Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

Cisco 1841 to Vigor VPN

Hi All,

I'm in desperate need of some help. I've spent the last 48 hrs trawling the internet try to find how to set this up secessfully

I have ports 80 and 443 port forwarded for 78.25.xxx.xxx to our local  mailserver 192.168.6.65. But all im presented with is page cannot be  displayed when i try and connect to the external IP within the LAN. However if i try and access this address outside the lan then  it works great?

My other problem I have is i would like to setup 7 vpn's which all dial in to this router. They are setup to use ipsec with an ike pre-shared key. The dial in router's are vigor 2600-2820  series and i was going to use the following config for the cisco but it  hangs at crypto map cm-cryptomap.

If anyone can help me i would really really appreciate it.

Network setup
                                     PRIVATE IP    PUBLIC IP
HUB SITE(CISCO 1841)   192.168.6.0   78.XX.XXX.48
SPOKE SITE(VIGOR 2600) 192.168.88.0  85.XX.XXX.85

################# attempted vpn config which didnt work #######

crypto isakmp policy 1
hash md5
authentication pre-share
lifetime 3600
crypto isakmp key 123 address 85.189.xxx.xxx   (spoke site)
crypto ipsec transform-set cm-transformset-1 esp-des esp-md5-hmac
crypto mib ipsec flowmib history tunnel size 200
crypto mib ipsec flowmib history failure size 200
crypto map cm-cryptomap local-address FastEthernet0/0
crypto map cm-cryptomap 1 ipsec-isakmp
set peer 85.189.155.85  (spoke site)
set transform-set cm-transformset-1
match address 100

interface FastEthernet0/0
crypto map cm-cryptomap
access-list 100 permit ip 192.168.6.0 0.0.0.255 192.168.88.0 0.0.0.255


Below is the full config less vpn info which works flawlessly with bonded adsl
################ FULL CONFIG ################

Current configuration : 3938 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname BURTON
!
boot-start-marker
boot-end-marker
!
enable secret 5 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
enable password xxxxxxxxxxx
!
no aaa new-model
ip cef
!
!
ip auth-proxy max-nodata-conns 3
ip admission max-nodata-conns 3
!
!
ip name-server 62.121.0.2
ip name-server 195.54.225.10
!
!
crypto pki trustpoint TP-self-signed-692553461
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-692553461
revocation-check none
rsakeypair TP-self-signed-692553461
!
!
crypto pki certificate chain TP-self-signed-692553461
certificate self-signed 01
  3082023C 308201A5 A0030201 02020101 300D0609 2A864886 F70D0101 04050030
  30312E30 2C060355 04031325 494F532D 53656C66 2D536967 6E65642D 43657274
  69666963 6174652D 36393235 35333436 31301E17 0D313031 31323431 34343930
  325A170D 32303031 30313030 30303030 5A303031 2E302C06 03550403 1325494F
  532D5365 6C662D53 69676E65 642D4365 72746966 69636174 652D3639 32353533
  34363130 819F300D 06092A86 4886F70D 01010105 0003818D 00308189 02818100
  BA51CDF7 D418D270 7DCE516E 1ADE6DF5 82FE4507 CD1EBE0A 4B6E4B15 9A3C20ED
  B1D19FC9 63D0B925 0A4611FF CE8D935C 264FC3FE DF8BFAC2 76EC38ED 68115F43
  20A68D85 C04A564E 8BDE86FE 127F79B4 8E123D9C 8430940C BCD5CDA4 ADAAE387
  FA1E14A6 ECF92197 0CF54E89 B33915E7 A4E01EC7 CE45DDF6 AA60D168 38C92E67
  02030100 01A36630 64300F06 03551D13 0101FF04 05300301 01FF3011 0603551D
  11040A30 08820642 5552544F 4E301F06 03551D23 04183016 8014645E 3FDE4E90
  A8773580 81EE4217 F4821238 993A301D 0603551D 0E041604 14645E3F DE4E90A8
  77358081 EE4217F4 82123899 3A300D06 092A8648 86F70D01 01040500 03818100
  B9B21771 6B8C0F9E C66B907A AC7A09BF 1FFCB332 0C7B6446 22483A32 5EE7D1FC
  0A29DD8B 4ABE123D 250070DF 30964615 128A9224 E70FFE29 513455AB 6A1747C4
  E67A33F0 4E61AB87 9AE1D2DC 72741BE7 3A9AD79D 13B622B3 BCADCDAA 9D5EA74C
  567D2852 AD429722 9AE90E13 7D80027F 4FA37A7F 65014A45 43CB141C 36FCB96B
  quit
!
!
!
!
!
!
interface FastEthernet0/0
description $ETH-LAN$
ip address 192.168.6.40 255.255.255.0
ip nat inside
ip virtual-reassembly
duplex auto
speed auto
!
interface FastEthernet0/1
no ip address
shutdown
duplex auto
speed auto
!
interface ATM0/0/0
no ip address
no ip mroute-cache
no atm ilmi-keepalive
bundle-enable
dsl operating-mode auto
pvc 0/38
  encapsulation aal5mux ppp dialer
  dialer pool-member 1
!
!
interface ATM0/1/0
no ip address
no ip mroute-cache
no atm ilmi-keepalive
bundle-enable
dsl operating-mode auto
pvc 0/38
  encapsulation aal5mux ppp dialer
  dialer pool-member 1
!
!
interface Dialer0
ip address negotiated
ip nat outside
ip virtual-reassembly
encapsulation ppp
dialer pool 1
dialer-group 1
ppp reliable-link
ppp authentication chap callin
ppp chap hostname username@supplier.co.uk
ppp chap password 0 xxxxxxxx
ppp ipcp dns request
ppp link reorders
ppp multilink
ppp multilink slippage mru 16
ppp multilink fragment delay 10
ppp multilink interleave
ppp multilink multiclass
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 Dialer0
!
ip http server
ip http secure-server
ip nat inside source list 100 interface Dialer0 overload
ip nat inside source static tcp 192.168.6.65 25 interface Dialer0 25
ip nat inside source static tcp 192.168.6.45 1723 interface Dialer0 1723
ip nat inside source static tcp 192.168.6.65 80 78.XX.XXX.61 80 extendable
ip nat inside source static tcp 192.168.6.65 443 78.XX.XXX.61 443 extendable
ip nat inside source static tcp 192.168.6.30 80 78.XX.XXX.62 80 extendable
ip nat inside source static tcp 192.168.6.30 443 78.XX.XXX.62 443 extendable
!
access-list 100 permit ip 192.168.6.0 0.0.0.255 any
dialer-list 1 protocol ip permit
snmp-server community public RO
!
!
control-plane
!
!
line con 0
line aux 0
line vty 0 4
password xxxxxxxxxxxx
login
!
scheduler allocate 20000 1000
end

2 ACCEPTED SOLUTIONS

Accepted Solutions
Cisco Employee

Re: Cisco 1841 to Vigor VPN

The crypto is working fine it seems.

The error which you are receiving is I think because vigor side is able to encrypt an ip subnet (range) which is not defined by Cisco.

The vigor is sending it down to Cisco and after decrypting it the IPSEC SA is dropping it because it is not part of the interesting traffic.

But, I guess you are already up and running.

Cisco Employee

Re: Cisco 1841 to Vigor VPN

Hello Mark,

This looks like a defect to me.

Post your show version please.

29 REPLIES
Cisco Employee

Re: Cisco 1841 to Vigor VPN

Please tell us more about the errors which you are getting. By the looks of it the configuration is fine.

################# attempted vpn config which didnt work #######

crypto isakmp policy 1
hash md5
authentication pre-share
lifetime 3600

crypto isakmp key 123 address 85.189.xxx.xxx   (spoke site)
crypto ipsec transform-set cm-transformset-1 esp-des esp-md5-hmac


crypto map cm-cryptomap local-address FastEthernet0/0

crypto map cm-cryptomap 1 ipsec-isakmp
set peer 85.189.155.85  (spoke site)
set transform-set cm-transformset-1
match address 100

interface FastEthernet0/0
crypto map cm-cryptomap

access-list 100 permit ip 192.168.6.0 0.0.0.255 192.168.88.0 0.0.0.255

New Member

Re: Cisco 1841 to Vigor VPN

First off when im entering this config i get down to crypto map cm-cryptomap and then the router is then uncontactable? so i can't even put the correct acl in from then on. I'm a complete novice at cisco's to be honest, managed to setup the bonded lines ok and some port forwarding but really am struggling here.

How can i debug the vpn connection or see the errors?

Thanks

New Member

Re: Cisco 1841 to Vigor VPN

I've turned some sort of debugging on

Router# debug crypto verbose
Router# debug crypto isakmp
Router# term monitor
New Member

Re: Cisco 1841 to Vigor VPN

Below my latest attempt, will switch this over when i get to work tomorrow and see if it works.

Building configuration...                      

Current configuration : 4729 bytes                                 
!
version 12.4           
service timestamps debug datetime msec                                     
service timestamps log datetime msec                                   
no service password-encryption                             
!
hostname BURTON              
!
boot-start-marker                
boot-end-marker              
!
enable secret 5 xxxxxxxxxxxxxxxxxxxxxxxxx                                             
enable password xxxxxxxxxxxxxxxx                          
!
no aaa new-model               
ip cef     
!
!
ip auth-proxy max-nodata-conns 3                               
ip admission max-nod                  
!
!
ip name-server 62.121.0.2                        
ip name-server 195.54.225.10                           
!
!
crypto pki trustpoint TP-self-signed-692553461                                             
enrollment selfsigned                     
subject-name cn=IOS-Self-Signed-Certificate-692553461                                                     
revocation-check none                     
rsakeypair TP-self-signed-692553461                                   
!
!
crypto pki certificate chain TP-self-signed-692553461                                                    
certificate self-signed 01                          
  3082023C 308201A5 A0030201 02020101 300D0609 2A864886 F70D0101 04050030                                                                        
  30312E30 2C060355 04031325 494F532D 53656C66 2D536967 6E65642D 43657274                                                                        
  69666963 6174652D 36393235 35333436 3                                    
  365A170D 32303031 30313030 30303030 5A303031 2E302C06 03550403 1325494F                                                                        
  532D5365 6C662D53 69676E65 642D4365 72746966 69636174 652D3639 32353533                                                                        
  34363130 819F300D 06092A86 4886F70D 01010105 0003818D 00308189 02818100                                                                        
  BA51CDF7 D418D270 7DCE516E 1ADE6DF5 82FE4507 CD1EBE0A 4B6E4B15 9A3C20ED                                                                        
  B1D19FC9 63D0B925 0A4611FF CE8D935C 264FC3FE DF8BFAC2 76EC38ED 68115F43                                                                        
  20A68D85 C04A564E 8BDE86FE 127F79B4 8E123D9C 8430940C BCD5CDA4 ADAAE387                                                                        
  FA1E14A6 ECF92197 0CF54E89 B33915E7 A4E01EC7 CE45DDF6 AA60D168 38C92E                                                                     
  02030100 01A36630 64300F06 03551D13 0101FF04 05300301 01FF3011 0603551D                                                                        
  11040A30 08820642 5552544F 4E301F06 03551D23 04183016 8014645E 3FDE4E90                                                                        
  A8773580 81EE4217 F4821238 993A301D 0603551D 0E041604 14645E3F DE4E90A8                                                                        
  77358081 EE4217F4 82123899 3A300D06 092A8648 86F70D01 01040500 03818100                                                                        
  5FE3DF70 3253B1F7 D1359012 24F8E1E3 57E1DF58 A2010295 A03A8C75 FA41E51D                                                                        
  09C5E211 8BD9C42E D1D242FB 6BDCD933 B22256C9 ADB1841D BD015A05 28D41A86                                                                        
  E1E80740 1CDC4B02 FD689446 426DE1D6 0D1500A6 C5558839 029AA0D0 B8AA33                                                                     
  88DACDDA AC58BC10 799FC7CD FBCB8A3A 0FB8A789 9756338C F51AF115 159ADC52                                                                        
  quit     
!
!
!
!
crypto isakmp policy 1                     
encr 3des         
authentication pre-share                        
group 2       
crypto isakmp key xxxxxxx address 77.xxx.xxx.176                                                 
!
!
crypto ipsec transform-set 3DES-SHA esp-3des esp-sha-hmac                                                        
crypto ipsec transform-set AES-SHA esp-aes esp-sha-hmac                                                      
crypto ipsec transform-set 3DES-SHA-compression esp-3des esp-sha-hmac comp-lzs                                                                             
crypto ipsec transform-set AES-SHA-compression esp-aes esp-sha-hmac comp-lzs                                                                           
!
crypto map VPN-Map-1 10 ipsec-isakmp                                  
set peer 77.xxx.xxx.176                       
set transform-set AES-SHA-compression                                     
set pfs group2              
match address Crypto-list                         
!
!
!
interface FastEthernet0/0                        
description $ETH-LAN$                     
ip address 192.168.6.40 255.255.255.0                                     
ip nat inside             
ip virtual-reassembly                     
duplex auto           
speed auto          
crypto map VPN-Map-1                    
!
interface FastEthernet0/1                        
no ip address             
shutdown        
duplex auto           
speed auto          
!
interface ATM0/0/0                 
no ip address             
no ip mroute-cache                  
no atm ilmi-keepalive                     
bundle-enable             
dsl operating-mode auto                       
pvc 0/38        
  encapsulation aal5mux ppp dialer                               
  dialer pool-member 1                     

!
interface ATM0/1/0                 
no ip address             
no ip mroute-cache                  
no atm ilmi-keepalive                     
bundle-enable             
dsl operating-mode auto                       
pvc 0/38        
  encapsulation aal5mux ppp dialer                                 
  dialer pool-member 1                     

!
interface Dialer0                
ip address negotiated                     
ip nat outside              
ip virtual-reassembly                     
encapsulation ppp                 
dialer pool 1             
dialer-group 1              
ppp reliable-link                 
ppp authentication chap callin                              
ppp chap hostname xxxxxxxxxxxxxxxxxxxxx                                             
ppp chap password 0 xxxxxxxxxxx                            
ppp ipcp dns request                    
ppp link reorders                 
ppp mult      
ppp multilink slippage mru 16                             
ppp multilink fragment delay 10                               
ppp multilink interleave                        
ppp multilink multiclass                        
!
ip forward-protocol nd                     
ip route 0.0.0.0 0.0.0.0 Dialer0                               
!
ip http server             
ip http secure-server                    
ip nat inside source list 100 interface Dialer0 overload                                                       
ip nat inside source static tcp 192.168.6.45 1723 interface Dialer0 1723                                                                       
ip nat inside source static tcp 192.168.6.65 25 interface Dialer0 25                                                                   
ip nat inside source static tcp 192.168.6.65 80 78.xxx.xxx.61 80 extendable                                                                         
ip nat inside source static tcp 192.168.6.65 443 78.xxx.xxx.61 443 extendable                                                                           
ip nat inside source static tcp 192.168.6.30 80 78.xxx.xxx.62 80 extendable                                                                         
ip nat inside source static tcp 192.168.6.30 443 78.xxx.xxx.62 443 extendable                                                                           
!
ip access-list extended Crypto-list
permit ip 192.168.6.0 0.0.0.255 192.168.88.0 0.0.0.255
ip access-list extended Internet-inbound-ACL
permit udp host 77.xxx.xxx.176 any eq isakmp
permit esp host 77.xxx.xxx.176 any
!
access-list 100 permit ip 192.168.6.0 0.0.0.255 any
dialer-list 1 protocol ip permit
snmp-server community public RO
!
!
control-plane
!
!
line con 0
line aux 0
line vty 0 4
password xxxxxxxxxxx
login
!
scheduler allocate 20000 1000
end

New Member

Re: Cisco 1841 to Vigor VPN

I'm not sure if this is correct? The FastEthernet 0/0 is the internal interface and ATM0/0/0 and ATM0/1/0 are the external interface there is also the Dailer0, can someone confirm this is correct or not.

interface FastEthernet0/0                        
description $ETH-LAN$                     
ip address 192.168.6.40 255.255.255.0                                     
ip nat inside             
ip virtual-reassembly                     
duplex auto           
speed auto          
crypto map VPN-Map-1

Cisco Employee

Re: Cisco 1841 to Vigor VPN

Hello Mark,

The crypto map will be on the outbound interface which is connected to the internet. In your case it will be the dialer interface. To remember, the crypto map will normally be on a interface which has 'ip nat outside' for internet bound traffic.

Cisco Employee

Re: Cisco 1841 to Vigor VPN

Hello Mark,

These are the correct debugs in case you need to troubleshoot it further.

I hope after putting the crypto ACL first then the crypto map things may work.

Cisco Employee

Re: Cisco 1841 to Vigor VPN

Hello Mark,

You need to put the crypto ACL first then attach the crypto map on the interface.

If you will attach the crypto map to the interface without defining the crypto acl then by default ALL the traffic is going to be encrypted by this router. That is the reason why the router become inaccessible through SSH or telnet or any other traffic for that matter.

New Member

Re: Cisco 1841 to Vigor VPN

Hi Vikas,

Thanks for your help in this matter.

I've done this

ip access-list extended Crypto-list
permit ip 192.168.6.0 0.0.0.255 192.168.78.0 0.0.0.255

Should this be okay? I've taken the cryto map off the ethernet interface and put it on the dialer0.

Cisco Employee

Re: Cisco 1841 to Vigor VPN

Hello Mark,

That's correct.

New Member

Re: Cisco 1841 to Vigor VPN

I'm getting somewhere...

It looks like an encryption problem

###########################   CONFIG ########################################

crypto isakmp policy 1
hash md5
authentication pre-share
group 2
lifetime 3600
crypto isakmp key burtonst1 address 78.XX.XXX.48
!
!
crypto ipsec transform-set 3DES-SHA esp-3des esp-sha-hmac
crypto ipsec transform-set AES-SHA esp-aes esp-sha-hmac
crypto ipsec transform-set 3DES-SHA-compression esp-3des esp-sha-hmac comp-lzs
crypto ipsec transform-set AES-SHA-compression esp-aes esp-sha-hmac comp-lzs
!
crypto map VPN-Map-1 10 ipsec-isakmp
set peer 78.XX.XXX.48
set transform-set 3DES-SHA
set pfs group2
match address Crypto-list
!
!
!
interface FastEthernet0/0
description $ETH-LAN$
ip address 192.168.78.40 255.255.255.0
ip nat inside
ip virtual-reassembly
duplex auto
speed auto
!
interface FastEthernet0/1
no ip address
shutdown
duplex auto
speed auto
!
interface ATM0/0/0
no ip address
no ip mroute-cache
no atm ilmi-keepalive
bundle-enable
dsl operating-mode auto
pvc 0/38
  encapsulation aal5mux ppp dialer
  dialer pool-member 1
!
!
interface ATM0/1/0
no ip address
no ip mroute-cache
no atm ilmi-keepalive
bundle-enable
dsl operating-mode auto
pvc 0/38
  encapsulation aal5mux ppp dialer
  dialer pool-member 1
!
!
interface Dialer0
ip address negotiated
ip nat outside
ip virtual-reassembly
encapsulation ppp
dialer pool 1
dialer-group 1
ppp reliable-link
ppp authentication chap callin
ppp chap hostname XXXXXXXXXXXXXXXXXXX

ppp chap password 0 XXXXXXX

ppp ipcp dns request
ppp link reorders
ppp multilink
ppp multilink slippage mru 16
ppp multilink fragment delay 10
ppp multilink interleave
ppp multilink multiclass
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 Dialer0
!
ip http server
ip http secure-server
ip nat inside source list 100 interface Dialer0 overload
!
ip access-list extended Crypto-list
permit ip 192.168.78.0 0.0.0.255 192.168.6.0 0.0.0.255
ip access-list extended Internet-inbound-ACL
permit udp host 78.XX.XX.48 any eq isakmp
permit esp host 78.XX.XXX.48 any
!
access-list 100 permit ip 192.168.78.0 0.0.0.255 any
dialer-list 1 protocol ip permit
snmp-server community public RO

############################################################################

*Nov 25 10:55:17.663: ISAKMP: New peer created peer = 0x6377038C peer_handle = 0
x80000007
*Nov 25 10:55:17.663: ISAKMP: Locking peer struct 0x6377038C, IKE refcount 1 for
crypto_isakmp_process_block
*Nov 25 10:55:17.663: ISAKMP: local port 500, remote port 500
*Nov 25 10:55:17.667: insert sa successfully sa = 63955158
*Nov 25 10:55:17.667: ISAKMP:(0:0:N/A:0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH

*Nov 25 10:55:17.667: ISAKMP:(0:0:N/A:0):Old State = IKE_READY  New State = IKE_
R_MM1

*Nov 25 10:55:17.667: ISAKMP:(0:0:N/A:0): processing SA payload. message ID = 0
*Nov 25 10:55:17.667: ISAKMP:(0:0:N/A:0):found peer pre-shared key matching 78.2
5.240.48
*Nov 25 10:55:17.667: ISAKMP:(0:0:N/A:0): local preshared key found
*Nov 25 10:55:17.667: ISAKMP : Scanning profiles for xauth ...
*Nov 25 10:55:17.667: ISAKMP:(0:0:N/A:0):Checking ISAKMP transform 0 against pri
ority 1 policy
*Nov 25 10:55:17.667: ISAKMP:      life type in seconds
*Nov 25 10:55:17.667: ISAKMP:      life duration (basic) of 28800
*Nov 25 10:55:17.667: ISAKMP:      encryption DES-CBC
*Nov 25 10:55:17.667: ISAKMP:      hash MD5
*Nov 25 10:55:17.667: ISAKMP:      auth pre-share
*Nov 25 10:55:17.667: ISAKMP:      default group 1
*Nov 25 10:55:17.667: ISAKMP:(0:0:N/A:0):Diffie-Hellman group offered does not m
atch policy!
*Nov 25 10:55:17.667: ISAKMP:(0:0:N/A:0):atts are not acceptable. Next payload i
s 3
*Nov 25 10:55:17.667: ISAKMP:(0:0:N/A:0):Checking ISAKMP transform 1 against pri
ority 1 policy
*Nov 25 10:55:17.667: ISAKMP:      life type in seconds
*Nov 25 10:55:17.667: ISAKMP:      life duration (basic) of 28800
*Nov 25 10:55:17.667: ISAKMP:      encryption DES-CBC
*Nov 25 10:55:17.667: ISAKMP:      hash SHA
*Nov 25 10:55:17.667: ISAKMP:      auth pre-share
*Nov 25 10:55:17.667: ISAKMP:      default group 1
*Nov 25 10:55:17.667: ISAKMP:(0:0:N/A:0):Hash algorithm offered does not match p
olicy!
*Nov 25 10:55:17.667: ISAKMP:(0:0:N/A:0):atts are not acceptable. Next payload i
s 3
*Nov 25 10:55:17.667: ISAKMP:(0:0:N/A:0):Checking ISAKMP transform 2 against pri
ority 1 policy
*Nov 25 10:55:17.667: ISAKMP:      life type in seconds
*Nov 25 10:55:17.667: ISAKMP:      life duration (basic) of 28800
*Nov 25 10:55:17.667: ISAKMP:      encryption 3DES-CBC
*Nov 25 10:55:17.667: ISAKMP:      hash MD5
*Nov 25 10:55:17.667: ISAKMP:      auth pre-share
*Nov 25 10:55:17.667: ISAKMP:      default group 1
*Nov 25 10:55:17.667: ISAKMP:(0:0:N/A:0):Encryption algorithm offered does not m
atch policy!
*Nov 25 10:55:17.667: ISAKMP:(0:0:N/A:0):atts are not acceptable. Next payload i
s 3
*Nov 25 10:55:17.671: ISAKMP:(0:0:N/A:0):Checking ISAKMP transform 3 against pri
ority 1 policy
*Nov 25 10:55:17.671: ISAKMP:      life type in seconds
*Nov 25 10:55:17.671: ISAKMP:      life duration (basic) of 28800
*Nov 25 10:55:17.671: ISAKMP:      encryption 3DES-CBC
*Nov 25 10:55:17.671: ISAKMP:      hash MD5
*Nov 25 10:55:17.671: ISAKMP:      auth pre-share
*Nov 25 10:55:17.671: ISAKMP:      default group 2
*Nov 25 10:55:17.671: ISAKMP:(0:0:N/A:0):Encryption algorithm offered does not m
atch policy!
*Nov 25 10:55:17.671: ISAKMP:(0:0:N/A:0):atts are not acceptable. Next payload i
s 0
*Nov 25 10:55:17.671: ISAKMP:(0:0:N/A:0):Checking ISAKMP transform 0 against pri
ority 65535 policy
*Nov 25 10:55:17.671: ISAKMP:      life type in seconds
*Nov 25 10:55:17.671: ISAKMP:      life duration (basic) of 28800
*Nov 25 10:55:17.671: ISAKMP:      encryption DES-CBC
*Nov 25 10:55:17.671: ISAKMP:      hash MD5
*Nov 25 10:55:17.671: ISAKMP:      auth pre-share
*Nov 25 10:55:17.671: ISAKMP:      default group 1
*Nov 25 10:55:17.671: ISAKMP:(0:0:N/A:0):Hash algorithm offered does not match p
olicy!
*Nov 25 10:55:17.671: ISAKMP:(0:0:N/A:0):atts are not acceptable. Next payload i
s 3
*Nov 25 10:55:17.671: ISAKMP:(0:0:N/A:0):Checking ISAKMP transform 1 against pri
ority 65535 policy
*Nov 25 10:55:17.671: ISAKMP:      life type in seconds
*Nov 25 10:55:17.671: ISAKMP:      life duration (basic) of 28800
*Nov 25 10:55:17.671: ISAKMP:      encryption DES-CBC
*Nov 25 10:55:17.671: ISAKMP:      hash SHA
*Nov 25 10:55:17.671: ISAKMP:      auth pre-share
*Nov 25 10:55:17.671: ISAKMP:      default group 1
*Nov 25 10:55:17.671: ISAKMP:(0:0:N/A:0):Authentication method offered does not
match policy!
*Nov 25 10:55:17.671: ISAKMP:(0:0:N/A:0):atts are not acceptable. Next payload i
s 3
*Nov 25 10:55:17.671: ISAKMP:(0:0:N/A:0):Checking ISAKMP transform 2 against pri
ority 65535 policy
*Nov 25 10:55:17.671: ISAKMP:      life type in seconds
*Nov 25 10:55:17.671: ISAKMP:      life duration (basic) of 28800
*Nov 25 10:55:17.671: ISAKMP:      encryption 3DES-CBC
*Nov 25 10:55:17.671: ISAKMP:      hash MD5
*Nov 25 10:55:17.671: ISAKMP:      auth pre-share
*Nov 25 10:55:17.671: ISAKMP:      default group 1
*Nov 25 10:55:17.671: ISAKMP:(0:0:N/A:0):Encryption algorithm offered does not m
atch policy!
*Nov 25 10:55:17.671: ISAKMP:(0:0:N/A:0):atts are not acceptable. Next payload i
s 3
*Nov 25 10:55:17.671: ISAKMP:(0:0:N/A:0):Checking ISAKMP transform 3 against pri
ority 65535 policy
*Nov 25 10:55:17.671: ISAKMP:      life type in seconds
*Nov 25 10:55:17.671: ISAKMP:      life duration (basic) of 28800
*Nov 25 10:55:17.671: ISAKMP:      encryption 3DES-CBC
*Nov 25 10:55:17.671: ISAKMP:      hash MD5
*Nov 25 10:55:17.671: ISAKMP:      auth pre-share
*Nov 25 10:55:17.671: ISAKMP:      default group 2
*Nov 25 10:55:17.671: ISAKMP:(0:0:N/A:0):Encryption algorithm offered does not m
atch policy!
*Nov 25 10:55:17.671: ISAKMP:(0:0:N/A:0):atts are not acceptable. Next payload i
s 0
*Nov 25 10:55:17.671: ISAKMP:(0:0:N/A:0):no offers accepted!
*Nov 25 10:55:17.671: ISAKMP:(0:0:N/A:0): phase 1 SA policy not acceptable! (loc
al 77.107.173.176 remote 78.XX.XXX.48)
*Nov 25 10:55:17.671: ISAKMP (0:0): incrementing error counter on sa, attempt 1
of 5: construct_fail_ag_init
*Nov 25 10:55:17.671: ISAKMP:(0:0:N/A:0): sending packet to 78.XX.XXX.48 my_port
500 peer_port 500 (R) MM_NO_STATE
*Nov 25 10:55:17.675: ISAKMP:(0:0:N/A:0):peer does not do paranoid keepalives.

*Nov 25 10:55:17.675: ISAKMP:(0:0:N/A:0):deleting SA reason "Phase1 SA policy

Cisco Employee

Re: Cisco 1841 to Vigor VPN

*Nov 25 10:55:17.671: ISAKMP:(0:0:N/A:0): phase 1 SA policy not acceptable!

Your configuration:

crypto isakmp policy 1

hash md5

authentication pre-share

group 2

lifetime 3600

Since you have not specified the encryption, by default it is DES.

Can you create one more policy with:

Cry isakmp policy 5

Hash md5

Encr 3des

Authen pre-share

Group 2

(All lower case).

New Member

Re: Cisco 1841 to Vigor VPN

Still having problems, the vigor is setup with 3DES with encryption

dst             src             state          conn-id slot status
77.xx.xx.176  78.xx.xxx.48    MM_NO_STATE          0    0 ACTIVE (deleted)

################## CONFIG ############

crypto isakmp policy 1
hash md5
authentication pre-share
group 2
lifetime 3600
!
crypto isakmp policy 5
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key burtonst1 address 78.xx.xxx.48
!
!
crypto ipsec transform-set 3DES-SHA esp-3des esp-sha-hmac
crypto ipsec transform-set AES-SHA esp-aes esp-sha-hmac
crypto ipsec transform-set 3DES-SHA-compression esp-3des esp-sha-hmac comp-lzs
crypto ipsec transform-set AES-SHA-compression esp-aes esp-sha-hmac comp-lzs
!
crypto map VPN-Map-1 10 ipsec-isakmp
set peer 78.xx.xxx.48
set transform-set 3DES-SHA
set pfs group2
match address Crypto-list
!
!
!
interface FastEthernet0/0
description $ETH-LAN$
ip address 192.168.78.40 255.255.255.0
ip nat inside
ip virtual-reassembly
duplex auto
speed auto
!
interface FastEthernet0/1
no ip address
shutdown
duplex auto
speed auto
!
interface ATM0/0/0
no ip address
no ip mroute-cache
no atm ilmi-keepalive
bundle-enable
dsl operating-mode auto
pvc 0/38
  encapsulation aal5mux ppp dialer
  dialer pool-member 1
!
!
interface ATM0/1/0
no ip address
no ip mroute-cache
no atm ilmi-keepalive
bundle-enable
dsl operating-mode auto
pvc 0/38
  encapsulation aal5mux ppp dialer
  dialer pool-member 1
!
!
interface Dialer0
ip address negotiated
ip nat outside
ip virtual-reassembly
encapsulation ppp
dialer pool 1
dialer-group 1
ppp reliable-link
ppp authentication chap callin
ppp chap hostname xxxxxxxxxxxxxxxxxxxx

ppp chap password 0 xxxxxxxx
ppp ipcp dns request
ppp link reorders
ppp multilink
ppp multilink slippage mru 16
ppp multilink fragment delay 10
ppp multilink interleave
ppp multilink multiclass
crypto map VPN-Map-1
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 Dialer0
!
ip http server
ip http secure-server
ip nat inside source list 100 interface Dialer0 overload
!
ip access-list extended Crypto-list
permit ip 192.168.78.0 0.0.0.255 192.168.6.0 0.0.0.255
ip access-list extended Internet-inbound-ACL
permit udp host 78.xx.xxx.48 any eq isakmp
permit esp host 78.xx.xxx.48 any
!
access-list 100 permit ip 192.168.78.0 0.0.0.255 any
dialer-list 1 protocol ip permit
snmp-server community public RO

##############################################################

*Nov 25 12:08:45.491: ISAKMP: New peer created peer = 0x632737F8 peer_handle = 0
x80000017
*Nov 25 12:08:45.491: ISAKMP: Locking peer struct 0x632737F8, IKE refcount 1 for
crypto_isakmp_process_block
*Nov 25 12:08:45.491: ISAKMP: local port 500, remote port 500
*Nov 25 12:08:45.491: insert sa successfully sa = 639559E8
*Nov 25 12:08:45.491: ISAKMP:(0:0:N/A:0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH

*Nov 25 12:08:45.491: ISAKMP:(0:0:N/A:0):Old State = IKE_READY  New State = IKE_
R_MM1

*Nov 25 12:08:45.491: ISAKMP:(0:0:N/A:0): processing SA payload. message ID = 0
*Nov 25 12:08:45.491: ISAKMP:(0:0:N/A:0):found peer pre-shared key matching 78.2
5.240.48
*Nov 25 12:08:45.491: ISAKMP:(0:0:N/A:0): local preshared key found
*Nov 25 12:08:45.491: ISAKMP : Scanning profiles for xauth ...
*Nov 25 12:08:45.495: ISAKMP:(0:0:N/A:0):Checking ISAKMP transform 0 against pri
ority 1 policy
*Nov 25 12:08:45.495: ISAKMP:      life type in seconds
*Nov 25 12:08:45.495: ISAKMP:      life duration (basic) of 28800
*Nov 25 12:08:45.495: ISAKMP:      encryption DES-CBC
*Nov 25 12:08:45.495: ISAKMP:      hash MD5
*Nov 25 12:08:45.495: ISAKMP:      auth pre-share
*Nov 25 12:08:45.495: ISAKMP:      default group 1
*Nov 25 12:08:45.495: ISAKMP:(0:0:N/A:0):Diffie-Hellman group offered does not m
atch policy!
*Nov 25 12:08:45.495: ISAKMP:(0:0:N/A:0):atts are not acceptable. Next payload i
s 0
*Nov 25 12:08:45.495: ISAKMP:(0:0:N/A:0):Checking ISAKMP transform 0 against pri
ority 5 policy
*Nov 25 12:08:45.495: ISAKMP:      life type in seconds
*Nov 25 12:08:45.495: ISAKMP:      life duration (basic) of 28800
*Nov 25 12:08:45.495: ISAKMP:      encryption DES-CBC
*Nov 25 12:08:45.495: ISAKMP:      hash MD5
*Nov 25 12:08:45.495: ISAKMP:      auth pre-share
*Nov 25 12:08:45.495: ISAKMP:      default group 1
*Nov 25 12:08:45.495: ISAKMP:(0:0:N/A:0):Encryption algorithm offered does not m
atch policy!
*Nov 25 12:08:45.495: ISAKMP:(0:0:N/A:0):atts are not acceptable. Next payload i
s 0
*Nov 25 12:08:45.495: ISAKMP:(0:0:N/A:0):Checking ISAKMP transform 0 against pri
ority 65535 policy
*Nov 25 12:08:45.495: ISAKMP:      life type in seconds
*Nov 25 12:08:45.495: ISAKMP:      life duration (basic) of 28800
*Nov 25 12:08:45.495: ISAKMP:      encryption DES-CBC
*Nov 25 12:08:45.495: ISAKMP:      hash MD5
*Nov 25 12:08:45.495: ISAKMP:      auth pre-share
*Nov 25 12:08:45.495: ISAKMP:      default group 1
*Nov 25 12:08:45.495: ISAKMP:(0:0:N/A:0):Hash algorithm offered does not match p
olicy!
*Nov 25 12:08:45.495: ISAKMP:(0:0:N/A:0):atts are not acceptable. Next payload i
s 0
*Nov 25 12:08:45.495: ISAKMP:(0:0:N/A:0):no offers accepted!
*Nov 25 12:08:45.495: ISAKMP:(0:0:N/A:0): phase 1 SA policy not acceptable! (loc
al 77.107.173.176 remote 78.xx.xxx.48)
*Nov 25 12:08:45.495: ISAKMP (0:0): incrementing error counter on sa, attempt 1
of 5: construct_fail_ag_init
*Nov 25 12:08:45.495: ISAKMP:(0:0:N/A:0): sending packet to 78.xx.xxx.48 my_port
500 peer_port 500 (R) MM_NO_STATE
*Nov 25 12:08:45.495: ISAKMP:(0:0:N/A:0):peer does not do paranoid keepalives.

*Nov 25 12:08:45.495: ISAKMP:(0:0:N/A:0):deleting SA reason "Phase1 SA policy pr
oposal not accepted" state (R) MM_NO_STATE (peer 78.xx.xxx.48)
*Nov 25 12:08:45.495: ISAKMP (0:0): FSM action returned error: 2
*Nov 25 12:08:45.495: ISAKMP:(0:0:N/A:0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_
MAIN_MODE
*Nov 25 12:08:45.499: ISAKMP:(0:0:N/A:0):Old State = IKE_R_MM1  New State = IKE_
R_MM1

*Nov 25 12:08:45.499: ISAKMP:(0:0:N/A:0):deleting SA reason "Phase1 SA policy pr
oposal not accepted" state (R) MM_NO_STATE (peer 78.xx.xxx.48)
*Nov 25 12:08:45.499: ISAKMP: Unlocking IKE struct 0x632737F8 for isadb_mark_sa_
deleted(), count 0
*Nov 25 12:08:45.499: ISAKMP: Deleting peer node by peer_reap for 78.xx.xxx.48:
632737F8
*Nov 25 12:08:45.499: ISAKMP:(0:0:N/A:0):Input = IKE_MESG_INTERNAL, IKE_PHASE1_D
EL
*Nov 25 12:08:45.499: ISAKMP:(0:0:N/A:0):Old State = IKE_R_MM1  New State = IKE_
DEST_SA

*Nov 25 12:08:45.499: IPSEC(key_engine): got a queue event with 1 kei messages
*Nov 25 12:08:45.499: ISAKMP:(0:0:N/A:0):deleting SA reason "No reason" state (R
) MM_NO_STATE (peer 78.xx.xxx.48)
*Nov 25 12:08:45.499: ISAKMP:(0:0:N/A:0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_
ERROR
*Nov 25 12:08:45.499: ISAKMP:(0:0:N/A:0):Old State = IKE_DEST_SA  New State = IK
E_DEST_SA

Cisco Employee

Re: Cisco 1841 to Vigor VPN

Hello,

I have no idea about Vigor router (device) but it seems that the P1 proposals are not a match:

*Nov 25 12:08:45.495: ISAKMP: life type in seconds

*Nov 25 12:08:45.495: ISAKMP: life duration (basic) of 28800

*Nov 25 12:08:45.495: ISAKMP: encryption DES-CBC

*Nov 25 12:08:45.495: ISAKMP: hash MD5

*Nov 25 12:08:45.495: ISAKMP: auth pre-share

*Nov 25 12:08:45.495: ISAKMP: default group 1

Let us try to match it with what it is sending us

Create a new policy

Crypto isakmp policy 2

hash md5

authentication pre-share

group 1

encr des

Is there a way you post the phase1 and phase 2 parameters from the vigor

New Member

Re: Cisco 1841 to Vigor VPN

Right im not too sure if im any further down the line here....

*Nov 25 12:31:17.239: ISAKMP (0:134217729): received packet from 78.xx.xxx.48 dp
ort 500 sport 500 Global (R) QM_IDLE
*Nov 25 12:31:17.239: ISAKMP: set new node -857312455 to QM_IDLE
*Nov 25 12:31:17.239: ISAKMP:(0:1:SW:1): processing HASH payload. message ID = -
857312455
*Nov 25 12:31:17.239: ISAKMP:(0:1:SW:1): processing SA payload. message ID = -85
7312455
*Nov 25 12:31:17.239: ISAKMP:(0:1:SW:1):Checking IPSec proposal 0
*Nov 25 12:31:17.239: ISAKMP: transform 0, ESP_DES
*Nov 25 12:31:17.239: ISAKMP:   attributes in transform:
*Nov 25 12:31:17.239: ISAKMP:      encaps is 1 (Tunnel)
*Nov 25 12:31:17.239: ISAKMP:      SA life type in seconds
*Nov 25 12:31:17.239: ISAKMP:      SA life duration (basic) of 3600
*Nov 25 12:31:17.239: ISAKMP:      authenticator is HMAC-SHA
*Nov 25 12:31:17.239: ISAKMP:(0:1:SW:1):atts are acceptable.
*Nov 25 12:31:17.239: ISAKMP:(0:1:SW:1):Checking IPSec proposal 0
*Nov 25 12:31:17.239: ISAKMP: transform 1, ESP_DES
*Nov 25 12:31:17.239: ISAKMP:   attributes in transform:
*Nov 25 12:31:17.239: ISAKMP:      encaps is 1 (Tunnel)
*Nov 25 12:31:17.243: ISAKMP:      SA life type in seconds
*Nov 25 12:31:17.243: ISAKMP:      SA life duration (basic) of 3600
*Nov 25 12:31:17.243: ISAKMP:      authenticator is HMAC-MD5
*Nov 25 12:31:17.243: ISAKMP:(0:1:SW:1):atts are acceptable.
*Nov 25 12:31:17.243: IPSEC(validate_proposal_request): proposal part #1,
  (key eng. msg.) INBOUND local= 77.xxx.xxx.176, remote= 78.xx.xxx.48,
    local_proxy= 192.168.78.0/255.255.255.0/0/0 (type=4),
    remote_proxy= 192.168.6.0/255.255.255.0/0/0 (type=4),
    protocol= ESP, transform= esp-des esp-sha-hmac  (Tunnel),
    lifedur= 0s and 0kb,
    spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x2
*Nov 25 12:31:17.243: Crypto mapdb : proxy_match
        src addr     : 192.168.78.0
        dst addr     : 192.168.6.0
        protocol     : 0
        src port     : 0
        dst port     : 0
*Nov 25 12:31:17.243: IPSEC(validate_transform_proposal): transform proposal not
supported for identity:
    {esp-des esp-sha-hmac }
*Nov 25 12:31:17.243: ISAKMP:(0:1:SW:1): IPSec policy invalidated proposal
*Nov 25 12:31:17.243: IPSEC(validate_proposal_request): proposal part #1,
  (key eng. msg.) INBOUND local= 77.xxx.xxx.176, remote= 78.xx.xxx.48,
    local_proxy= 192.168.78.0/255.255.255.0/0/0 (type=4),
    remote_proxy= 192.168.6.0/255.255.255.0/0/0 (type=4),
    protocol= ESP, transform= esp-des esp-md5-hmac  (Tunnel),
    lifedur= 0s and 0kb,
    spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x2
*Nov 25 12:31:17.243: Crypto mapdb : proxy_match
        src addr     : 192.168.78.0
        dst addr     : 192.168.6.0
        protocol     : 0
        src port     : 0
        dst port     : 0
*Nov 25 12:31:17.243: IPSEC(validate_transform_proposal): invalid transform prop
osal flags -- 0x2
*Nov 25 12:31:17.243: ISAKMP:(0:1:SW:1): IPSec policy invalidated proposal
*Nov 25 12:31:17.243: ISAKMP:(0:1:SW:1): phase 2 SA policy not acceptable! (loca
l 77.107.173.176 remote 78.25.240.48)
*Nov 25 12:31:17.243: ISAKMP: set new node 427526447 to QM_IDLE
*Nov 25 12:31:17.243: ISAKMP:(0:1:SW:1):Sending NOTIFY PROPOSAL_NOT_CHOSEN proto
col 3
        spi 1664467464, message ID = 427526447
*Nov 25 12:31:17.243: ISAKMP:(0:1:SW:1): sending packet to 78.xx.xxx.48 my_port
500 peer_port 500 (R) QM_IDLE
*Nov 25 12:31:17.247: ISAKMP:(0:1:SW:1):purging node 427526447
*Nov 25 12:31:17.247: ISAKMP:(0:1:SW:1):deleting node -857312455 error TRUE reas
on "QM rejected"
*Nov 25 12:31:17.247: ISAKMP (0:134217729): Unknown Input IKE_MESG_FROM_PEER, IK
E_QM_EXCH:  for node -857312455: state = IKE_QM_READY
*Nov 25 12:31:17.247: ISAKMP:(0:1:SW:1):Node -857312455, Input = IKE_MESG_FROM_P
EER, IKE_QM_EXCH
*Nov 25 12:31:17.247: ISAKMP:(0:1:SW:1):Old State = IKE_QM_READY  New State = IK
E_QM_READY
*Nov 25 12:31:17.247: %CRYPTO-6-IKMP_MODE_FAILURE: Processing of Quick mode fail
ed with peer at 78.xx.xxx.48

Cisco Employee

Re: Cisco 1841 to Vigor VPN

Now you are failing on your Phase 2 proposals:

*Nov 25 12:31:17.243: IPSEC(validate_transform_proposal): transform

proposal not

supported for identity:

{esp-des esp-sha-hmac }

*Nov 25 12:31:17.243: ISAKMP:(0:1:SW:1): IPSec policy invalidated proposal

It seems the Vigor device does not have 3des as a proposal and is using

ESP-DES ESP-SHA-HMAC or ESP-SHA-MD5 as the hash.

You do not have ESP-DES configured as a one of the proposals (rightfully so).

crypto ipsec transform-set 3DES-SHA esp-3des esp-sha-hmac

crypto ipsec transform-set AES-SHA esp-aes esp-sha-hmac

crypto ipsec transform-set 3DES-SHA-compression esp-3des esp-sha-hmac comp-lzs

crypto ipsec transform-set AES-SHA-compression esp-aes esp-sha-hmac comp-lzs

However, just for the heck of it lets try configuring a ESP-DES proposal and see if we are successful.

Please try this:

1. Create a new transform set with esp-des and esp-sha-hmac

crypto ipsec trans this_should_work esp-des esp-sha-hmac

2. Remove the crypto map from the interface, otherwise we may block our access, (normally the crypto just say !incomplete, but be safe than sorry)

Interface dialer0

no crypto map VPN-Map-1

3. remove the 3des transform and attach des transform

crypto map VPN-Map-1 10 ipsec-isakmp

no set transform-set 3DES-SHA

set trans this_should_work

4. Attach the crypto map to the dialer0 interface again.

interface dialer0

crypto map VPN-Map-1

One more observation; sorry to have missed it before;

Your nat access-list is not bypassing the nat for the remote network 192.168.6.0 so

Ip access-li exten 100

5 deny ip 192.168.78.0 0.0.0.255 192.168.6.0 0.0.0.255

New Member

Re: Cisco 1841 to Vigor VPN

Done that but still got problem with phase 2....

################### CONFIG ####################

crypto isakmp policy 1
hash md5
authentication pre-share
group 2
lifetime 3600
!
crypto isakmp policy 5
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key burtonst1 address 78.xx.xxx.48
!
!
crypto ipsec transform-set 3DES-SHA esp-3des esp-sha-hmac
crypto ipsec transform-set AES-SHA esp-aes esp-sha-hmac
crypto ipsec transform-set 3DES-SHA-compression esp-3des esp-sha-hmac comp-lzs
crypto ipsec transform-set AES-SHA-compression esp-aes esp-sha-hmac comp-lzs
crypto ipsec transform-set cm-transformset-1 esp-des esp-sha-hmac
crypto ipsec transform-set this_should_work esp-des esp-sha-hmac
!
crypto map VPN-Map-1 10 ipsec-isakmp
set peer 78.xx.xxx.48
set transform-set this_should_work
set pfs group2
match address Crypto-list
!
!
!
interface FastEthernet0/0
description $ETH-LAN$
ip address 192.168.78.40 255.255.255.0
ip nat inside
ip virtual-reassembly
duplex auto
speed auto
!
interface FastEthernet0/1
no ip address
shutdown
duplex auto
speed auto
!
interface ATM0/0/0
no ip address
no ip mroute-cache
no atm ilmi-keepalive
bundle-enable
dsl operating-mode auto
pvc 0/38
  encapsulation aal5mux ppp dialer
  dialer pool-member 1
!
!
interface ATM0/1/0
no ip address
no ip mroute-cache
no atm ilmi-keepalive
bundle-enable
dsl operating-mode auto
pvc 0/38
  encapsulation aal5mux ppp dialer
  dialer pool-member 1
!
!
interface Dialer0
ip address negotiated
ip nat outside
ip virtual-reassembly
encapsulation ppp
dialer pool 1
dialer-group 1
ppp reliable-link
ppp authentication chap callin
ppp chap hostname xxxxxxxxxxxxxxxxxxxxxxxxx
ppp chap password 0 xxxxxxxx
ppp ipcp dns request
ppp link reorders
ppp multilink
ppp multilink slippage mru 16
ppp multilink fragment delay 10
ppp multilink interleave
ppp multilink multiclass
crypto map VPN-Map-1
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 Dialer0
!
ip http server
ip http secure-server
ip nat inside source list 100 interface Dialer0 overload
!
ip access-list extended Crypto-list
permit ip 192.168.78.0 0.0.0.255 192.168.6.0 0.0.0.255
ip access-list extended Internet-inbound-ACL
permit udp host 78.xx.xxx.48 any eq isakmp
permit esp host 78.xx.xxx.48 any
!
access-list 100 deny   ip 192.168.78.0 0.0.0.255 192.168.6.0 0.0.0.255
access-list 100 permit ip 192.168.78.0 0.0.0.255 any
dialer-list 1 protocol ip permit
snmp-server community public RO


################################################

*Nov 25 13:11:40.619: ISAKMP (0:134217729): received packet from 78.xx.xxx.48 dp
ort 500 sport 500 Global (R) QM_IDLE
*Nov 25 13:11:40.619: ISAKMP: set new node -1395233995 to QM_IDLE
*Nov 25 13:11:40.619: ISAKMP:(0:1:SW:1): processing HASH payload. message ID = -
1395233995
*Nov 25 13:11:40.619: ISAKMP:(0:1:SW:1): processing SA payload. message ID = -13
95233995
*Nov 25 13:11:40.619: ISAKMP:(0:1:SW:1):Checking IPSec proposal 0
*Nov 25 13:11:40.619: ISAKMP: transform 0, ESP_DES
*Nov 25 13:11:40.619: ISAKMP:   attributes in transform:
*Nov 25 13:11:40.619: ISAKMP:      encaps is 1 (Tunnel)
*Nov 25 13:11:40.619: ISAKMP:      SA life type in seconds
*Nov 25 13:11:40.619: ISAKMP:      SA life duration (basic) of 3600
*Nov 25 13:11:40.619: ISAKMP:      authenticator is HMAC-SHA
*Nov 25 13:11:40.619: ISAKMP:(0:1:SW:1):atts are acceptable.
*Nov 25 13:11:40.623: ISAKMP:(0:1:SW:1):Checking IPSec proposal 0
*Nov 25 13:11:40.623: ISAKMP: transform 1, ESP_DES
*Nov 25 13:11:40.623: ISAKMP:   attributes in transform:
*Nov 25 13:11:40.623: ISAKMP:      encaps is 1 (Tunnel)
*Nov 25 13:11:40.623: ISAKMP:      SA life type in seconds
*Nov 25 13:11:40.623: ISAKMP:      SA life duration (basic) of 3600
*Nov 25 13:11:40.623: ISAKMP:      authenticator is HMAC-MD5
*Nov 25 13:11:40.623: ISAKMP:(0:1:SW:1):atts are acceptable.
*Nov 25 13:11:40.623: IPSEC(validate_proposal_request): proposal part #1,
  (key eng. msg.) INBOUND local= 77.xxx.xxx.176, remote= 78.xx.xxx.48,
    local_proxy= 192.168.78.0/255.255.255.0/0/0 (type=4),
    remote_proxy= 192.168.6.0/255.255.255.0/0/0 (type=4),
    protocol= ESP, transform= esp-des esp-sha-hmac  (Tunnel),
    lifedur= 0s and 0kb,
    spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x2
*Nov 25 13:11:40.623: Crypto mapdb : proxy_match
        src addr     : 192.168.78.0
        dst addr     : 192.168.6.0
        protocol     : 0
        src port     : 0
        dst port     : 0
*Nov 25 13:11:40.623: IPSEC(validate_transform_proposal): invalid transform prop
osal flags -- 0x2
*Nov 25 13:11:40.623: ISAKMP:(0:1:SW:1): IPSec policy invalidated proposal
*Nov 25 13:11:40.623: IPSEC(validate_proposal_request): proposal part #1,
  (key eng. msg.) INBOUND local= 77.xxx.xxx.176, remote= 78.xx.xxx.48,
    local_proxy= 192.168.78.0/255.255.255.0/0/0 (type=4),
    remote_proxy= 192.168.6.0/255.255.255.0/0/0 (type=4),
    protocol= ESP, transform= esp-des esp-md5-hmac  (Tunnel),
    lifedur= 0s and 0kb,
    spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x2
*Nov 25 13:11:40.623: Crypto mapdb : proxy_match
        src addr     : 192.168.78.0
        dst addr     : 192.168.6.0
        protocol     : 0
        src port     : 0
        dst port     : 0
*Nov 25 13:11:40.623: IPSEC(validate_transform_proposal): transform proposal not
supported for identity:
    {esp-des esp-md5-hmac }
*Nov 25 13:11:40.623: ISAKMP:(0:1:SW:1): IPSec policy invalidated proposal
*Nov 25 13:11:40.623: ISAKMP:(0:1:SW:1): phase 2 SA policy not acceptable! (loca
l 77.107.173.176 remote 78.xx.xxx.48)
*Nov 25 13:11:40.623: ISAKMP: set new node -542923407 to QM_IDLE
*Nov 25 13:11:40.623: ISAKMP:(0:1:SW:1):Sending NOTIFY PROPOSAL_NOT_CHOSEN proto
col 3
        spi 1664467464, message ID = -542923407
*Nov 25 13:11:40.627: ISAKMP:(0:1:SW:1): sending packet to 78.xx.xxx.48 my_port
500 peer_port 500 (R) QM_IDLE
*Nov 25 13:11:40.627: ISAKMP:(0:1:SW:1):purging node -542923407
*Nov 25 13:11:40.627: ISAKMP:(0:1:SW:1):deleting node -1395233995 error TRUE rea
son "QM rejected"
*Nov 25 13:11:40.627: ISAKMP (0:134217729): Unknown Input IKE_MESG_FROM_PEER, IK
E_QM_EXCH:  for node -1395233995: state = IKE_QM_READY
*Nov 25 13:11:40.627: ISAKMP:(0:1:SW:1):Node -1395233995, Input = IKE_MESG_FROM_
PEER, IKE_QM_EXCH
*Nov 25 13:11:40.627: ISAKMP:(0:1:SW:1):Old State = IKE_QM_READY  New State = IK
E_QM_READY
*Nov 25 13:11:40.627: %CRYPTO-6-IKMP_MODE_FAILURE: Processing of Quick mode fail
ed with peer at 78.xx.xxx.48
*Nov 25 13:11:43.647: ISAKMP (0:134217729): received packet from 78.xx.xxx.48 dp
ort 500 sport 500 Global (R) QM_IDLE
*Nov 25 13:11:43.651: ISAKMP:(0:1:SW:1): phase 2 packet is a duplicate of a prev
ious packet.

New Member

Re: Cisco 1841 to Vigor VPN

I think it's validating phase 1 against transform set 3 and policy 5

Checking ISAKMP transform 3 against pri
ority 5 policy
*Nov 25 13:11:39.427: ISAKMP:      life type in seconds
*Nov 25 13:11:39.427: ISAKMP:      life duration (basic) of 28800
*Nov 25 13:11:39.427: ISAKMP:      encryption 3DES-CBC
*Nov 25 13:11:39.427: ISAKMP:      hash MD5
*Nov 25 13:11:39.427: ISAKMP:      auth pre-share
*Nov 25 13:11:39.427: ISAKMP:      default group 2
*Nov 25 13:11:39.427: ISAKMP:(0:0:N/A:0):atts are acceptable. Next payload is 0
*Nov 25 13:11:39.483: ISAKMP:(0:1:SW:1):Input = IKE_MESG_INTERNAL, IKE_PROCESS_M
AIN_MODE
*Nov 25 13:11:39.483: ISAKMP:(0:1:SW:1):Old State = IKE_R_MM1  New State = IKE_R
_MM1

Cisco Employee

Re: Cisco 1841 to Vigor VPN

Hello,

*Nov 25 13:11:40.623: ISAKMP:(0:1:SW:1): IPSec policy invalidated proposal

*Nov 25 13:11:40.623: IPSEC(validate_proposal_request): proposal part #1,

(key eng. msg.) INBOUND local= 77.xxx.xxx.176, remote= 78.xx.xxx.48,

local_proxy= 192.168.78.0/255.255.255.0/0/0 (type=4),

remote_proxy= 192.168.6.0/255.255.255.0/0/0 (type=4),

protocol= ESP, transform= esp-des esp-md5-hmac (Tunnel),

lifedur= 0s and 0kb,

spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x2

*Nov 25 13:11:40.623: Crypto mapdb : proxy_match

src addr : 192.168.78.0

dst addr : 192.168.6.0

protocol : 0

src port : 0

dst port : 0

*Nov 25 13:11:40.623: IPSEC(validate_transform_proposal): transform

proposal not

supported for identity:

{esp-des esp-md5-hmac }

*Nov 25 13:11:40.623: ISAKMP:(0:1:SW:1): IPSec policy invalidated proposal

*Nov 25 13:11:40.623: ISAKMP:(0:1:SW:1): phase 2 SA policy not acceptable!

(loca

l 77.107.173.176 remote 78.xx.xxx.48)

It is the Phase 2 which is being dropped.

Which side is trying to initiate the tunnel?

Can you please collect the debugs from the cisco router when you initiate the tunnel from behind the cisco router and also when you try to initiate the tunnel from behind vigor?

New Member

Re: Cisco 1841 to Vigor VPN

Got some progress now, i need a quick search on google about invalid transform proposal flags -- 0x2 and it said to remove PFS Group2.

Once this was removed it connected fine. However im still getting these errors?

The other remaining issue i have is we port forward 80 and 443 to a local mailserver, if i access the mailserver outside the LAN using the public ip it works perfect but if i try and access the mailserver inside the lan i get page cannot be displayed?

I would also like to say thank you, you have been a great help. I now understand these cisco routers far more than i did 2 days ago.

BURTON#show crypto isakmp sa
dst             src             state          conn-id slot status
77.xxx.xxx.176  78.xx.xxx.48    QM_IDLE              1    0 ACTIVE

BURTON#
*Nov 25 14:15:44.210: IPSEC(epa_des_crypt): decrypted packet failed SA identity
check
*Nov 25 14:16:21.342: IPSEC(epa_des_crypt): decrypted packet failed SA identity
check
*Nov 25 14:16:58.474: IPSEC(epa_des_crypt): decrypted packet failed SA identity
check

Cisco Employee

Re: Cisco 1841 to Vigor VPN

*Nov 25 14:15:44.210: IPSEC(epa_des_crypt): decrypted packet failed SA

identity

check

*Nov 25 14:16:21.342: IPSEC(epa_des_crypt): decrypted packet failed SA

identity

check

*Nov 25 14:16:58.474: IPSEC(epa_des_crypt): decrypted packet failed SA

identity

check

Looks like crypto ACL mis match. One side is using fine grained ACL if I am not mistaken.

Can you post the screen shot of Vigor? Or the ACL which you are using in it.

Or try initiating the tunnel from router.

New Member

Re: Cisco 1841 to Vigor VPN

The vigor is a very basic router which just has a GUI, i've telnet into it and under accesslist nothing is listed.

Connected to this vigor is another 7 vpn's though, which i cannot route to from the cisco. The vigor is basically the hub with the cisco being a spoke node, ultimately in the coming days i'm going to replace the vigor with the cisco.

The network id's of our LAN's

192.168.23.0

192.168.18.0

192.168.28.0

192.168.48.0

192.168.88.0

192.168.108.0

10.0.0.0

New Member

Re: Cisco 1841 to Vigor VPN

Results from sh crypto ipsec sa

It's not causing any problems that i can see anyway, I can ping 192.168.78.2 which is a pc on that subnet and also ping 192.168.6.30 the server on that subnet.

interface: Dialer0

    Crypto map tag: VPN-Map-1, local addr 77.xxx.xxx.176

   protected vrf: (none)

   local  ident (addr/mask/prot/port): (192.168.78.0/255.255.255.0/0/0)

   remote ident (addr/mask/prot/port): (192.168.6.0/255.255.255.0/0/0)

   current_peer 78.xx.xxx.48 port 500

     PERMIT, flags={origin_is_acl,}

    #pkts encaps: 4406, #pkts encrypt: 4406, #pkts digest: 4406

    #pkts decaps: 6206, #pkts decrypt: 6206, #pkts verify: 6206

    #pkts compressed: 0, #pkts decompressed: 0

    #pkts not compressed: 0, #pkts compr. failed: 0

    #pkts not decompressed: 0, #pkts decompress failed: 0

    #send errors 1, #recv errors 175

     local crypto endpt.: 77.xxx.xxx.176, remote crypto endpt.: 78.xx.xxx.48

     path mtu 1500, ip mtu 1500, ip mtu idb Dialer0

     current outbound spi: 0x60C18423(1623295011)

     inbound esp sas:

      spi: 0x6AE509AC(1793395116)

        transform: esp-des esp-sha-hmac ,

        in use settings ={Tunnel, }

        conn id: 3003, flow_id: FPGA:3, crypto map: VPN-Map-1

        sa timing: remaining key lifetime (k/sec): (4586467/2908)

        IV size: 8 bytes

        replay detection support: Y

        Status: ACTIVE

     inbound ah sas:

     inbound pcp sas:

     outbound esp sas:

      spi: 0x60C18423(1623295011)

        transform: esp-des esp-sha-hmac ,

        in use settings ={Tunnel, }

        conn id: 3004, flow_id: FPGA:4, crypto map: VPN-Map-1

        sa timing: remaining key lifetime (k/sec): (4586472/2907)

        IV size: 8 bytes

        replay detection support: Y

        Status: ACTIVE

     outbound ah sas:

     outbound pcp sas:

interface: Virtual-Access2

    Crypto map tag: VPN-Map-1, local addr 77.xxx.xxx.176

   protected vrf: (none)

   local  ident (addr/mask/prot/port): (192.168.78.0/255.255.255.0/0/0)

   remote ident (addr/mask/prot/port): (192.168.6.0/255.255.255.0/0/0)

   current_peer 78.xx.xxx.48 port 500

     PERMIT, flags={origin_is_acl,}

    #pkts encaps: 4406, #pkts encrypt: 4406, #pkts digest: 4406

    #pkts decaps: 6206, #pkts decrypt: 6206, #pkts verify: 6206

    #pkts compressed: 0, #pkts decompressed: 0

    #pkts not compressed: 0, #pkts compr. failed: 0

    #pkts not decompressed: 0, #pkts decompress failed: 0

    #send errors 1, #recv errors 175

     local crypto endpt.: 77.xxx.xxx.176, remote crypto endpt.: 78.xx.xxx.48

     path mtu 1500, ip mtu 1500, ip mtu idb Dialer0

     current outbound spi: 0x60C18423(1623295011)

     inbound esp sas:

      spi: 0x6AE509AC(1793395116)

        transform: esp-des esp-sha-hmac ,

        in use settings ={Tunnel, }

        conn id: 3003, flow_id: FPGA:3, crypto map: VPN-Map-1

        sa timing: remaining key lifetime (k/sec): (4586467/2907)

        IV size: 8 bytes

        replay detection support: Y

        Status: ACTIVE

     inbound ah sas:

     inbound pcp sas:

     outbound esp sas:

      spi: 0x60C18423(1623295011)

        transform: esp-des esp-sha-hmac ,

        in use settings ={Tunnel, }

        conn id: 3004, flow_id: FPGA:4, crypto map: VPN-Map-1

        sa timing: remaining key lifetime (k/sec): (4586472/2906)

        IV size: 8 bytes

        replay detection support: Y

        Status: ACTIVE

     outbound ah sas:

     outbound pcp sas:

Cisco Employee

Re: Cisco 1841 to Vigor VPN

The crypto is working fine it seems.

The error which you are receiving is I think because vigor side is able to encrypt an ip subnet (range) which is not defined by Cisco.

The vigor is sending it down to Cisco and after decrypting it the IPSEC SA is dropping it because it is not part of the interesting traffic.

But, I guess you are already up and running.

New Member

Re: Cisco 1841 to Vigor VPN

Hi Vikas,

When i reload the router the crypto map assigned to dialer0 is not retained? I checked the basics made sure the settings have been written to memory still does not retain the crypto map on the dialer.

Any ideas?

Thanks

Mark

Cisco Employee

Re: Cisco 1841 to Vigor VPN

Hello Mark,

This looks like a defect to me.

Post your show version please.

New Member

Re: Cisco 1841 to Vigor VPN

Cisco IOS Software, 1841 Software (C1841-ADVSECURITYK9-M), Version 12.4(25), REL
EASE SOFTWARE (fc2)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2009 by Cisco Systems, Inc.
Compiled Tue 21-Apr-09 10:00 by prod_rel_team

ROM: System Bootstrap, Version 12.3(8r)T9, RELEASE SOFTWARE (fc1)

BURTON uptime is 12 minutes
System returned to ROM by reload at 11:06:24 UTC Fri Nov 26 2010
System image file is "flash:c1841-advsecurityk9-mz.124-25.bin"

New Member

Re: Cisco 1841 to Vigor VPN

Hi Vikas,

I upgraded to 25(d) all working fine now, the IPSEC sa's were causing me a problem but that's also been sorted to a certain extent. I dont think the Vigor routers are fully compatible with the cisco.

https://supportforums.cisco.com/message/3237644

thanks gain for your help though.

Mark

New Member

Re: Cisco 1841 to Vigor VPN

Hi Vikas,

I was wondering if you can help me please.

I've just replaced one of the vigor routers with a cisco 1841 as a spoke to the main hub.

Im getting this though...

*Jan 18 14:58:46.147: %CRYPTO-6-IKMP_MODE_FAILURE: Processing of Quick mode fail
ed with peer at 78.xx.xxx.48

This is my spoke config..

#############################################################################

Current configuration : 6571 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname DALBY
!
boot-start-marker
boot-end-marker
!
enable secret 5 $1$iFwB$xxxxxxxxxxxxxxxx.
enable password xxxxxxxxxx

!
no aaa new-model
ip cef
!
!
ip auth-proxy max-nodata-conns 3
ip admission max-nodata-conns 3
!
!
ip name-server 62.121.0.2
ip name-server 195.54.225.10
!
!
crypto pki trustpoint TP-self-signed-692553461
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-692553461
revocation-check none
rsakeypair TP-self-signed-692553461
!
!
crypto pki certificate chain TP-self-signed-692553461
certificate self-signed 01
  3082023B 308201A4 A0030201 02020101 300D0609 2A864886 F70D0101 04050030
  30312E30 2C060355 04031325 494F532D 53656C66 2D536967 6E65642D 43657274
  69666963 6174652D 36393235 35333436 31301E17 0D313130 31313831 34313134
  305A170D 32303031 30313030 30303030 5A303031 2E302C06 03550403 1325494F
  532D5365 6C662D53 69676E65 642D4365 72746966 69636174 652D3639 32353533
  34363130 819F300D 06092A86 4886F70D 01010105 0003818D 00308189 02818100
  BA51CDF7 D418D270 7DCE516E 1ADE6DF5 82FE4507 CD1EBE0A 4B6E4B15 9A3C20ED
  B1D19FC9 63D0B925 0A4611FF CE8D935C 264FC3FE DF8BFAC2 76EC38ED 68115F43
  20A68D85 C04A564E 8BDE86FE 127F79B4 8E123D9C 8430940C BCD5CDA4 ADAAE387
  FA1E14A6 ECF92197 0CF54E89 B33915E7 A4E01EC7 CE45DDF6 AA60D168 38C92E67
  02030100 01A36530 63300F06 03551D13 0101FF04 05300301 01FF3010 0603551D
  11040930 07820544 414C4259 301F0603 551D2304 18301680 14645E3F DE4E90A8
  77358081 EE4217F4 82123899 3A301D06 03551D0E 04160414 645E3FDE 4E90A877
  358081EE 4217F482 1238993A 300D0609 2A864886 F70D0101 04050003 8181006C
  774C8BB8 2E5A70BA 4E38068F C4B8CC70 3318C04D 1EF45489 D3FD6E13 A49AB6B7
  8A40E698 09FA2417 A61C574A 8668E3F4 67532654 C33034DC 1B0B0962 EB5F05F6
  C83B7AA8 D132208C 1CFC10A4 94D5741C 83967D65 642886A9 2FC53C0F 4C21303E
  A90FDF8F 4742460B 4DFB3E2C ECE1E328 4642C1F3 2E687B94 A44082E7 2E56A6
  quit
!
!
!
!
crypto isakmp policy 1
hash md5
authentication pre-share
group 2
lifetime 3600
!
crypto isakmp policy 5
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key Dalby%19 address 78.xx.xxx.48
!
!
crypto ipsec transform-set 3DES-SHA esp-3des esp-sha-hmac
crypto ipsec transform-set AES-SHA esp-aes esp-sha-hmac
crypto ipsec transform-set 3DES-SHA-compression esp-3des esp-sha-hmac comp-lzs
crypto ipsec transform-set AES-SHA-compression esp-aes esp-sha-hmac comp-lzs
crypto ipsec transform-set cm-transformset-1 esp-des esp-sha-hmac
crypto ipsec transform-set this_should_work esp-des esp-sha-hmac
crypto ipsec transform-set cm-transformset-2 esp-des esp-md5-hmac
!
crypto map VPN-Map-1 11 ipsec-isakmp
set peer 78.xx.xxx.48
set transform-set this_should_work
set pfs group2
match address burton
!
!
!
interface FastEthernet0/0
description $ETH-LAN$
ip address 192.168.88.40 255.255.255.0
ip nat inside
ip virtual-reassembly
no ip route-cache cef
no ip route-cache
no ip mroute-cache
duplex auto
speed auto
!
interface FastEthernet0/1
no ip address
shutdown
duplex auto
speed auto
no cdp enable
!
interface ATM0/0/0
no ip address
no ip route-cache cef
no ip route-cache
no ip mroute-cache
atm restart timer 300
no atm ilmi-keepalive
bundle-enable
dsl operating-mode auto
pvc 0/38
  encapsulation aal5mux ppp dialer
  dialer pool-member 1
!
!
interface ATM0/1/0
no ip address
no ip route-cache cef
no ip route-cache
no ip mroute-cache
atm restart timer 300
no atm ilmi-keepalive
bundle-enable
dsl operating-mode auto
pvc 0/38
  encapsulation aal5mux ppp dialer
  dialer pool-member 1
!
!
interface Dialer0
ip address negotiated
ip nat outside
ip virtual-reassembly
encapsulation ppp
no ip route-cache cef
no ip route-cache
dialer pool 1
dialer-group 1
ppp reliable-link
ppp authentication chap callin
ppp chap hostname xxxxxxxxxxxxxxxxxxxxxx

ppp chap password 0 xxxxxxxxxx
ppp ipcp dns request
ppp link reorders
ppp multilink
ppp multilink slippage mru 16
ppp multilink fragment delay 10
ppp multilink interleave
ppp multilink multiclass
crypto map VPN-Map-1
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 Dialer0
!
ip http server
ip http secure-server
ip nat inside source list 100 interface Dialer0 overload
ip nat inside source static tcp 192.168.88.30 25 78.xx.xxx.245 25 extendable
ip nat inside source static tcp 192.168.88.30 80 78.xx.xxx.245 80 extendable
ip nat inside source static tcp 192.168.88.30 443 78.xx.xxx.245 443 extendable
ip nat inside source static tcp 192.168.88.45 443 78.xx.xxx.246 443 extendable
!
ip access-list extended Internet-inbound-ACL
permit udp host 78.xx.xx.48 any eq isakmp
permit esp host 78.xx.xx.48 any
permit udp host 78.xx.xx.188 any eq isakmp
permit esp host 78.xx.xx.188 any
ip access-list extended braintree
permit ip any 10.0.0.0 0.0.0.255
ip access-list extended burton
permit ip any 192.168.6.0 0.0.0.255
ip access-list extended burtonstores
permit ip any 192.168.78.0 0.0.0.255
ip access-list extended corby
permit ip any 192.168.18.0 0.0.0.255
ip access-list extended dalby
permit ip any 192.168.88.0 0.0.0.255
ip access-list extended glasgow
permit ip any 192.168.108.0 0.0.0.255
ip access-list extended hadleigh
permit ip any 192.168.48.0 0.0.0.255
ip access-list extended northwich
permit ip any 192.168.23.0 0.0.0.255
ip access-list extended wycombe
permit ip any 192.168.28.0 0.0.0.255
!
access-list 100 deny   ip 192.168.88.0 0.0.0.255 192.168.18.0 0.0.0.255
access-list 100 deny   ip 192.168.88.0 0.0.0.255 192.168.78.0 0.0.0.255
access-list 100 deny   ip 192.168.88.0 0.0.0.255 192.168.6.0 0.0.0.255
access-list 100 deny   ip 192.168.88.0 0.0.0.255 10.0.0.0 0.0.0.255
access-list 100 deny   ip 192.168.88.0 0.0.0.255 192.168.48.0 0.0.0.255
access-list 100 deny   ip 192.168.88.0 0.0.0.255 192.168.23.0 0.0.0.255
access-list 100 deny   ip 192.168.88.0 0.0.0.255 192.168.28.0 0.0.0.255
access-list 100 deny   ip 192.168.88.0 0.0.0.255 192.168.108.0 0.0.0.255
access-list 100 permit ip 192.168.88.0 0.0.0.255 any
dialer-list 1 protocol ip permit
snmp-server community public RO
!
!
control-plane
!
banner motd ^CCC
******************************************
* Welcome to xxxxxxxxxxxxxxxxx

* Dalby Router
* Unauthorized access prohibited
******************************************
^C
!
line con 0
exec-timeout 0 0
line aux 0
line vty 0 4
password xxxxxxxxxx%18
login
!
scheduler allocate 20000 1000
no process cpu extended
no process cpu autoprofile hog
end

My hub config.....

####################################################################

Current configuration : 8449 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname BURTON
!
boot-start-marker
boot-end-marker
!
enable secret 5 $xxxxxxxxxxxxxxxxxxxxxxxx.
enable password xxxxxxxxxx

!
no aaa new-model
ip cef
!
!
ip auth-proxy max-nodata-conns 3
ip admission max-nodata-conns 3
!
!
ip name-server 62.121.0.2
ip name-server 195.54.225.10
!
!
crypto pki trustpoint TP-self-signed-561592686
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-561592686
revocation-check none
rsakeypair TP-self-signed-561592686
!
!
crypto pki certificate chain TP-self-signed-561592686
certificate self-signed 01
  3082023C 308201A5 A0030201 02020101 300D0609 2A864886 F70D0101 04050030
  30312E30 2C060355 04031325 494F532D 53656C66 2D536967 6E65642D 43657274
  69666963 6174652D 35363135 39323638 36301E17 0D313130 31313831 33303433
  335A170D 32303031 30313030 30303030 5A303031 2E302C06 03550403 1325494F
  532D5365 6C662D53 69676E65 642D4365 72746966 69636174 652D3536 31353932
  36383630 819F300D 06092A86 4886F70D 01010105 0003818D 00308189 02818100
  E4DBC9F8 8DE09F73 32A36E04 09799F97 29720B78 4C02543D EA4EC2F1 71A3C126
  C93BE7BD 0D76F720 A0617593 6CABD849 771E52A7 27832E26 4D8B51E8 3F18CCE0
  B809D177 8820615D 7EDB42AE EB1AC1B6 D1333F93 AF284E97 2E254CE9 905C54EE
  B52F5E66 6D653B3C F490B042 AEBF2962 3BEF40EC FFB79ECC C21FC162 B85E83D9
  02030100 01A36630 64300F06 03551D13 0101FF04 05300301 01FF3011 0603551D
  11040A30 08820642 5552544F 4E301F06 03551D23 04183016 80148AC9 92D2CAA8
  C71BB6E5 D8AF5B07 B0E876B8 3837301D 0603551D 0E041604 148AC992 D2CAA8C7
  1BB6E5D8 AF5B07B0 E876B838 37300D06 092A8648 86F70D01 01040500 03818100
  0164D61E 00DA2699 FCEC5883 9673596F 6BAF1602 ED1CDDF9 EC94F994 01452D19
  FEFD02BB 592E1C44 7EE37A45 8861C6FC 0D6CE485 CDE5AFEE C4D9B629 1F6EFDB8
  F4C122B6 2DD9FABE 0BE55EBD 2F38F37A 5305F79C A798B50C 1FFD8355 80539A2E
  9C4277E8 7762A368 5CCE6916 8949A1A9 4588E7B9 822C3C5A D8F30C1F 2744EB55
  quit
!
!
!
!
crypto isakmp policy 1
hash md5
authentication pre-share
group 2
lifetime 3600
!
crypto isakmp policy 5
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key Braxxxe%20 address 85.xxx.xxx.9
crypto isakmp key Nordddd%24x address 85.xx.xxx.10
crypto isakmp key Burxxxst%18 address 78.xx.xxx.82
crypto isakmp key Corxxxx%21 address 78.xx.xxx.179
crypto isakmp key Glaxsxxx%22 address 78.xx.xxx.181
crypto isakmp key Haxxxxh%23 address 78.xx.xxx.180
crypto isakmp key Wyxxxe%25 address 78.xx.xxx.178
crypto isakmp key Daxxxx%19 address 78.xx.xxx.188
!
!
crypto ipsec transform-set 3DES-SHA esp-3des esp-sha-hmac
crypto ipsec transform-set AES-SHA esp-aes esp-sha-hmac
crypto ipsec transform-set 3DES-SHA-compression esp-3des esp-sha-hmac comp-lzs
crypto ipsec transform-set AES-SHA-compression esp-aes esp-sha-hmac comp-lzs
crypto ipsec transform-set cm-transformset-1 esp-des esp-sha-hmac
crypto ipsec transform-set this_should_work esp-des esp-sha-hmac
crypto ipsec transform-set cm-transformset-2 esp-des esp-md5-hmac
!
crypto map VPN-Map-1 10 ipsec-isakmp
set peer 78.xx.xxx.82
set transform-set cm-transformset-2
match address burtonstores
crypto map VPN-Map-1 11 ipsec-isakmp
set peer 78.xx.xxx.188
set transform-set this_should_work
set pfs group2
match address dalby
crypto map VPN-Map-1 12 ipsec-isakmp
set peer 85.xxx.xxx.9
set transform-set this_should_work
match address braintree
crypto map VPN-Map-1 13 ipsec-isakmp
set peer 78.xx.xxx.179
set transform-set this_should_work
match address corby
crypto map VPN-Map-1 14 ipsec-isakmp
set peer 78.xx.xxx.181
set transform-set cm-transformset-2
match address glasgow
crypto map VPN-Map-1 15 ipsec-isakmp
set peer 78.xx.xxx.180
set transform-set this_should_work
match address hadleigh
crypto map VPN-Map-1 16 ipsec-isakmp
set peer 85.xxx.xxx.10
set transform-set this_should_work
match address northwich
crypto map VPN-Map-1 17 ipsec-isakmp
set peer 78.xx.xxx.178
set transform-set this_should_work
match address wycombe
!
!
!
interface FastEthernet0/0
description $ETH-LAN$
ip address 192.168.6.40 255.255.255.0
ip nat inside
ip virtual-reassembly
no ip route-cache cef
no ip route-cache
no ip mroute-cache
duplex auto
speed auto
!
interface FastEthernet0/1
no ip address
shutdown
duplex auto
speed auto
no cdp enable
!
interface ATM0/0/0
no ip address
no ip route-cache cef
no ip route-cache
no ip mroute-cache
atm restart timer 300
no atm ilmi-keepalive
bundle-enable
dsl operating-mode auto
pvc 0/38
  encapsulation aal5mux ppp dialer
  dialer pool-member 1
!
!
interface ATM0/1/0
no ip address
no ip route-cache cef
no ip route-cache
no ip mroute-cache
atm restart timer 300
no atm ilmi-keepalive
bundle-enable
dsl operating-mode auto
pvc 0/38
  encapsulation aal5mux ppp dialer
  dialer pool-member 1
!
!
interface Dialer0
ip address negotiated
ip nat outside
ip virtual-reassembly
encapsulation ppp
no ip route-cache cef
no ip route-cache
dialer pool 1
dialer-group 1
ppp reliable-link
ppp authentication chap callin
ppp chap hostname xxxxxxxxxxxxxxxx

ppp chap password 0 xxxxxxxxxxxxxx
ppp ipcp dns request
ppp link reorders
ppp multilink
ppp multilink slippage mru 16
ppp multilink fragment delay 10
ppp multilink interleave
ppp multilink multiclass
crypto map VPN-Map-1
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 Dialer0
!
ip http server
ip http secure-server
ip nat inside source list 100 interface Dialer0 overload
ip nat inside source static tcp 192.168.6.45 1723 interface Dialer0 1723
ip nat inside source static tcp 192.168.6.65 25 78.xx.xxx.48 25 extendable
ip nat inside source static tcp 192.168.6.65 80 78.xx.xxx.48 80 extendable
ip nat inside source static tcp 192.168.6.65 443 78.xx.xxx.48 443 extendable
ip nat inside source static tcp 192.168.6.30 80 78.xx.xxx.62 80 extendable
ip nat inside source static tcp 192.168.6.30 443 78.xx.xxx.62 443 extendable
!
ip access-list extended Internet-inbound-ACL
permit udp host 85.xxx.xxx.85 any eq isakmp
permit esp host 85.xxx.xxx.85 any
permit udp host 85.xxx.xxx.9 any eq isakmp
permit esp host 85.xxx.xxx.9 any
permit udp host 85.xxx.xxx.10 any eq isakmp
permit esp host 85.xxx.xxx.10 any
permit udp host 78.xx.xxx.82 any eq isakmp
permit esp host 78.xx.xxx.82 any
permit udp host 78.xx.xxx.178 any eq isakmp
permit esp host 78.xx.xxx.178 any
permit udp host 78.xx.xxx.179 any eq isakmp
permit esp host 78.xx.xxx.179 any
permit udp host 78.xx.xxx.180 any eq isakmp
permit esp host 78.xx.xxx.180 any
permit udp host 78.xx.xxx.181 any eq isakmp
permit esp host 78.xx.xxx.181 any
permit udp host 78.xx.xxx.188 any eq isakmp
permit esp host 78.xx.xxx.188 any
ip access-list extended braintree
permit ip any 10.0.0.0 0.0.0.255
ip access-list extended burtonstores
permit ip any 192.168.78.0 0.0.0.255
ip access-list extended corby
permit ip any 192.168.18.0 0.0.0.255
ip access-list extended dalby
permit ip any 192.168.88.0 0.0.0.255
ip access-list extended glasgow
permit ip any 192.168.108.0 0.0.0.255
ip access-list extended hadleigh
permit ip any 192.168.48.0 0.0.0.255
ip access-list extended northwich
permit ip any 192.168.23.0 0.0.0.255
ip access-list extended wycombe
permit ip any 192.168.28.0 0.0.0.255
!
access-list 100 deny   ip 192.168.6.0 0.0.0.255 192.168.18.0 0.0.0.255
access-list 100 deny   ip 192.168.6.0 0.0.0.255 192.168.78.0 0.0.0.255
access-list 100 deny   ip 192.168.6.0 0.0.0.255 192.168.88.0 0.0.0.255
access-list 100 deny   ip 192.168.6.0 0.0.0.255 10.0.0.0 0.0.0.255
access-list 100 deny   ip 192.168.6.0 0.0.0.255 192.168.48.0 0.0.0.255
access-list 100 deny   ip 192.168.6.0 0.0.0.255 192.168.23.0 0.0.0.255
access-list 100 deny   ip 192.168.6.0 0.0.0.255 192.168.28.0 0.0.0.255
access-list 100 deny   ip 192.168.6.0 0.0.0.255 192.168.108.0 0.0.0.255
access-list 100 permit ip 192.168.6.0 0.0.0.255 any
dialer-list 1 protocol ip permit
snmp-server community public RO
snmp-server community private RW
!
!
control-plane
!
banner motd ^CC
******************************************
* Welcome to xxxxxxxxxxxx

* Burton Router
* Unauthorized access prohibited
******************************************
^C
!
line con 0
exec-timeout 0 0
line aux 0
line vty 0 4
password xxxxxxxxxxxxx%18
login
!
scheduler allocate 20000 1000
no process cpu extended
no process cpu autoprofile hog
end

###############################################

This is shown on the spoke

DALBY#show crypto isakmp sa
dst             src             state          conn-id slot status
78.xx.xxx.48    78.xx.xxx.188   QM_IDLE             69    0 ACTIVE
78.xx.xxx.48    78.xx.xxx.188   MM_NO_STATE         68    0 ACTIVE (deleted)

It looks like it's failing on phase 2 (this is on the spoke)

*Jan 18 15:27:38.431: map_db_find_best did not find matching map
*Jan 18 15:27:38.431: IPSEC(validate_transform_proposal): no IPSEC cryptomap exi
sts for local address 78.xx.xxx.188
*Jan 18 15:27:38.431: ISAKMP:(0:72:SW:1): IPSec policy invalidated proposal
*Jan 18 15:27:38.431: ISAKMP:(0:72:SW:1): phase 2 SA policy not acceptable! (loc
al 78.xx.xxx.188 remote 78.xx.xxx.48)

If you could help I would be extremely greatfull.

Thanks

A cisco ios novice!

1844
Views
0
Helpful
29
Replies
CreatePlease to create content