffic.

  --
  Don't stop once you have upgraded your network! Improve the world by lending money to low-income workers:
  http://www.Kiva.org/invitedBy/karsteni

• Decision on DMVPN and L2L simple IPsec tunnels

  I have a project where I need to make a decision on which solution to implement... environment is as follows...

  • 4 branches.
  • Each branch has 2 subnets; one for DATA and another for VOICE
  • 2 ISPS in each (an Internet access provider and a provider of MPLS)
  • Branch #1 isn't necessarily the HUB office that all database servers and files are there are
  • Branch #2 is actually where the phone equipment
  • Other 2 branches are just branches speaks (may not need never DATA interconnectivy, but they do need interconnection VOICE when they call since we spoke directly to the other)
  • MPLS is currently used for telephone traffic.
  • ISP provider link is used for site to site tunnels that traverse the internet, and it is the primary path for DATA. Means that all branch DATA subnets use the tunnels from site to site as main road to join the #1 branch where all files and databases are located.
  • I'd like to have redundancy in case the network MPLS down for all traffic VOICE switch to L2L tunnels.

  My #1 Option

  Because it isn't really a star to the need, I don't really know if I want to apply DMVPN, although I read great things about it. In addition, another reason, I would have perhaps against DMVPN is the 'delay' involved, at least during initialization, communications having spoke-to-spoke. There is always a broken package when a department wants to initiate communication with one another.

  My #2 Option

  My other choice is just deploy L2L IPSec tunnels between all 4 branches. It's certainly much easier to install than DMVPN although DMVPN can without routing protocols that I think I'll need. But with these Plains L2L IPSec tunnels, I can also add the GRE tunnels and the routing of traffic protocols it as well as all multicast traffic. In addition, I can easily install simple IP SLA that will keep all tunnels upwards forever.

  Can someone please help to choose one over the other is? or if I'm just okay with the realization of the #2 option

  Thanks in advance

  Hi ciscobigcat

  Yes, OSPF will send periodic packets 'Hello' and they will maintain the tunnels at all times.

  The numbers that you see (143 and 1001) are the "cost" of the track, so OSPF (Simplified) will calculate what different paths there are to a destination and assign each of them a 'cost' (by assigning a cost to each segment of the path, for example GigabitEthernet is "lower cost" Fastethernet and then adding the costs of all segments).

  Then it will take the path to the lowest cost (143 in your case, in normal operation) and insert this in the routing table.

  So since traffic is already going the right way, I don't know if you still need any tweaking? Personally, I would not add a second routing protocol because, generally, makes things more complicated.

  QoS, it is important to use "prior qos rank".

  See for example

  http://www.Cisco.com/en/us/docs/solutions/Enterprise/WAN_and_MAN/QoS_SRND/IPSecQoS.html

  http://www.Cisco.com/en/us/Tech/tk543/tk757/technologies_tech_note09186a00800b3d15.shtml

  HTH

  Herbert

• IPSec tunnel between a client connection mobility and WRV200

  Someone has set up an IPSec tunnel between a client connection mobility and WRV200? I can't get the right configuration.

  Agitation, these products are treated by the Cisco Small Business support community. Please refer to the URL: https://supportforums.cisco.com/community/netpro/small-business

• IPSec Tunnel between Cisco 2801 and Netscren 50 with NAT and static

  Hello

  My problem isn't really the IPSec connection between two devices (it is already done...) But my problem is that I have a mail server on the site of Cisco, who have a static NAT from inside to outside. Due to the static NAT, I do not see the server in the VPN tunnel. I found a document that almost describes the problem:

  "Configuration of a router IPSEC Tunnel private-to-private network with NAT and static" (Document ID 14144)

  NAT takes place before the encryption verification!

  In this document, the solution is 'routing policy' using the loopback interface. But, how can I handle this with the Netscreen firewall. Someone has an idea?

  Thanks for any help

  Best regards

  Heiko

  Hello

  Try to change your static NAT with static NAT based policy.

  That is to say the static NAT should not be applicable for VPN traffic

  permissible static route map 1

  corresponds to the IP 104

  access-list 104 refuse host ip 10.1.110.10 10.1.0.0 255.255.0.0

  access-list 104 allow the host ip 10.1.110.10 all

  IP nat inside source static 10.1.110.10 81.222.33.90 map of static route

  HTH

  Kind regards

  GE.

• Policy Nat and IPSec tunnel

  Hello

  I have a Cisco IOS router and you want to configure an IPSec tunnel between myself and the client.  Unfortunately, we have two overlapping of 10 network IP addresses.

  Is it possible for me to just Nat addresses IP on my side or should the customer Nat as well?

  I have configured NAT on the inside of the interface for 10.134.206.1 to 192.168.156.6 so that Nat happens before that packages are encrypted in the tunnel, however tunnel is not coming.    The client uses a sonic firewall and allowed their 10.91.0.0/16 network 192.168.156.0/24.

  See attachment

  Kind regards

  They are wrong to installation.  Remote local networks are not 10.134.206.0 and 10.134.206/42.  It is simply your public IP address.

• IPSec tunnel and NetFlow packets

  I have a router 1841 IPSec running with an ASA. F0/0 is the source interface. I also set up NetFlow, which must be sent through the IPSec tunnel to the parser. The acl setting the IPSec interesting traffic covers addresses, source and destination of NetFlow. But NetFlow Traffic is not captured by the tunnel. When I ping the destination router, icmp traffic is picked up and goes through the tunnel. Are there ways to force NetFlow traffic to go to the tunnel?

  Thank you.

  Y at - it a route to the destination address of netflow? I have noted problems with traffic heading towards a destination that was not in the routing table is not made down a VPN.

• IPSec tunnels does not work

  I have 2 Cat6, with IPsec SPA card, while the other did not.

  I tried setting IPsec tunnel between them, but somehow can't bring up the tunnel, can someone help me to watch set it up?

  A (with SPA):

  crypto ISAKMP policy 1

  BA aes 256

  preshared authentication

  Group 5

  ISAKMP crypto cisco123 key address 0.0.0.0 0.0.0.0

  ISAKMP crypto keepalive 10

  Crypto ipsec transform-set esp - aes 256 esp-sha-hmac testT1

  !

  Crypto ipsec profile P1

  Set transform-set testT1

  !

  Crypto call admission limit ike his 3000

  !

  Crypto call admission limit ike in-negotiation-sa 115

  !

  interface Tunnel962

  Loopback962 IP unnumbered

  tunnel GigabitEthernet2/37.962 source

  tunnel destination 172.16.16.6

  ipv4 ipsec tunnel mode

  Profile of tunnel P1 ipsec protection

  interface GigabitEthernet2/37.962

  encapsulation dot1Q 962

  IP 172.16.16.5 255.255.255.252

  interface Loopback962

  1.1.4.200 the IP 255.255.255.255

  IP route 2.2.4.200 255.255.255.255 Tunnel962

  B (wuthout SPA):

  crypto ISAKMP policy 1

  BA aes 256

  preshared authentication

  Group 5

  ISAKMP crypto cisco123 key address 0.0.0.0 0.0.0.0

  !

  !

  Crypto ipsec transform-set esp - aes 256 esp-sha-hmac T1

  !

  Crypto ipsec profile P1

  game of transformation-T1

  interface Tunnel200

  Loopback200 IP unnumbered

  tunnel GigabitEthernet2/1.1 source

  tunnel destination 172.16.16.5

  ipv4 ipsec tunnel mode

  Profile of tunnel T1 ipsec protection

  interface Loopback200

  2.2.4.200 the IP 255.255.255.255

  interface GigabitEthernet2/1.1

  encapsulation dot1Q 962

  IP 172.16.16.6 255.255.255.252

  IP route 1.1.4.200 255.255.255.255 Tunnel200

  I can ping from 172.16.16.6 to 172.16.16.5, but the tunnel just can not upwards. When I turned on "debugging ipsec cry ' and ' debug cry isa", nothing comes out, when I trun on 'cry of debugging sciences', I got:

  "00:25:17: crypto_engine_select_crypto_engine: can't handle more."

  Hello

  You need a map of IPSEC SPA on chassis B do IPSEC encryption. Please see the below URL for more details.

  Without a SPA-IPSEC - 2G or IPsec VPN Services Module of acceleration, the IPsec network security feature (configured with the crypto ipsec command) is supported in the software only for administrative for Catalyst 6500 series switches and routers for the Cisco 7600 Series connections.

  http://www.Cisco.com/en/us/docs/switches/LAN/catalyst6500/IOS/12.2SXF/native/release/notes/OL_4164.html

  Kind regards

  Arul

  * Rate pls if it helps *.

• Public static IPsec tunnel between two routers cisco [VRF aware]

  Hi all

  I am trying to configure static IPsec tunnel between two routers. Router R1 has [no VRF] only global routing table.

  Router R2 has two routing tables:

  * vrf INET - used for internet connectivity

  * global routing table - used for VPN connections

  Here are the basic configs:

  R1

  crypto ISAKMP policy 1
  BA 3des
  md5 hash
  preshared authentication
  Group 2
  ISAKMP crypto key 7V7u841k2D3Q7v98d6Y4z0zF address 203.0.0.3
  invalid-spi-recovery crypto ISAKMP
  !
  Crypto ipsec transform-set esp - aes 256 esp-sha-hmac TRSET_AES-256_SHA
  transport mode
  !
  Crypto ipsec TUNNEL-IPSEC-PROTECTION profile
  game of transformation-TRSET_AES-256_SHA
  !
  interface Loopback0
  10.0.1.1 IP address 255.255.255.255
  IP ospf 1 zone 0
  !
  interface Tunnel0
  IP 192.168.255.34 255.255.255.252
  IP ospf 1 zone 0
  source of tunnel FastEthernet0/0
  tunnel destination 203.0.0.3
  ipv4 ipsec tunnel mode
  Ipsec TUNNEL-IPSEC-PROTEC protection tunnel profile
  !
  interface FastEthernet0/0
  IP 102.0.0.1 255.255.255.0

  !

  IP route 203.0.0.3 255.255.255.255 FastEthernet0/0 102.0.0.2

  #######################################################

  R2

  IP vrf INET
  RD 1:1
  !
  Keyring cryptographic test vrf INET
  address of pre-shared-key 102.0.0.1 key 7V7u841k2D3Q7v98d6Y4z0zF
  !
  crypto ISAKMP policy 1
  BA 3des
  md5 hash
  preshared authentication
  Group 2
  invalid-spi-recovery crypto ISAKMP
  crypto isakmp profile test
  door-key test
  function identity address 102.0.0.1 255.255.255.255
  !
  Crypto ipsec transform-set esp - aes 256 esp-sha-hmac TRSET_AES-256_SHA
  transport mode
  !
  Crypto ipsec TUNNEL-IPSEC-PROTECTION profile
  game of transformation-TRSET_AES-256_SHA
  Test Set isakmp-profile
  !
  interface Loopback0
  IP 10.0.2.2 255.255.255.255
  IP ospf 1 zone 0
  !
  interface Tunnel0
  IP 192.168.255.33 255.255.255.252
  IP ospf 1 zone 0
  source of tunnel FastEthernet0/0
  tunnel destination 102.0.0.1
  ipv4 ipsec tunnel mode
  tunnel vrf INET
  Ipsec TUNNEL-IPSEC-PROTEC protection tunnel profile
  !
  interface FastEthernet0/0
  IP vrf forwarding INET
  IP 203.0.0.3 255.255.255.0

  !

  IP route 102.0.0.1 255.255.255.255 FastEthernet0/0 203.0.0.2

  #######################################################

  There is a router between R1 and R2, it is used only for connectivity:

  interface FastEthernet0/0
  IP 102.0.0.2 255.255.255.0
  !
  interface FastEthernet0/1
  IP 203.0.0.2 255.255.255.0

  The problem that the tunnel is not coming, I can't pass through phase I.

  The IPsec VPN are not my strength. So if someone could show me what mistake I make, I'd appreciate it really.

  I joined ouptup #debug R2 crypto isakmp

  Source and destination Tunnel0 is belong to VRF INET, the static route need to be updated.

  IP route vrf INET 102.0.0.1 255.255.255.255 FastEthernet0/0 203.0.0.2

  crypto isakmp profile test

  VRF INET

  door-key test
  function identity address 102.0.0.1 255.255.255.255

• IPSec tunnel between 2 routers

  Hello

  I am trying to configure an IPSec VPN tunnel between 2 routers Cisco, connected to the internet via the ATM interface, my router is a 1841 with the network 10.200.36.0 address the remote router is a Cisco network 192.168.9.0 address with 877.

  I have tryied to follow some tutorials, unsuccessfully, because I can't always ping all IP addresses on the remote network and also the VPN tunnel is not up!

  Can help you please give me a configuration model, or maybe let me know how to configure step by step on mine and remote router?

  Thank you very much!

  Concerning

  Riccardo

  Here is an example. x.x.x.x and y.y.y.y are the public IPs of routers:

  ROUTER1 hostname

  !

  crypto ISAKMP policy 10

  BA aes 256

  AUTH pre

  Group 5

  !

  ISAKMP crypto key cisco1234 address y.y.y.y

  !

  Crypto ipsec transform-set ESP-AES256-SHA1 esp - aes 256 esp-sha-hmac

  !

  Profile of crypto ipsec TunnelProfile

  the transform ESP-AES256-SHA1 value

  !

  interface Tunnel0

  IP 10.255.255.0 255.255.255.254

  tunnel Dialer source 0

  tunnel destination y.y.y.y

  ipv4 ipsec tunnel mode

  Tunnel TunnelProfile ipsec protection profile

  !

  interface Dialer0

  IP x.x.x.x

  !

  IP route 192.168.9.0 255.255.255.0 Tunnel0

  hostname ROUTER2

  !

  crypto ISAKMP policy 10

  BA aes 256

  AUTH pre

  Group 5

  !

  ISAKMP crypto cisco1234 key address x.x.x.x

  !

  Crypto ipsec ESP-AES256-SHA1 transform-set esp - aes 256 esp-sha-hmac

  !

  Profile of crypto ipsec TunnelProfile

  the transform ESP-AES256-SHA1 value

  !

  interface Tunnel0

  IP 10.255.255.1 255.255.255.254

  tunnel Dialer source 0

  tunnel destination x.x.x.x

  ipv4 ipsec tunnel mode

  Tunnel TunnelProfile ipsec protection profile

  !

  interface Dialer0

  IP address y.y.y.y

  !

  IP route 10.200.36.0 255.255.255.0 Tunnel0

  --
  Don't stop once you have upgraded your network! Improve the world by lending money to low-income workers:
  http://www.Kiva.org/invitedBy/karsteni

• WILL secure IPSec tunnel

  Hi all

  I have just set up an IPSec tunnel, except use debug crypto ipsec / isakmp how can I check IPSec works? When I configure the encryption card, can I use ip of the tunnel as the peer address.

  Thanks in advance.

  Banlan

  Hi Banlan,

  Thanks for your appreciation. I feel honoured!

  Back to your question about free WILL inside the IPSec, you must use the gre as the Protocol in the access list; This right, shud you get points for that! (because the ip packet is encapsulated by GRE and then AH / ESP headers are added). Also remember that the ip address as the destination of the tunnel should be globally routable. You cannot use tunneling as a destination of the tunnel (except of course when the routers are connected back to back)

  See the following configs for GRE inside IPSec.

  ! ON THE INITIATOR

  ...

  ...

  access-list 110 permit host WILL

  ...

  12 crypto isakmp policy

  preshared authentication

  !

  address ISAKMP crypto key xxxxx

  Crypto ipsec transform-set esp TS - a

  !

  card 11 CM ipsec-isakmp crypto

  defined by peers

  game of transformation-TS

  match address 110

  !

  tunnel1 interface

  IP unnumbered

  source of tunnel

  tunnel destination

  card crypto CM

  !

  interface

  card crypto CM

  !

  IP route x.x.x.x tunnel1

  ! ON THE ANSWERING MACHINE

  ...

  ...

  access-list 111 allow host WILL

  ...

  crypto ISAKMP policy 11

  preshared authentication

  !

  address ISAKMP crypto key xxxxx

  Crypto ipsec transform-set esp TS - a

  !

  Map 10 CM ipsec-isakmp crypto

  defined by peers

  game of transformation-TS

  match address 111

  !

  interface tunnels2

  IP unnumbered

  source of tunnel

  tunnel destination

  card crypto CM

  !

  interface

  card crypto CM

  !

  IP route x.x.x.x tunnels2

  I think you have the answer now. Catch me if you want something else.

  Cheers :-))

  Naveen

  [email protected] / * /.

• Cisco 1841 ipsec tunnel protocol down after a minute

  I have a strange problem where im manages to get a tha cisco ipsec tunnel 1841 to a RV016 linksys/cisco for about a minute and ping/encrypt the packets through the linen for about a minute before it breaks down. I tried different configuration and it all results in the tunnel for a minute then descend to come. I don't know if im hitting a bug and decide to if im doing something wrong.

  any help is appreciated paul

  RV016 firmware 2.0.18

  Cisco 1841: C1841-ADVENTERPRISEK9-M), Version 12.4 (24) T

  my config

  no default isakmp crypto policy

  !

  crypto ISAKMP policy 1

  BA 3des

  md5 hash

  preshared authentication

  Group 2

  lifetime 28800

  ISAKMP crypto key address 0.0.0.0 eaton1234 0.0.0.0

  !

  !

  Crypto ipsec transform-set esp-3des esp-sha-hmac ESSTS

  transport mode

  no default crypto ipsec transform-set

  !

  Crypto ipsec profile ipsec_profile1

  Description in the location main site to site VPN tunnel

  game of transformation-ESSTS

  PFS group2 Set

  !

  !

  !

  !

  !

  !

  !

  Tunnel1 interface

  Description of the location of the hand

  IP unnumbered Serial0/0/0

  source of tunnel Serial0/0/0

  destination 209.213.x.x tunnel

  ipv4 ipsec tunnel mode

  tunnel path-mtu-discovery

  protection of ipsec profile ipsec_profile1 tunnel

  !

  a debug output

  Apr 24 16:42:07: IPSEC (validate_proposal_request): part #1 the proposal

  Apr 24 16:42:07: IPSEC (validate_proposal_request): part #1 of the proposal

  (Eng. msg key.) Local INCOMING = 209.213.xx.46, distance = 209.213.xx.164,.

  local_proxy = 10.20.86.0/255.255.255.0/0/0 (type = 4),

  remote_proxy = 10.0.0.0/255.255.255.0/0/0 (type = 4),

  Protocol = ESP, transform = NONE (Tunnel),

  lifedur = 0 and 0kb in

  SPI = 0 x 0 (0), id_conn = 0, keysize = 0, flags = 0 x 0

  Apr 24 16:42:07: mapdb Crypto: proxy_match

  ADR SRC: 10.20.86.0

  ADR DST: 10.0.0.0

  Protocol: 0

  SRC port: 0

  DST port: 0

  Apr 24 16:42:07: IPSEC (key_engine): had an event of the queue with 1 KMI message (s)

  Apr 24 16:42:07: mapdb Crypto: proxy_match

  ADR SRC: 10.20.86.0

  ADR DST: 10.0.0.0

  Protocol: 0

  SRC port: 0

  DST port: 0

  Apr 24 16:42:07: IPSEC (policy_db_add_ident): src dest 10.0.0.0, 10.20.86.0, dest_port

  0

  Apr 24 16:42:07: IPSEC (create_sa): its created.

  (his) sa_dest = 209.213.xx.46, sa_proto = 50,.

  sa_spi = 0x4CF51011 (1291128849).

  sa_trans = sa_conn_id of hmac-sha-esp, esp-3des = 2045

  sa_lifetime(k/sec) = (4463729/3600)

  Apr 24 16:42:07: IPSEC (create_sa): its created.

  (his) sa_dest = 209.213.xx.164, sa_proto = 50,.

  sa_spi = 0x1EB77DAF (515341743).

  sa_trans = sa_conn_id of hmac-sha-esp, esp-3des = 2046

  sa_lifetime(k/sec) = (4463729/3600)

  Apr 24 16:42:07: % LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel1, sta changed

  you to

  Apr 24 16:42:07: IPSEC (key_engine): had an event of the queue with 1 KMI message (s)

  Apr 24 16:42:07: IPSEC (key_engine_enable_outbound): rec would notify of ISAKMP

  Apr 24 16:42:07: IPSEC (key_engine_enable_outbound): select SA with spinnaker 515341743/50

  Apr 24 16:42:07: IPSEC (update_current_outbound_sa): update peer 209.213.xx.164 curre

  NT his outgoing to SPI 1EB77DAF

  Apr 24 16:42:12: IPSEC (key_engine): request timer shot: count = 1,.

  local (identity) = 209.213.xx.46, distance = 209.213.xx.164,

  local_proxy = 0.0.0.0/0.0.0.0/0/0 (type = 4),

  remote_proxy = 0.0.0.0/0.0.0.0/0/0 (type = 4)

  Apr 24 16:42:12: IPSEC (sa_request):,.

  (Eng. msg key.) Local OUTGOING = 209.213.xx.46, distance = 209.213.xx.164,.

  local_proxy = 0.0.0.0/0.0.0.0/0/0 (type = 4),

  remote_proxy = 0.0.0.0/0.0.0.0/0/0 (type = 4),

  Protocol = ESP, transform = esp-3des esp-sha-hmac (Tunnel),

  lifedur = 3600 s and KB 4608000,

  SPI = 0 x 0 (0), id_conn = 0, keysize = 0, flags = 0 x 0

  Apr 24 16:42:42: IPSEC (key_engine): request timer shot: count = 2,.

  local (identity) = 209.213.xx.46, distance = 209.213.xx.164,

  local_proxy = 0.0.0.0/0.0.0.0/0/0 (type = 4),

  remote_proxy = 0.0.0.0/0.0.0.0/0/0 (type = 4)

  Apr 24 16:42:42: % LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel1, sta changed

  you all the downu

  All possible debugging has been disabled

  I would try to set up a VPN Interface virtual Tunnel on the IOS router base and the value of defined transformation in tunnel mode no transport.

  In history, I have had several issues with VPN between a router IOS and the series RV.

• Double IPSec tunnel between routers

  I am facing the following challenge:

  I have two routers and want to build two IPSec encapsulated between them, with the help of ASIT tunnel interfaces.

  The interaces two tunnel would in that case the same source and destination ip addresses.

  With a single tunnel interface defined, it works well, however, as soon as the second tunnel interface is defined, the first breaks down.

  Here is an example configuration:

  interface Tunnel0
  IP 192.168.1.1 255.255.255.252
  source of tunnel Serial1/0
  tunnel destination 10.1.1.6
  ipv4 ipsec tunnel mode
  protection of ipsec profile ipsecprofile tunnel
  !
  Tunnel1 interface
  IP 192.168.1.5 255.255.255.252
  source of tunnel Serial1/0
  tunnel destination 10.1.1.6
  ipv4 ipsec tunnel mode
  protection of ipsec profile ipsecprofile tunnel
  !

  In fact, the matter is rather a conceptual issue than a direct. What is the root cause, this type of configuration does not work?

  ESP protocol is the distinction between endponits ESP SAs based on SPI identifier as well, isn't? If so, what is wrong here?

  Thanks in advance...

  Hi Frank,.

  As a general rule, you cannot have two interfaces of tunnel with the same tunnel source (series 1/0) and destinations (10.1.1.6) tunnel; with the same method (ipv4) tunel.

  The work around that would be to bounce one of the tunnels on a loopback interface.

  This tunnel 1: tunnel_interface_1 - series 1/0---internet---10.1.1.6

  and tunnel 2: tunnel_interface_2---loopback---serial1/0---internet---10.1.1.6

  In this way the two tunnels can be up at the same time.

  I hope this helps.

  -Shrikant

  P.S.: Please check question one answer, if it has been resolved. Note the useful messages. Thank you.

• Traffic is failed on plain IPSec tunnel between two 892 s

  Have a weird case and you are looking for some suggestions/thougs where to dig because I have exhausted the options.

  Note: I replaced the Networkid real to a mentined below.

  Topology: a classic IPSec VPN tunnel between two 892 s of Cisco, with pre-shared key and no GRE. A 892 (branch_892) has access to the Internet using PPPoE and has three network / VLAN behind it. A VLAN is coordinated to the PPPoE internet access. Access to the other two VLAN - VL92 (100.100.200.0/24) and VL93 (100.100.100.0/24) is performed via the VPN tunnel.

  Second 892 (892_DC) has just one interface - WAN on Gigabit enabled/connected and a static route to the default GW. It doesn't have any defined interal network. If the router is strictly used to send traffic to VL92/VL93 to the domestic 892 via IPSec tunnel.

  Here's the problem: access to VL93 (100.100.100.0/24) works, however for VL92 (100.100.100.0/24) - does not work.

  Devices in VL92 I ping IP address of 892_DC through the VPN tunnel. The 892_DC router I can ping devices in VL92. However, I can't VL92 ping any device beyond the 892_DC and at the same time the packets arriving on 892_DC for VL92 are not sent through the VPN tunnel.

  I took the package trace on 892_DC using capture point/buffer to nathalie caron to VL92 packages and saw that the traffic coming to the 892_DC. I run the nathalie caron even on Branch_892, and there was not a single package.

  So... What's the problem? More interesting, I modified the way left on VL92 access list and still - no packets are sent through the tunnel.

  Any idea? Two routers config are below

  -------

  892_DC #show ru

  !

  crypto ISAKMP policy 10

  BA aes 256

  hash sha256

  preshared authentication

  Group 2

  isakmp encryption key * address 1.2.3.4

  ISAKMP crypto keepalive 10 periodicals

  !

  address of 1.2.3.4 crypto isakmp peers

  Description of-COIL-892

  !

  !

  Crypto ipsec transform-set IT-IPSec-Transform-Set esp - aes 256 sha256-esp-hmac

  Crypto ipsec df - bit clear

  !

  map IT ipsec - IPSec crypto - Crypto - map 10-isakmp

  defined peer 1.2.3.4

  disable the kilobytes of life together - the security association

  86400 seconds, life of security association set

  the transform-set IT-IPSec-Transform-Set value

  match a lists 101

  market arriere-route

  QoS before filing

  !

  interface GigabitEthernet0

  IP 10,20,30,40 255.255.255.240

  IP 1400 MTU

  IP tcp adjust-mss 1360

  automatic duplex

  automatic speed

  card crypto IT-IPSec-Crypto-map

  !

  IP route 0.0.0.0 0.0.0.0 10.20.30.41

  !

  access list 101 ip allow any 100.100.100.0 0.0.0.255 connect

  access list 101 ip allow any 100.100.200.0 0.0.0.255 connect

  -------------------------------------------------------------------------------------

  Branch_892 #sh run

  !

  crypto ISAKMP policy 10

  BA aes 256

  hash sha256

  preshared authentication

  Group 2

  isakmp encryption key * address 10,20,30,40

  ISAKMP crypto keepalive 10 periodicals

  !

  address peer isakmp crypto 10,20,30,40

  !

  !

  Crypto ipsec transform-set IT-IPSec-Transform-Set esp - aes 256 sha256-esp-hmac

  Crypto ipsec df - bit clear

  !

  map IT ipsec - IPSec crypto - Crypto - map 10-isakmp

  defined peer 10,20,30,40

  disable the kilobytes of life together - the security association

  86400 seconds, life of security association set

  the transform-set IT-IPSec-Transform-Set value

  match address 101

  market arriere-route

  QoS before filing

  !

  FastEthernet6 interface

  Description VL92

  switchport access vlan 92

  !

  interface FastEthernet7

  Description VL93

  switchport access vlan 93

  !

  interface GigabitEthernet0

  Description # to WAN #.

  no ip address

  automatic duplex

  automatic speed

  PPPoE-client dial-pool-number 1

  !

  interface Vlan1

  Description # local to #.

  IP 192.168.1.254 255.255.255.0

  IP nat inside

  IP virtual-reassembly in

  !

  interface Vlan92

  Description fa6-nexus e100/0/40

  IP 100.100.200.1 255.255.255.0

  !

  interface Vlan93

  Description fa7-nexus e100/0/38

  IP 100.100.100.1 255.255.255.0

  !

  interface Dialer0

  no ip address

  No cdp enable

  !

  interface Dialer1

  IP 1.2.3.4 255.255.255.248

  IP mtu 1454

  NAT outside IP

  IP virtual-reassembly in max-pumping 256

  encapsulation ppp

  IP tcp adjust-mss 1414

  Dialer pool 1

  Dialer-Group 1

  Authentication callin PPP chap Protocol

  PPP chap hostname ~ ~ ~

  PPP chap password =.

  No cdp enable

  card crypto IT-IPSec-Crypto-map

  !

  Dialer-list 1 ip protocol allow

  !

  access-list 101 permit ip 100.100.100.0 0.0.0.255 any

  access-list 101 permit ip 100.100.200.0 0.0.0.255 any

  !

  IP route 0.0.0.0 0.0.0.0 Dialer1

  Yes correct sounds - so another possible problem is the routing is routing 100% correct on both sides? Can you put the two sides config for review?

• IPSec tunnel is disabled

  We have 3 IPSec tunnel set up between the cisco 1760 router and PIX 515e. IPSec tunnel is down by intermittent & son come only after compensation isakmp crypto & clear crypto its next to the router.

  do we need to configure something else in router and end of pix so that tunnels are still in Active state (QM_IDLE).

  Looks like the PIX loses its connection and the router is unable to say that the PIX has dropped.

  Try the isakmp keepalive on both devices configuration but also check network links extended features.

  See you soon,.

  Paul.