Hi,
I have a cisco 1750 router with 2 VPN profiles/dynamic map for mobile users with cisco vpn client software.
Now i want to give these mobile users acess to 2 servers behind a cisco 3000 VPN concentrator. I dont have the access to 3000 VPN concentrator and have configured the 1750 to match with it (key and encryption types).
I am facing problems When i try to access these servers behind VPN concentrator by first connectiong to 1750 with cisco vpn client software.
When i do a "sh crypto isakmp sa" i get MMO_NO_STATE for the site to site VPN.
My configuration is as follows
crypto isakmp policy 10
encr 3des
hash md5
authentication pre-share
group 2
!
crypto isakmp policy 20
encr 3des
authentication pre-share
crypto isakmp key xxx address x.x.x.x
crypto isakmp keepalive 10 4
!
crypto isakmp client configuration group VPN001
key xxxx
domain xyz.com
pool dynpool
acl 150
!
crypto isakmp client configuration group VPN002
key xxxx
domain xyz.com
pool dynpool2
acl 151
crypto isakmp profile VPN002
description VPN002 Client VPN profile
match identity group VPN002
isakmp authorization list client-vpn
client configuration address initiate
client configuration address respond
crypto isakmp profile vpn001
description Innitial VPN access Profile
match identity group VPN001
isakmp authorization list client-vpn
client configuration address initiate
client configuration address respond
crypto isakmp profile sitetosite
description Site to Site VPN
match identity address 200.200.200.200 255.255.255.255
!
!
crypto ipsec transform-set ts001 esp-3des esp-md5-hmac
crypto ipsec transform-set ts002 esp-3des esp-sha-hmac
crypto ipsec nat-transparency spi-matching
!
crypto dynamic-map dynmap 1
set transform-set ts001
set isakmp-profile vpn001
crypto dynamic-map dynmap 2
set transform-set ts001
!
!
crypto map TestVPN 1 ipsec-isakmp dynamic dynmap
crypto map TestVPN 2 ipsec-isakmp
set peer 200.200.200.200
set transform-set ts002
match address sitetositeACL
!
!
!
interface Ethernet0
ip address 100.100.100.1 255.255.255.248
ip access-group 111 in
ip nat outside
ip inspect E0 in
full-duplex
crypto map TestVPN
!
interface FastEthernet0
ip address 192.168.100.254 255.255.255.0
ip access-group 110 in
ip nat inside
ip inspect Fa0 in
ip route-cache flow
speed auto
!
I appriciate your expert help on this.I have also attached the config file with this.
Thanks
Wasantha
