Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Attention: The Community will be in read-only mode on 12/14/2017 from 12:00 am pacific to 11:30 am.

During this time you will only be able to see content. Other interactions such as posting, replying to questions, or marking content as helpful will be disabled for few hours.

We apologize for the inconvenience while we perform important updates to the Community.

New Member

My IPSEC tunnel failed to go up


I have 2 routers, R1 (had end) and R2 (remote) connected via the public cloud.

The config is as soecified in the document attached.

The link latency is about 1500ms. HOwever, I have the following issue.

My issue is R1 and R2 failed to ping each.

When R2 senr traffic via tunnel can be seen by my firewall at the headend site. However, the return traffic back to R2 also been seen by my firewall.

I enable the ip accouting on the tunnel interface on R1 router, it shown that the traffic is being put into the tunnel.

HOwever, I also enable ip accounting on the R2 router, but, I did not see any output traffic.

It seems to me that the traffic sent to the tunnel went missing in the cloud.

From, the firewall, I noticead that the return traffic sent by the R1 router is GRE traffic instead of ESP...

Can I know why? I can't ping the tunnel ip and also the ipsec peer IP.

Can I know why?

Hall of Fame Super Silver

Re: My IPSEC tunnel failed to go up

It would seem that the first and most important problem is whether you can ping the peer address. You need to fix that first. After that there are some configuration issues to address. I have looked and note these issues which should be fixed:

- both routers use exactly the same address in the crypto isakmp key statement

crypto isakmp key QuU2d

they can not both point to (Which seems to be the outbound interface on R2)

- in their crypto map they both set exactly the same address as the address of the peer

set peer

that can not be correct.

- on R1 the tunnel source is loopback0 but you do not show the configuration of that interface. The crypto access list on R1 shows two source addresses or one of them is not valid but we can not tell which. The crypto access list on R2 implies that the valid address is probably

- But R1 tunnel configuration specifies the tunnel destination as as the tunnel destination.

- the crypto access list on R1 has multiple statements while the crypto access list on R2 has only a single line. The crypto access lists should be inverse mirrors of each other and mismatches in access list construction will frequently produce errors in the operation of the VPN.

- both routers put the crypto map on both the tunnel interface and on a physical interface. Unless you are running pretty old code the crypto map should be on only the outbound physical interface.

Correct these issues and the VPN may work. If it does not work then post updated/corrected configs and we will look for additional issues.



CreatePlease to create content