Hi,
How do you clear the tunnel?
I think you use the following commands to clear it
1)clear crypto isakmp
2)clear crypto sa
The issue will be seen when you execute clear crypto isakmp first and then clear crypto sa second
This is a wrong process:
First you have to execute
1)'clear crypto sa' - to clear sa counters
and then
2)'clear crypto isakmp'
The Reason is when you execute clear crypto isakmp - it will only clears the IKE and but not the SPI (present in sa counter) - will not be deleted,
Even you execute 'clear crypto sa' - SPI will remain same.
SPI will be removed when 'clear crypto sa' is done first and the command wont clears if it is executed second
Then if you initial traffic to establish tunnel , the ike will use the old spi - which is a invalid , because the consecutive SPI should be used and if it is used then tunnel will not be established,
You can see the encaps and decaps but tunnel wont be established
Conclusion:
-------------
Whenever you clear the tunnel:
Please do the following steps:
1) clear crypto sa - which clear all sa counters
and then
2)execute 'clear crypto isakmp'
By mistake if did wrong,
then
execute
1)no crypto isakmp enable in config mode
2)crypto isakmp enable in config mode
to reset the crypto
Thanks,
Kesavamurthy Palani
