Comments are available to members only. Sign up or Log in to view these comments.
Main Topics
Browse All TopicsI currently have an IPSEC tunnel that was working but after making some changes to the BGP configuration on the router broke due to a routing issue. We have that problem fixed, however the IPSEC tunnel will still not come up.
Here is the current configuration with the other side being the spitting image except for the access-list number and the peer address.
crypto isakmp policy 2
authentication pre-share
group 2
lifetime 3600
crypto isakmp key Intellimark-VPN address 192.168.1.1
!
!
crypto ipsec transform-set GMACCM esp-3des esp-md5-hmac
!
crypto map RemoteAccess local-address ATM3/IMA0.1
crypto map RemoteAccess 104 ipsec-isakmp
set peer 192.168.1.1
set transform-set GMACCM
match address 107
!
!
access-list 107 permit tcp 10.1.1.1 255.255.0.0 host 20.1.1.1 eq 3389
Now here is the debug that we took on the router. Everything seems fine until it goes to negotiate the ipsec proposal.
1w4d: CryptoEngine0: generate alg parameter
1w4d: ISAKMP (0:1): processing NONCE payload. message ID = 0
1w4d: ISAKMP (0:1): found peer pre-shared key matching 192.168.1.1
1w4d: CryptoEngine0: create ISAKMP SKEYID for conn id 1
1w4d: ISAKMP (0:1): SKEYID state generated
1w4d: ISAKMP (0:1): processing vendor id payload
1w4d: ISAKMP (0:1): speaking to another IOS box!
1w4d: ISAKMP (1): ID payload
next-payload : 8
type : 1
protocol : 17
port : 500
length : 8
1w4d: ISAKMP (1): Total payload length: 12
1w4d: CryptoEngine0: generate hmac context for conn id 1
1w4d: ISAKMP (0:1): sending packet to 192.168.1.1 (I) MM_KEY_EXCH
1w4d: ISAKMP (0:1): received packet from 192.168.1.1 (I) MM_KEY_EXCH
1w4d: ISAKMP (0:1): processing ID payload. message ID = 0
1w4d: ISAKMP (0:1): processing HASH payload. message ID = 0
1w4d: CryptoEngine0: generate hmac context for conn id 1
1w4d: ISAKMP (0:1): SA has been authenticated with 192.168.1.1
1w4d: ISAKMP (0:1): beginning Quick Mode exchange, M-ID of -196547694
1w4d: CryptoEngine0: generate hmac context for conn id 1
1w4d: ISAKMP (0:1): sending packet to 192.168.1.1 (I) QM_IDLE
1w4d: CryptoEngine0: clear dh number for conn id 1
1w4d: ISAKMP (0:1): received packet from 192.168.1.1 (I) QM_IDLE
1w4d: CryptoEngine0: generate hmac context for conn id 1
1w4d: ISAKMP (0:1): processing HASH payload. message ID = -1861604493
1w4d: ISAKMP (0:1): processing NOTIFY PROPOSAL_NOT_CHOSEN protocol 3
spi 1158430383, message ID = -1861604493
1w4d: ISAKMP (0:1): deleting spi 1158430383 message ID = -196547694
1w4d: ISAKMP (0:1): deleting node -196547694
1w4d: ISAKMP (0:1): deleting node -1861604493
Anyone have any thoughts? Ideas?
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.

Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Business Accounts
Answer for Membership
by: mikecrPosted on 2002-09-18 at 04:43:28ID: 7287907
Comments are available to members only. Sign up or Log in to view these comments.