[x]
Posted via EE Mobile

Search, ask, and monitor your questions on the go with EE Mobile. Visit Experts Exchange from your mobile device and never be out of touch again.
Question
[x]
Attachment Details
[x]
The Solution Rating System

With so many solutions, how can you tell which solutions are most likely to help you and which ones are not? To provide you with a tool to use, we rate our solutions based on various elements that most accurately determine if a solution is a quality solution. To explain what factors affect the solution rating, here are the elements we take into consideration when formulating our solution rating.

  • The Grade of the Solution
  • The Zone Rank of the Expert Providing the Solution
  • The Number of Author and Expert Comments
  • The Number of Experts Contributing
  • The Feedback of the Community

Your Input Matters
Because of the way the system is set up, the most important variable in this equation is you. As a member of Experts Exchange, you are able to cast your vote on the quality of the solutions in regard to how complete, accurate, helpful and easy to understand each solution is. When you provide your feedback, each rating is adjusted accordingly. So, if you see a solution that has a poor rating that you think is a good solution, let us know by rating it. As you do, the rating will be adjusted and will become more accurate for other members of our site.

If you have any suggestions that you would like to make for our rating system, please ask a question in the Suggestions Zone of Community Support.

Thank you!
7.4

Cisco, Access VPN, Cisco, 877 ADSL Router, Access VPN will not authenticate and drops.

Asked by dgewin in IPSec Security Protocol, Virtual Private Networking (VPN), Network Routers

Tags: cisco, 877, vpn

Hoping someone can help diagnose what the issue here is. I have had another person look at this with no luck so far. The router has IOS (C870-ADVIPSERVICESK9-M), Version 12.4(15)T1, RELEASE SOFTWARE (fc2) as we thought that the earlier IOS may have been the issue.

Trying to create and access vpn on the router with local authentication at first, radius will come after I get this part working. The vpn connections hits the router and then times out. Also the router has a working L2L vpn that does work (not been tested since the acess vpn has been configured).

Cheers
DR

Current configuration : 7622 bytes
!
!
version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname XXXXXX
!
boot-start-marker
boot-end-marker
!
logging buffered 4096
!
aaa new-model
!
!
aaa authentication login default local
aaa authentication login userauthen local
aaa authorization network groupauthor local
!
!
!
crypto isakmp policy 10
 encr 3des
 hash md5
 authentication pre-share
 group 2
!
crypto isakmp policy 21
 encr 3des
 hash md5
 authentication pre-share
 group 2
 lifetime 480
crypto isakmp key ********* address 20x.xxx.xxx.xxx no-xauth
crypto isakmp nat keepalive 20
!
crypto isakmp client configuration group XXXXX_VPN_Clients
 key XXXX
 dns 192.168.5x.4
 wins 192.168.5x.4
 domain xxxxx.xxxxxxx.xxxxxx
 pool VPNPOOL
 acl XXXXX_IPSEC
!
!
crypto ipsec transform-set XXXXX_TRANSFORM esp-3des esp-md5-hmac
crypto ipsec transform-set REMOTE_CLIENTS esp-3des esp-md5-hmac
!
crypto dynamic-map REMOTE_MAP 10
 set transform-set REMOTE_CLIENTS
!
!
crypto map XXXXX_MAP client authentication list userauthen
crypto map XXXXX_MAP isakmp authorization list groupauthor
crypto map XXXXX_MAP client configuration address respond
crypto map XXXXX_MAP 21 ipsec-isakmp
 set peer xxx.xxx.xxx
 set transform-set XXXXX_TRANSFORM
 match address XXXXX_IPSEC
crypto map XXXXX_MAP 65535 ipsec-isakmp dynamic REMOTE_MAP
!
no ip source-route
ip cef
!
!
!
!
!
multilink bundle-name authenticated
vpdn enable
!
!
!
username XXXXX password 7 XXXXXXXXXXXX
username XXXXX password 7 XXXXXXXXXXXX
username XXXXX password 7 XXXXXXXXXXXX
archive
 log config
  hidekeys
!
!
!

interface ATM0
 no ip address
 no atm ilmi-keepalive
 bundle-enable
 dsl operating-mode auto
 hold-queue 224 in
!
interface ATM0.1 point-to-point
 no snmp trap link-status
 pvc 8/35
  pppoe-client dial-pool-number 1
 !
!
interface FastEthernet0
 description XXXXX LAN
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
 description XXXXX Port 3
 switchport access vlan 50
 duplex full
!
interface Vlan1
 ip address 192.168.5x.1 255.255.255.0
 ip nat inside
 ip rip send version 1 2
 ip rip receive version 1 2
 ip virtual-reassembly
!
interface Vlan50
 ip address 192.168.2xx.2 255.255.255.0
 ip rip send version 1 2
 ip rip receive version 1 2
 ip virtual-reassembly
!
interface Dialer1
 ip address negotiated
 ip mtu 1492
 ip nat outside
 ip virtual-reassembly
 encapsulation ppp
 ip tcp adjust-mss 1452
 dialer pool 1
 dialer-group 1
 ppp authentication pap callin
 ppp chap refuse
 ppp pap sent-username XXXXXXXXXX password 7 XXXXXXXXXXX
 crypto map XXXXX_MAP
!
router eigrp 17
 redistribute static
 network 192.168.5x.0
 network 192.168.2xx.0
 auto-summary
!
router rip
 redistribute static
 network 192.168.5x.0
 network 192.168.2xx.0
neighbor 192.168.4x.xxx
 no auto-summary
!
ip local pool VPNPOOL 192.168.4x.1 192.168.4x.254
ip route 0.0.0.0 0.0.0.0 192.168.4x.65 10
ip route 0.0.0.0 0.0.0.0 Dialer1 240
ip route 10.0.0.0 255.255.254.0 xxx.xxx.xxx.xxx 200
ip route 172.XXX.0.0 255.255.0.0 xxx.xxx.xxx.xxx 200
ip route 192.168.4x.0 255.255.255.0 xxx.xxx.xxx 200
ip route 192.168.4x.0 255.255.255.0 Dialer1
ip route 192.168.5x.0 255.255.255.0 xxx.xxx.xxx 200
ip route 192.168.7x.0 255.255.255.0 192.168.2xx.5
!
!
no ip http server
ip http secure-server
ip nat inside source route-map NONAT_RMAP interface Dialer1 overload
!
ip access-list extended XXXXX_IPSEC
 remark VPN Encrypted Traffic
 remark PERMIT TRAFFIC FROM INTERNAL LAN TO VPN CLIENTS
 permit ip 192.168.5x.0 0.0.0.255 192.168.4x.0 0.0.0.255
 remark PERMIT TRAFFIC FROM INTERNAL LAN TO VPN SITES
 permit ip 192.168.5x.0 0.0.0.255 192.168.4x.0 0.0.0.255
 permit ip 192.168.5x.0 0.0.0.255 172.xxx.0.0 0.0.255.255
 permit ip 192.168.5x.0 0.0.0.255 192.168.7x.0 0.0.0.255
 permit ip 192.168.5x.0 0.0.0.255 10.x.x.x 0.0.x.255
 permit ip 192.168.5x.0 0.0.0.255 192.168.2xx.0 0.0.0.255
 deny   ip any any log
ip access-list extended NONAT_ACL
 remark Filter IPSec traffic from NAT
 remark Deny NAT FROM INTERNAL LAN TO VPN CLIENTS
 deny   ip 192.168.5x.0 0.0.0.255 192.168.4x.0 0.0.0.255
 remark Deny NAT FROM INTERNAL LAN TO VPN SITES
 deny   ip 192.168.5x.0 0.0.0.255 192.168.4x.0 0.0.0.255
 deny   ip 192.168.5x.0 0.0.0.255 172.xxx.0.0 0.0.255.255
 deny   ip 192.168.5x.0 0.0.0.255 192.168.7x.0 0.0.0.255
 deny   ip 192.168.5x.0 0.0.0.255 10.0.0.0 0.0.1.255
 deny   ip 192.168.5x.0 0.0.0.255 192.168.2xx.0 0.0.0.255
 permit ip 192.168.5x.0 0.0.0.255 any
 deny   ip any any log
ip access-list extended WAN_IN
 permit ahp any any
 permit esp any any
 permit udp any any eq isakmp
 permit udp any any eq non500-isakmp
 permit ip any any log
!
dialer-list 1 protocol ip permit
snmp-server engineID local 1921685050
snmp-server community XXXXX RW 50
snmp-server location XXXXX_Rtr
snmp-server contact XXXXXXX
snmp-server enable traps tty
snmp-server enable traps authenticate-fail
snmp-server enable traps config-copy
snmp-server enable traps config
snmp-server enable traps syslog
snmp-server enable traps isakmp tunnel start
snmp-server enable traps isakmp tunnel stop
snmp-server enable traps ipsec tunnel start
snmp-server enable traps ipsec tunnel stop
snmp-server host 17x.xxx.xxx.xxx XXXXX

!
!
route-map NONAT_RMAP permit 21
 match ip address NONAT_ACL
!
!
control-plane
!
!
line con 0
 no modem enable
line aux 0
line vty 0 4
 transport ssh
!
scheduler max-task-time 5000
ntp clock-period 17175020
ntp server xxx.xxx.xxx.xxx

!
webvpn cef
!
webvpn context Default_context
 ssl authenticate verify all
 !
 no inservice
!
end



Oct 31 00:57:00.392: ISAKMP (0:0): received packet from xxx.xxx.xxx dport 500 sport 500 Global (N) NEW SA
Oct 31 00:57:00.392: ISAKMP: Created a peer struct for xxx.xxx.xxx, peer port 500
Oct 31 00:57:00.392: ISAKMP: New peer created peer = 0x83AFF370 peer_handle = 0x80000014
Oct 31 00:57:00.392: ISAKMP: Locking peer struct 0x83AFF370, refcount 1 for crypto_isakmp_process_block
Oct 31 00:57:00.392: ISAKMP:(0):Setting client config settings 83B44BB0
Oct 31 00:57:00.392: ISAKMP:(0):(Re)Setting client xauth list  and state
Oct 31 00:57:00.392: ISAKMP/xauth: initializing AAA request
Oct 31 00:57:00.392: AAA/BIND(00000022): Bind i/f  
Oct 31 00:57:00.392: ISAKMP: local port 500, remote port 500
Oct 31 00:57:00.392: insert sa successfully sa = 830AA388
Oct 31 00:57:00.392: ISAKMP:(0): processing SA payload. message ID = 0
Oct 31 00:57:00.392: ISAKMP:(0): processing ID payload. message ID = 0
Oct 31 00:57:00.396: ISAKMP (0:0): ID payload
        next-payload : 13
        type         : 11
        group id     : XXXXX_VPN_Clients
        protocol     : 17
        port         : 500
        length       : 27
Oct 31 00:57:00.396: ISAKMP:(0):: peer matches *none* of the profiles
Oct 31 00:57:00.396: ISAKMP:(0): processing vendor id payload
Oct 31 00:57:00.396: ISAKMP:(0): vendor ID seems Unity/DPD but major 215 mismatch
Oct 31 00:57:00.396: ISAKMP:(0): vendor ID is XAUTH
Oct 31 00:57:00.396: ISAKMP:(0): processing vendor id payload
Oct 31 00:57:00.396: ISAKMP:(0): vendor ID is DPD
Oct 31 00:57:00.396: ISAKMP:(0): processing vendor id payload
Oct 31 00:57:00.396: ISAKMP:(0): vendor ID seems Unity/DPD but major 123 mismatch
Oct 31 00:57:00.396: ISAKMP:(0): vendor ID is NAT-T v2
Oct 31 00:57:00.396: ISAKMP:(0): processing vendor id payload
Oct 31 00:57:00.396: ISAKMP:(0): vendor ID seems Unity/DPD but major 194 mismatch
Oct 31 00:57:00.396: ISAKMP:(0): processing vendor id payload
Oct 31 00:57:00.396: ISAKMP:(0): vendor ID is Unity
Oct 31 00:57:00.396: ISAKMP:(0): Authentication by xauth preshared
Oct 31 00:57:00.396: ISAKMP:(0):Checking ISAKMP transform 1 against priority 10 policy
Oct 31 00:57:00.396: ISAKMP:      encryption AES-CBC
Oct 31 00:57:00.396: ISAKMP:      hash SHA
Oct 31 00:57:00.396: ISAKMP:      default group 2
Oct 31 00:57:00.396: ISAKMP:      auth XAUTHInitPreShared
Oct 31 00:57:00.396: ISAKMP:      life type in seconds
Oct 31 00:57:00.396: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
Oct 31 00:57:00.396: ISAKMP:      keylength of 256
Oct 31 00:57:00.400: ISAKMP:(0):Encryption algorithm offered does not match policy!
Oct 31 00:57:00.400: ISAKMP:(0):atts are not acceptable. Next payload is 3
Oct 31 00:57:00.400: ISAKMP:(0):Checking ISAKMP transform 2 against priority 10 policy
Oct 31 00:57:00.400: ISAKMP:      encryption AES-CBC
Oct 31 00:57:00.400: ISAKMP:      hash MD5
Oct 31 00:57:00.400: ISAKMP:      default group 2
Oct 31 00:57:00.400: ISAKMP:      auth XAUTHInitPreShared
Oct 31 00:57:00.400: ISAKMP:      life type in seconds
Oct 31 00:57:00.400: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
Oct 31 00:57:00.400: ISAKMP:      keylength of 256
Oct 31 00:57:00.400: ISAKMP:(0):Encryption algorithm offered does not match policy!
Oct 31 00:57:00.400: ISAKMP:(0):atts are not acceptable. Next payload is 3
Oct 31 00:57:00.400: ISAKMP:(0):Checking ISAKMP transform 3 against priority 10 policy
Oct 31 00:57:00.400: ISAKMP:      encryption AES-CBC
Oct 31 00:57:00.400: ISAKMP:      hash SHA
Oct 31 00:57:00.400: ISAKMP:      default group 2
Oct 31 00:57:00.400: ISAKMP:      auth pre-share
Oct 31 00:57:00.400: ISAKMP:      life type in seconds
Oct 31 00:57:00.400: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
Oct 31 00:57:00.400: ISAKMP:      keylength of 256
Oct 31 00:57:00.400: ISAKMP:(0):Encryption algorithm offered does not match policy!
Oct 31 00:57:00.400: ISAKMP:(0):atts are not acceptable. Next payload is 3
Oct 31 00:57:00.400: ISAKMP:(0):Checking ISAKMP transform 4 against priority 10 policy
Oct 31 00:57:00.400: ISAKMP:      encryption AES-CBC
Oct 31 00:57:00.400: ISAKMP:      hash MD5
Oct 31 00:57:00.400: ISAKMP:      default group 2
Oct 31 00:57:00.400: ISAKMP:      auth pre-share
Oct 31 00:57:00.404: ISAKMP:      life type in seconds
Oct 31 00:57:00.404: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
Oct 31 00:57:00.404: ISAKMP:      keylength of 256
Oct 31 00:57:00.404: ISAKMP:(0):Encryption algorithm offered does not match policy!
Oct 31 00:57:00.404: ISAKMP:(0):atts are not acceptable. Next payload is 3
Oct 31 00:57:00.404: ISAKMP:(0):Checking ISAKMP transform 5 against priority 10 policy
Oct 31 00:57:00.404: ISAKMP:      encryption AES-CBC
Oct 31 00:57:00.404: ISAKMP:      hash SHA
Oct 31 00:57:00.404: ISAKMP:      default group 2
Oct 31 00:57:00.404: ISAKMP:      auth XAUTHInitPreShared
Oct 31 00:57:00.404: ISAKMP:      life type in seconds
Oct 31 00:57:00.404: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
Oct 31 00:57:00.404: ISAKMP:      keylength of 128
Oct 31 00:57:00.404: ISAKMP:(0):Encryption algorithm offered does not match policy!
Oct 31 00:57:00.404: ISAKMP:(0):atts are not acceptable. Next payload is 3
Oct 31 00:57:00.404: ISAKMP:(0):Checking ISAKMP transform 6 against priority 10 policy
Oct 31 00:57:00.404: ISAKMP:      encryption AES-CBC
Oct 31 00:57:00.404: ISAKMP:      hash MD5
Oct 31 00:57:00.404: ISAKMP:      default group 2
Oct 31 00:57:00.404: ISAKMP:      auth XAUTHInitPreShared
Oct 31 00:57:00.404: ISAKMP:      life type in seconds
Oct 31 00:57:00.404: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
Oct 31 00:57:00.404: ISAKMP:      keylength of 128
Oct 31 00:57:00.404: ISAKMP:(0):Encryption algorithm offered does not match policy!
Oct 31 00:57:00.404: ISAKMP:(0):atts are not acceptable. Next payload is 3
Oct 31 00:57:00.404: ISAKMP:(0):Checking ISAKMP transform 7 against priority 10 policy
Oct 31 00:57:00.404: ISAKMP:      encryption AES-CBC
Oct 31 00:57:00.404: ISAKMP:      hash SHA
Oct 31 00:57:00.408: ISAKMP:      default group 2
Oct 31 00:57:00.408: ISAKMP:      auth pre-share
Oct 31 00:57:00.408: ISAKMP:      life type in seconds
Oct 31 00:57:00.408: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
Oct 31 00:57:00.408: ISAKMP:      keylength of 128
Oct 31 00:57:00.408: ISAKMP:(0):Encryption algorithm offered does not match policy!
Oct 31 00:57:00.408: ISAKMP:(0):atts are not acceptable. Next payload is 3
Oct 31 00:57:00.408: ISAKMP:(0):Checking ISAKMP transform 8 against priority 10 policy
Oct 31 00:57:00.408: ISAKMP:      encryption AES-CBC
Oct 31 00:57:00.408: ISAKMP:      hash MD5
Oct 31 00:57:00.408: ISAKMP:      default group 2
Oct 31 00:57:00.408: ISAKMP:      auth pre-share
Oct 31 00:57:00.408: ISAKMP:      life type in seconds
Oct 31 00:57:00.408: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
Oct 31 00:57:00.408: ISAKMP:      keylength of 128
Oct 31 00:57:00.408: ISAKMP:(0):Encryption algorithm offered does not match policy!
Oct 31 00:57:00.408: ISAKMP:(0):atts are not acceptable. Next payload is 3
Oct 31 00:57:00.408: ISAKMP:(0):Checking ISAKMP transform 9 against priority 10 policy
Oct 31 00:57:00.408: ISAKMP:      encryption 3DES-CBC
Oct 31 00:57:00.408: ISAKMP:      hash SHA
Oct 31 00:57:00.408: ISAKMP:      default group 2
Oct 31 00:57:00.408: ISAKMP:      auth XAUTHInitPreShared
Oct 31 00:57:00.408: ISAKMP:      life type in seconds
Oct 31 00:57:00.408: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
Oct 31 00:57:00.408: ISAKMP:(0):Hash algorithm offered does not match policy!
Oct 31 00:57:00.408: ISAKMP:(0):atts are not acceptable. Next payload is 3
Oct 31 00:57:00.408: ISAKMP:(0):Checking ISAKMP transform 10 against priority 10 policy
Oct 31 00:57:00.408: ISAKMP:      encryption 3DES-CBC
Oct 31 00:57:00.408: ISAKMP:      hash MD5
Oct 31 00:57:00.408: ISAKMP:      default group 2
Oct 31 00:57:00.408: ISAKMP:      auth XAUTHInitPreShared
Oct 31 00:57:00.408: ISAKMP:      life type in seconds
Oct 31 00:57:00.408: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
Oct 31 00:57:00.408: ISAKMP:(0):atts are acceptable. Next payload is 3
Oct 31 00:57:00.412: ISAKMP:(0): processing KE payload. message ID = 0
Oct 31 00:57:00.412: crypto_engine: Create DH shared secret
Oct 31 00:57:00.456: ISAKMP:(0): processing NONCE payload. message ID = 0
Oct 31 00:57:00.456: ISAKMP:(0): vendor ID is NAT-T v2
Oct 31 00:57:00.456: AAA/AUTHOR (0x22): Pick method list 'groupauthor'
Oct 31 00:57:00.456: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_AM_EXCH
Oct 31 00:57:00.456: ISAKMP:(0):Old State = IKE_READY  New State = IKE_R_AM_AAA_AWAIT

Oct 31 00:57:00.460: crypto_engine: Create IKE SA
Oct 31 00:57:00.460: crypto engine: deleting DH phase 2 SW:21
Oct 31 00:57:00.460: crypto_engine: Delete DH shared secret
Oct 31 00:57:00.460: ISAKMP:(2014): constructed NAT-T vendor-02 ID
Oct 31 00:57:00.460: ISAKMP:(2014):SA is doing pre-shared key authentication plus XAUTH using id type ID_IPV4_ADDR
Oct 31 00:57:00.460: ISAKMP (0:2014): ID payload
        next-payload : 10
        type         : 1
        address      : xxx.xxx.xxx.xxx
        protocol     : 17
        port         : 0
        length       : 12
Oct 31 00:57:00.460: ISAKMP:(2014):Total payload length: 12
Oct 31 00:57:00.460: crypto_engine: Generate IKE hash
Oct 31 00:57:00.460: ISAKMP:(2014): sending packet to xxx.xxx.xxx.xxx my_port 500 peer_port 500 (R) AG_INIT_EXCH
Oct 31 00:57:00.464: ISAKMP:(2014):Sending an IKE IPv4 Packet.
Oct 31 00:57:00.464: ISAKMP:(2014):Input = IKE_MESG_FROM_AAA, PRESHARED_KEY_REPLY
Oct 31 00:57:00.464: ISAKMP:(2014):Old State = IKE_R_AM_AAA_AWAIT  New State = IKE_R_AM2

Oct 31 00:57:05.778: ISAKMP (0:2014): received packet from xxx.xxx.xxx.xxx dport 500 sport 500 Global (R) AG_INIT_EXCH
Oct 31 00:57:05.778: ISAKMP:(2014): phase 1 packet is a duplicate of a previous packet.
Oct 31 00:57:05.778: ISAKMP:(2014): retransmitting due to retransmit phase 1
Oct 31 00:57:06.278: ISAKMP:(2014): retransmitting phase 1 AG_INIT_EXCH...
Oct 31 00:57:06.278: ISAKMP (0:2014): incrementing error counter on sa, attempt 1 of 5: retransmit phase 1
Oct 31 00:57:06.278: ISAKMP:(2014): retransmitting phase 1 AG_INIT_EXCH
Oct 31 00:57:06.278: ISAKMP:(2014): sending packet to xxx.xxx.xxx.xxx my_port 500 peer_port 500 (R) AG_INIT_EXCH
Oct 31 00:57:06.278: ISAKMP:(2014):Sending an IKE IPv4 Packet.
Oct 31 00:57:10.773: ISAKMP (0:2014): received packet from xxx.xxx.xxx.xxx dport 500 sport 500 Global (R) AG_INIT_EXCH
Oct 31 00:57:10.773: ISAKMP:(2014): phase 1 packet is a duplicate of a previous packet.
Oct 31 00:57:10.773: ISAKMP:(2014): retransmitting due to retransmit phase 1
Oct 31 00:57:11.272: ISAKMP:(2014): retransmitting phase 1 AG_INIT_EXCH...
Oct 31 00:57:11.272: ISAKMP (0:2014): incrementing error counter on sa, attempt 2 of 5: retransmit phase 1
Oct 31 00:57:11.272: ISAKMP:(2014): retransmitting phase 1 AG_INIT_EXCH
Oct 31 00:57:11.272: ISAKMP:(2014): sending packet to xxx.xxx.xxx.xxx my_port 500 peer_port 500 (R) AG_INIT_EXCH
Oct 31 00:57:11.272: ISAKMP:(2014):Sending an IKE IPv4 Packet.
Oct 31 00:57:15.771: ISAKMP (0:2014): received packet from xxx.xxx.xxx.xxx dport 500 sport 500 Global (R) AG_INIT_EXCH
Oct 31 00:57:15.775: ISAKMP:(2014): phase 1 packet is a duplicate of a previous packet.
Oct 31 00:57:15.775: ISAKMP:(2014): retransmitting due to retransmit phase 1
Oct 31 00:57:16.275: ISAKMP:(2014): retransmitting phase 1 AG_INIT_EXCH...
Oct 31 00:57:16.275: ISAKMP (0:2014): incrementing error counter on sa, attempt 3 of 5: retransmit phase 1
Oct 31 00:57:16.275: ISAKMP:(2014): retransmitting phase 1 AG_INIT_EXCH
Oct 31 00:57:16.275: ISAKMP:(2014): sending packet to xxx.xxx.xxx.xxx my_port 500 peer_port 500 (R) AG_INIT_EXCH
Oct 31 00:57:16.275: ISAKMP:(2014):Sending an IKE IPv4 Packet.
Oct 31 00:57:26.272: ISAKMP:(2014): retransmitting phase 1 AG_INIT_EXCH...
Oct 31 00:57:26.272: ISAKMP (0:2014): incrementing error counter on sa, attempt 4 of 5: retransmit phase 1
Oct 31 00:57:26.272: ISAKMP:(2014): retransmitting phase 1 AG_INIT_EXCH
Oct 31 00:57:26.272: ISAKMP:(2014): sending packet to xxx.xxx.xxx.xxx my_port 500 peer_port 500 (R) AG_INIT_EXCH
Oct 31 00:57:26.272: ISAKMP:(2014):Sending an IKE IPv4 Packet.
Oct 31 00:57:36.269: ISAKMP:(2014): retransmitting phase 1 AG_INIT_EXCH...
Oct 31 00:57:36.269: ISAKMP (0:2014): incrementing error counter on sa, attempt 5 of 5: retransmit phase 1
Oct 31 00:57:36.269: ISAKMP:(2014): retransmitting phase 1 AG_INIT_EXCH
Oct 31 00:57:36.269: ISAKMP:(2014): sending packet to xxx.xxx.xxx.xxx my_port 500 peer_port 500 (R) AG_INIT_EXCH
Oct 31 00:57:36.269: ISAKMP:(2014):Sending an IKE IPv4 Packet.
Oct 31 00:57:46.267: ISAKMP:(2014): retransmitting phase 1 AG_INIT_EXCH...
Oct 31 00:57:46.267: ISAKMP:(2014):peer does not do paranoid keepalives.

Oct 31 00:57:46.267: ISAKMP:(2014):deleting SA reason "Death by retransmission P1" state (R) AG_INIT_EXCH (peer xxx.xxx.xxx.xxx)
Oct 31 00:57:46.267: ISAKMP:(2014):deleting SA reason "Death by retransmission P1" state (R) AG_INIT_EXCH (peer xxx.xxx.xxx.xxx)
Oct 31 00:57:46.267: ISAKMP: Unlocking peer struct 0x83AFF370 for isadb_mark_sa_deleted(), count 0
Oct 31 00:57:46.267: ISAKMP: Deleting peer node by peer_reap for xxx.xxx.xxx.xxx: 83AFF370
Oct 31 00:57:46.267: crypto engine: deleting IKE SA SW:14
Oct 31 00:57:46.267: crypto_engine: Delete IKE SA
Oct 31 00:57:46.267: ISAKMP:(2014):Input = IKE_MESG_INTERNAL, IKE_PHASE1_DEL
Oct 31 00:57:46.267: ISAKMP:(2014):Old State = IKE_R_AM2  New State = IKE_DEST_SA

Oct 31 00:57:46.271: IPSEC(key_engine): got a queue event with 1 KMI message(s)

XXXX_877#sh crypto map
Crypto Map "XXXX_MAP" 21 ipsec-isakmp
        Peer = xxx.xxx.xxx.xxx
        Extended IP access list XXXXX_IPSEC
            access-list XXXXX_IPSEC permit ip 192.168.5x.0 0.0.0.255 192.168.4x.0 0.0.0.255
            access-list XXXXX_IPSEC permit ip 192.168.5x.0 0.0.0.255 192.168.4x.0 0.0.0.255
            access-list XXXXX_IPSEC permit ip 192.168.5x.0 0.0.0.255 172.1x.0.0 0.0.255.255
            access-list XXXXX_IPSEC permit ip 192.168.5x.0 0.0.0.255 192.168.7x.0 0.0.0.255
            access-list XXXXX_IPSEC permit ip 192.168.5x.0 0.0.0.255 10.x.0.0 0.0.1.255
            access-list XXXXX_IPSEC permit ip 192.168.5x.0 0.0.0.255 192.168.2xx.0 0.0.0.255
            access-list XXXXX_IPSEC deny ip any any
        Current peer: xxx.xxx.xxx.xxxx
        Security association lifetime: 4608000 kilobytes/3600 seconds
        PFS (Y/N): N
        Transform sets={
                XXXXX_TRANSFORM,
        }

Crypto Map "XXXXX_MAP" 65535 ipsec-isakmp
        Dynamic map template tag: REMOTE_MAP
        Interfaces using crypto map XXXXX_MAP:
                Virtual-Access1

                Dialer1


[+][-]10/30/07 07:25 PM, ID: 20182543Expert Comment

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 30-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]11/07/07 01:43 PM, ID: 20236748Author Comment

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 30-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]01/13/08 09:42 PM, ID: 20651123Author Comment

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 30-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]02/11/08 09:04 AM, ID: 20867961Expert Comment

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 30-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]02/17/08 10:19 AM, ID: 20914838Administrative Comment

Experts Exchange has a courteous staff of administrators who help members get the most out of the website by means of administrative comments like this one.

Start your 30-day free trial to view this Administrative Comment or ask the Experts your question.

 
[+][-]02/17/08 08:42 PM, ID: 20917607Accepted Solution

View this solution now by starting your 30-day free trial. Setting up your free trial is quick, easy, and secure. We will return you to this solution, unlocked, when you're done.

About this solution

Zones: IPSec Security Protocol, Virtual Private Networking (VPN), Network Routers
Tags: cisco, 877, vpn
Sign Up Now!
Solution Provided By: dgewin
Participating Experts: 3
Solution Grade: B
 
 
Loading Advertisement...
20091021-EE-VQP-81 / EE_QW_2_20070628