Do you have the inside and outside vlan for your ipsec traffic configured with a crypto connect? eg
interface Vlan7 description outside:encrypted traffic no ip address crypto engine subslot 8/0 crypto connect vlan8 ! interface Vlan8 description inside:cleartext traffic ip address xxx crypto map xxx crypto engine subslot 8/0 Regards, Lee On Tue, Dec 15, 2009 at 6:46 AM, Pär Åslund <[email protected]> wrote: > Hi, > > I have problems with a WS-SVC-IPSEC-1 where I'm trying to setup a > site-to-site tunnel. > > Last night, I got the tunnel up. But after applying a acl to the 6500, > the tunnel went down and stayed down. Removing configuration just to > get the tunnel up again and continue trying to get the interesting > traffic through as intended, the tunnel never comes up. The remote > device is a ASA 5505, where I haven't touched anything since this > failure started. From what I can get out of all this, looking at logs > and crypto statistics. The traffic never gets to the module in slot 8. > > show crypto sessions - nothing > show crypto isakmp sa - nothing > show crypto ipsec sa - nothing > > I can still use packet-tracer on the asa as I could before and the > flow is created, but nothing ends up in the 6500 logs. debug crypto > isakmp and debug crypto ipsec is both enabled without anything being > logged. Any ideas are most welcome. Guess I have missed something > obvious but right now I just can't figure out what it is. > > This it the configuration from the 6500. > > crypto isakmp policy 1 > encr 3des > authentication pre-share > group 2 > crypto isakmp key <SECRETKEY> address <peer ip> no-xauth > ! > crypto isakmp client configuration group GROUP1 > key <KEY> > dns 172.16.9.2 > domain i.company.com > pool vpn > acl 101 > crypto isakmp profile ikepro > match identity group GROUP1 > client authentication list userlist > isakmp authorization list grouplist > client configuration address respond > client configuration group GROUP1 > crypto isakmp profile site-to-site > keyring default > match identity address <peer ip> 255.255.255.255 > keepalive 60 retry 5 > ! > ! > crypto ipsec transform-set 3dessha esp-3des esp-sha-hmac > ! > crypto ipsec profile ipsecpro > set transform-set 3dessha > ! > ! > crypto dynamic-map dynmap 10 > set transform-set 3dessha > set isakmp-profile ikepro > crypto dynamic-map dynmap 15 > set peer 76.238.146.205 > set transform-set 3dessha > set isakmp-profile site-to-site > crypto dynamic-map dynmap 20 > set transform-set 3dessha > set isakmp-profile ikepro > ! > ! > crypto map vpnmap engine slot 8 > crypto map vpnmap 10 ipsec-isakmp dynamic dynmap > > > and then on VLAN 8 where the traffic is suppose to come in: > interface Vlan8 > ip address <ip> 255.255.255.248 > ip nat outside > standby 8 ip <standby ip> > standby 8 priority 115 > standby 8 preempt > standby 8 name <standby name> > crypto map vpnmap redundancy <standby name> > end > > Best regards, > .pelle > _______________________________________________ > cisco-nsp mailing list [email protected] > https://puck.nether.net/mailman/listinfo/cisco-nsp > archive at http://puck.nether.net/pipermail/cisco-nsp/ > _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
