Unanswered Question
Apr 24th, 2008
User Badges:


I have a problem in encrypt a mGRE tunnel between two 7609 routers.

Here you have the configuration:

crypto keyring key1

pre-shared-key address key cisco


crypto isakmp policy 1

authentication pre-share

group 2

lifetime 14400

crypto isakmp aggressive-mode disable

crypto isakmp profile isakmp_data

keyring key1

match identity address



crypto ipsec transform-set gre esp-des

mode transport

no crypto ipsec nat-transparency udp-encaps


crypto ipsec profile tp

set transform-set gre

set isakmp-profile isakmp_data


interface Tunnel100

bandwidth 1000000

ip address 4.x.x.1

no ip redirects

ip mtu 1416

ip nhrp authentication test

ip nhrp map multicast dynamic

ip nhrp network-id 100000

ip nhrp holdtime 600

ip ospf network broadcast

ip ospf priority 2

delay 1000

tunnel source ATM4/0/0.2

tunnel mode gre multipoint

tunnel key 100000

tunnel protection ipsec profile tp

crypto engine slot 3/0

The mGRE tunnel is up and running but I cannot establish the ISAKMP SA

If you have some ideeas about this issue, would be helpful.


Alexandru Nitulescu

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
jsivulka Wed, 04/30/2008 - 05:50
User Badges:
  • Bronze, 100 points or more

The following URL will help you:

Configuring Dynamic Multipoint VPN (DMVPN) using GRE over IPSec between Multiple Routers

Configuring an IPSec Tunnel to Route Through a Hub and Multiple Remote Sites :

cleidh_mor Mon, 05/05/2008 - 06:44
User Badges:

That's a bit odd, what should happen is that the IPSec conn should come up, and *then* the mGRE tunnel should come up.

What's the output of:

- sh crypto isakmp sa

- sh crypto ipsec sa

While trying to bring the link up, what's the output from

- debug crypto isakmp

- debug crypto ipsec?


This Discussion