I am having trouble with my hub-spoke setup.
Cisco2611_ILM – hub site
Cisco1750_MYR – spoke1
Cisco2610_CLT – spoke2
The first spoke to complete its IKE phases will work correctly while the second will not. Both spokes successfully complete IKE phases with the following results:
---
Cisco2611_ILM#sho cry eng conn act
ID Interface IP-Address State Encrypt Decrypt
10 <none> <none> ---------set ------0 0 -------ISAKMP
11 <none> <none> ---------set ------0 0 -------ISAKMP
2000 E0/1 xx.xxx.xxx.xx --set ------0 6241 ----MYRinbound
2001 E0/1 xx.xxx.xxx.xx --set ---5317 0 -------MYRoutbound
2002 E0/1 xx.xxx.xxx.xx --set ------0 0 -------CLTinbound
2003 E0/1 xx.xxx.xxx.xx --set ----940 0 -------CLToutbound
---
Cisco2610_CLT#sho cry eng conn act
ID Interface IP-Address State Encrypt Decrypt
1 <none> <none> ----------set ------0 0 -------ISAKMP
2000 FE1/0 xx.xx.xxx.xx --set ------0 1031 ----ILMinbound
2001 FE1/0 xx.xx.xxx.xx --set ------1675 0 ----ILMoutbound
Notice that the hub router (ILM) does not show decrypts for the CLT inbound traffic. If I force the CLT tunnel up first and then the MYR tunnel, the MYR tunnel will have this same problem.
This is currently an IPSEC only vpn but I had the same problem with a GRE/IPSEC vpn between the same sites. I have eliminated my inbound access-lists on the public interfaces as a problem by turning them off and still experiencing the same results. Debug out put appears normal.
While the second tunnel is up, I receive the following error at the hub router once per minute:
1d00h: %CRYPTO-4-PKT_REPLAY_ERR: decrypt: replay check failed connection id=2000
Any help would be greatly appreciated.
