Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 

VPN tunnel fails to come up on the router

Core issue

The VPN tunnel can fail to come up on the router if traffic hits the deny ip any any statement before the permit statements in the access-group bound to the outside interface.


Once the traffic reaches the outside interface of the router, the router checks it against the access-group. If the deny statement comes before the permit statements, the router drops the packet even if interesting traffic is permitted in the permit statement.

Resolution

In order to resolve this issue, make sure that permit statements come before the deny ip any any statement in the access-group bound to the outside interface.


Here are a few other common reasons:
  • The wrong IP address is configured in the pre-share key or crypto map.
  • The crypto map is not bound to the outside interface.
  • There are mis-matched access control lists on the peers.
  • The ISP blocks UDP port 500.

521
Views
0
Helpful
0
Comments