[1.] Router A: ====== Version: Cisco IOS Software, C181X Software (C181X-ADVIPSERVICESK9-M), Version 12.4(6)T5, RELEASE SOFTWARE (fc1) Conifiguration: crypto isakmp policy 1 encr 3des hash md5 authentication pre-share group 2 lifetime 28800 crypto isakmp key *** address *.*.*.194 crypto isakmp keepalive 10 crypto ipsec transform-set to_vpn_amc_and_olo esp-3des esp-md5-hmac crypto map amc_olo 20 ipsec-isakmp set peer *.*.*.194 set transform-set to_vpn_amc_and_olo match address address_to_vpn_olo interface FastEthernet0 ip address *.*.*.34 255.255.255.240 ip access-group OUTSIDE in no ip redirects no ip unreachables no ip proxy-arp ip nbar protocol-discovery ip nat outside ip inspect OUTSIDE in ip virtual-reassembly ip route-cache flow load-interval 30 duplex auto speed auto crypto map amc_olo Router B: ====== Version: Cisco IOS Software, C870 Software (C870-ADVIPSERVICESK9-M), Version 12.4(4)XC2, RELEASE SOFTWARE (fc1) Configuration: crypto isakmp policy 1 encr 3des hash md5 authentication pre-share group 2 lifetime 28800 crypto isakmp key *** address *.*.95.34 crypto isakmp keepalive 10 ! ! crypto ipsec transform-set to_vpn_amc_and_centrala esp-3des esp-md5-hmac ! crypto map amc_and_centrala 10 ipsec-isakmp set peer *.*.95.34 set transform-set to_vpn_amc_and_centrala match address address_to_vpn_centrala interface FastEthernet4 ip address *.*.*.194 255.255.255.248 ip access-group OUTSIDE in ip nbar protocol-discovery ip flow egress ip nat outside ip inspect OUTSIDE in ip virtual-reassembly load-interval 30 duplex auto speed auto no cdp enable crypto map amc_and_centrala [2.] Router B: router-B#show crypto ipsec sa peer 88.208.95.34 detail interface: FastEthernet4 Crypto map tag: amc_and_centrala, local addr *.*.*.194 protected vrf: (none) local ident (addr/mask/prot/port): (172.16.251.0/255.255.255.224/0/0) remote ident (addr/mask/prot/port): (172.16.255.0/255.255.255.0/0/0) current_peer *.*.*.34 port 500 PERMIT, flags={origin_is_acl,} #pkts encaps: 84928, #pkts encrypt: 84928, #pkts digest: 84928 #pkts decaps: 90601, #pkts decrypt: 90601, #pkts verify: 90601 #pkts compressed: 0, #pkts decompressed: 0 #pkts not compressed: 0, #pkts compr. failed: 0 #pkts not decompressed: 0, #pkts decompress failed: 0 #pkts no sa (send) 1, #pkts invalid sa (rcv) 337 #pkts encaps failed (send) 0, #pkts decaps failed (rcv) 0 #pkts invalid prot (recv) 0, #pkts verify failed: 0 #pkts invalid identity (recv) 0, #pkts invalid len (rcv) 0 #pkts replay rollover (send): 0, #pkts replay rollover (rcv) 0 ##pkts replay failed (rcv): 0 #pkts internal err (send): 0, #pkts internal err (recv) 337 local crypto endpt.: 80.79.31.194, remote crypto endpt.: 88.208.95.34 path mtu 1500, ip mtu 1500 current outbound spi: 0xE3EAF363(3823825763) inbound esp sas: spi: 0xFF11AD08(4279348488) transform: esp-3des esp-md5-hmac , in use settings ={Tunnel, } conn id: 11, flow_id: Motorola SEC 1.0:11, crypto map: amc_and_centrala sa timing: remaining key lifetime (k/sec): (4431364/2280) IV size: 8 bytes replay detection support: Y Status: ACTIVE inbound ah sas: inbound pcp sas: outbound esp sas: spi: 0xE3EAF363(3823825763) transform: esp-3des esp-md5-hmac , in use settings ={Tunnel, } conn id: 12, flow_id: Motorola SEC 1.0:12, crypto map: amc_and_centrala sa timing: remaining key lifetime (k/sec): (4426336/2280) IV size: 8 bytes replay detection support: Y Status: ACTIVE outbound ah sas: outbound pcp sas: [3.] Crypto ISAKMP debugging is on Crypto ISAKMP Error debugging is on Crypto IPSEC debugging is on Crypto IPSEC Error debugging is on