Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

3002 to 3005 VPN not working

--begin ciscomoderator note-- The following post has been edited to remove potentially confidential information. Please refrain from posting confidential information on the site to reduce security risks to your network. -- end ciscomoderator note --

I've configured about 20 of these using DSL ISP's on the remote side with a 3002. In house we have a VPN 3005 where the tunnels terminate. I configure this using Network extension mode (PAT disabled). That is how this and all others are configured. However, I can't get this particular 3002 to connect. It looks like it starts IKE negotiation at least. I get this strange error message:

This message appears on the 3002 and 3005

210 06/11/2003 14:21:09.300 SEV=5 IKE/172 RPT=17 xx.xxx.xxx.10

Group [xx.xxx.xxx.10]

Automatic NAT Detection Status:

Remote end is NOT behind a NAT device

This end is NOT behind a NAT device

The remote side is using a speedstream router and AT&T business DSL. Nothing is supposed to be blocked and all filters are turned off on the DSL router for now. I don't understand why this is not connected. Please help!

Other relevent messages:

(From the 3005)

Group [BP-WPB_3002]

IKE SA Proposal # 1, Transform # 2 acceptable

Matches global IKE entry # 2 Proposal (CiscoVPNClient-3DES-MD5)

1 REPLY
Cisco Employee

Re: 3002 to 3005 VPN not working

Hi,

The first suggestion I would give is to take away the speedstream router and AT&T business DSL as the possible cause and try from one of the other sites which work fine. Additionally if you can go ahead and try to get the 3002 connect to the same group as the rest of these. The message:

210 06/11/2003 14:21:09.300 SEV=5 IKE/172 RPT=17 xx.xxx.xxx.10

Group [xx.xxx.xxx.10]

Automatic NAT Detection Status:

Remote end is NOT behind a NAT device

This end is NOT behind a NAT device

is just an informational message and doesn't tell us exactly whats wrong. Kindly make sure that the issue is not with the upstream router and then collect the details logs to send to TAC and troubleshoot the issue with them.

Hope this helps,

Regards,

Aamir Waheed,

Cisco Systems, Inc.

-=-=-

89
Views
0
Helpful
1
Replies
CreatePlease login to create content