Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Users might experience few discrepancies in Search results. We are working on this on our side. We apologize for the inconvenience it may have caused.
New Member

VPN - determining initiating side

I've got a Cisco VPN Concentrator 3005 set-up to accomodate some LAN-2-LAN-connections.

How can I see which side of the tunnel initiates the connection?

1 REPLY
Silver

Re: VPN - determining initiating side

I think, an IPSec tunnel is initiated by interesting traffic. Traffic is considered interesting when it travels between the IPSec peers.

These interesting traffic are configured using access-lists.

show crypto map is the command used to view the defined acces list.

To view the tunnel initiator, I think any one of the following debug commands will be helpful.

debug crypto ipsec  Shows if a client is negotiating the IPSec portion of the VPN connection.

debug crypto isakmp  Shows if the peers are negotiating the ISAKMP portion of the VPN connection.

IPSec negotiation can be broken down into five steps, including two Internet Key Exchange (IKE) phases.

An IPSec tunnel is initiated by interesting traffic. Traffic is considered interesting when it travels between the IPSec peers.

In IKE Phase 1, the IPSec peers negotiate the established IKE Security Association (SA) policy. Once the peers are authenticated, a secure tunnel is created using Internet Security Association and Key Management Protocol (ISAKMP).

In IKE Phase 2, the IPSec peers use the authenticated and secure tunnel to negotiate IPSec SA transforms. The negotiation of the shared policy determines how the IPSec tunnel is established.

The IPSec tunnel is created and data is transferred between the IPSec peers based on the IPSec parameters configured in the IPSec transform sets.

The IPSec tunnel terminates when the IPSec SAs are deleted or when their lifetime expires.

98
Views
0
Helpful
1
Replies
CreatePlease to create content