Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Community Member

Multiple ISAKMP SA to same peer checkpoint to cisco router

Hello

Has anyone come across this one before, I have moved a VPN IPSEC peering from a cisco ASA to a checkpoint appliance and getting some strange Phase 1, seems to be forming alot of iskamp sa more than I would expect, router is a Cisco 881 runing: c880data-universalk9-mz.151-4.M4.bin

<cisco router>#sh crypto isakmp sa

IPv4 Crypto ISAKMP SA

dst                            src                            state                         conn-id status

Cisco local router   cisco ASA                     MM_NO_STATE          0 ACTIVE (deleted)

Cisco local router   cisco ASA                     MM_NO_STATE          0 ACTIVE (deleted)

Cisco local router   Checkoint appliance      QM_IDLE                     2014 ACTIVE

Cisco local router   Checkoint appliance       QM_IDLE                     2013 ACTIVE

Cisco local router   Checkoint appliance       QM_IDLE                     2012 ACTIVE

Cisco local router   Checkoint appliance       QM_IDLE                     2011 ACTIVE

Cisco local router   Checkoint appliance       QM_IDLE                     2010 ACTIVE

I have removed the ip address but it seems to be creating more ISKAMP SA, my config are basic see below

crypto isakmp policy 10

encr 3des

hash md5

authentication pre-share

group 2

crypto isakmp key < preshare key > address < checkpoint ip >

crypto isakmp invalid-spi-recovery

!

!

crypto ipsec transform-set NR-secure esp-3des esp-md5-hmac

mode transport

!

crypto map nrremote 10 ipsec-isakmp

set peer < checkpoint ip >

set transform-set <name>

match address acl_vpn

295
Views
0
Helpful
0
Replies
CreatePlease to create content