Two 2811 routers get the certificates from CA server(Windows2003 Enterprise Server,192.168.22.167).But when they try to setup ipsec vpn tunnnel,they can not authenticate with each other by digital certificate successfully.Attachment is configuration of routers and debug information.
According to the debugs, "phase 1 packet is a duplicate of a previous packet" means that Caclient1 router is sending the same Phase 1 packet eventhough Caclient2 router processed the first packet and sent a response.
1. Caclient1 router sends IKE packet #1 to initiate a tunnel
2. Caclient2 router receives it, processes it, and sends a reply which is IKE packet #2
3. Caclient1 router never receives packet #2 and can't proceed with sending #3, so it resends
4. Caclient2 router sees this as a duplicate first packet and resends packet #2
Caclient2 router is sending a UDP 500 packet to Caclient1 but this packet is not getting to Caclient1.
Based upon your IP Addressing, Caclient1 and Caclient2 are on the same network, so there is no question for L3 Firewalling and UDP 500 getting blocked. Are there any L2 Firewalls and are they filtering UDP500.
Also, could you make sure there are no duplicate IP Addresses in your network.
Also, remove the crypto map on both the routers, clear the routes, arp entries and then try to bring up the tunnel again and see what happens.
I am sure that no L3 or L2 Firewall and filter existed because of directly connection of two routers with a switch.I redo the entire process several times.But the same issue also occured.I can get identical debug information from two routers.It almost made me crazy.
I can see only below information about error:
vendor ID seems Unity/DPD but major 245 mismatch
But I can not know whether it is a critical issue and what reason make it report that.Is there any necessary factor I should know ?
We have configured the outside and inside Interface with official ipv6 adresses, set a default route on outside Interface to our router, we also have definied a rule , which also gets hits, to permit tcp from inside Interface to any6.
In Syslog I also se...