cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
550
Views
0
Helpful
3
Replies

ip access-list on crypto map: behavior is different to the configuration

schuetzm
Level 1
Level 1

Hello,

I configured a IPSec between a hub-router and some spoke-routers. All things work fine.

My next step is to filter traffic between the sites by ACL's.

One of the ACL's is:

ip access-list extended gre_hub-spoke1

permit gre host 172.31.254.254 host 172.31.254.1

permit ip 10.70.0.0 0.0.0.255 192.168.10.0 0.0.0.255

This ACL matches to the crypto map:

crypto map gre-tunnel 10 ipsec-isakmp

set peer 172.31.254.1

set transform-set myset

match address gre_hub-spoke1

Why is the behavior different than configured?

The "permitted" communication is blocked, other traffic is forwarded.

Thanks and kind regards

Matthias

1 Accepted Solution

Accepted Solutions

From the Crypto acl:

permit gre host 172.31.254.254 host 172.31.254.1 ---------------> SAs are built and the traffic is going through

permit ip 10.70.0.0 0.0.0.255 192.168.10.0 0.0.0.255 ---------------------> there are no SA built for it! Check for mirror image acl entry for it on other side in crypto acl.

HTH

Saju

Please rate if it helps.

View solution in original post

3 Replies 3

singhsaju
Level 4
Level 4

Hello,

Do you see IPSEC sa being built for that traffic? Post output of "show crypto ipsec sa". Do you see encrypts/decrypts ?

HTH

Saju

Please rate if it helps

Hello,

thanks for your response. The output is attached, it's to long for posting it.

regards

Matthias

From the Crypto acl:

permit gre host 172.31.254.254 host 172.31.254.1 ---------------> SAs are built and the traffic is going through

permit ip 10.70.0.0 0.0.0.255 192.168.10.0 0.0.0.255 ---------------------> there are no SA built for it! Check for mirror image acl entry for it on other side in crypto acl.

HTH

Saju

Please rate if it helps.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: