Cisco 851 and ASA qm fsm error

I have a Cisco 881 running as EZVPN Server.  It has the IOS that uses zone security.  I have individual users VPN into it with no problem.  However, when I have an ASA 5505 attempt to EZVPN Remote into it, the tunnel is established, but then I get the "qm fsm error p2 struct" error on the remote.  With the new IOS I don't know where the corresponding isakmp is actually setup.  I have attached the 881 config.  Thanks ahead of time for your thoughts!
LVL 2
globalonline2Asked:
Who is Participating?
 
globalonline2Author Commented:
Opened Cisco TAC.  After several techs and 7 hours, it was determined that the software on the 881 does not support the ASA VPN Remote client on a Virtual Template.  So a seperate ISAKMP Profile was created for use with an ASA.
0
 
globalonline2Author Commented:
Sorry, Cisco 881
881-Configuration.txt
0
 
ptchubaCommented:
i'm assuming that you are using Network Extension Mode on the ASA. Check that your network behind the ASA does not overlap with the networks on the 881.

Let me know
Peter C.
0
On-Demand: Securing Your Wi-Fi for Summer Travel

Traveling this summer?Check out our on-demand webinar to learn about the importance of Wi-Fi security and 3 easy measures you can start taking immediately to protect your private data while using public Wi-Fi. Follow us today to learn more!

 
globalonline2Author Commented:
No, client mode, and no overlap.
0
 
netnounoursCommented:
The problem seems to be on phase 2 of the negociation. Check if you have the same parameters set on both sides for the IPSec piece of the VPN (eg : PFS group)
0
 
globalonline2Author Commented:
I agree, it is on phase 2.  However, it's my understanding that the VPN server intiates the negotiation with whatever profile I have specified.  The EZVPN remote client doesn't have a setup for IPSec or ISAKMP.
0
 
netnounoursCommented:
Try removing "set isakmp-profile ciscocp-ike-profile-1" from the IPSec profile.
0
 
globalonline2Author Commented:
I removed that entry to no avail.  Here are additional observations:

On the 881 there are no errors shown.  In debug mode it shows the tennel negotiation, and shows it being established.  However, there are no packets exchanges with the ASA - and there is no route setup for the IP it assigns the ASA from the VPN DHCP pool.

On the ASA.  It is where the error shows up in logs for the Phase 2 negotiation.  It shows the tunnel established, but  always gets the qm fsm error.  We have another ASA5510 that it works with just fine, but not the 881 router.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.