Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Community Member

VPN Phase 1 briefly comes up, then drops

Hello

 

I wonder if it is the Crypto transform-set

 

Peer is using: ESP_AES_256_SHA

 

I am using.

crypto map VPN 780 set transform-set AES_256_SHA

crypto map VPN 790 set peer 74.x.x.x

crypto map VPN 790 set transform-set AES_256_SHA

 

Could this difference be causing problems with phase 1

 

I tried to change my end, but received “ERROR: transform set with tag "ESP_AES_256_SHA" does not exist.”

 

Please review and advise.

 

 

 

sMc
2 ACCEPTED SOLUTIONS

Accepted Solutions
Super Bronze

Hi, The bolded section of the

Hi,

 

The bolded section of the command that you have listed above is only the name of the "transform-set" its not the actual setting/parameter.

 

You can use the command "show run crypto ipsec" to list the Transform Set configurations

 

You can use the command "show run crypto map" to list all the Crypto Map configurations

 

I would presume that your Transform sets are identical but you can use the first command above to check if it is.

 

I think the Phase1 briefly comes up because the Phase2 doesnt go through. So I would look for missmatched configurations between your device and the remote device.

 

The above listed configuration is not the complete Crypto Map configuration for a single L2L VPN Connection. At minimum you will have to have a line with "peer", and line with the "match address" (ACL defining the protected networks) and a "transform-set" line.

 

The second command I listed above would show your whole Crypto Map configuration.

 

- Jouni

Super Bronze

Hi, Were you able to check

Hi,

 

Were you able to check the settings and get the connection working?

 

- Jouni

5 REPLIES
Super Bronze

Hi, The bolded section of the

Hi,

 

The bolded section of the command that you have listed above is only the name of the "transform-set" its not the actual setting/parameter.

 

You can use the command "show run crypto ipsec" to list the Transform Set configurations

 

You can use the command "show run crypto map" to list all the Crypto Map configurations

 

I would presume that your Transform sets are identical but you can use the first command above to check if it is.

 

I think the Phase1 briefly comes up because the Phase2 doesnt go through. So I would look for missmatched configurations between your device and the remote device.

 

The above listed configuration is not the complete Crypto Map configuration for a single L2L VPN Connection. At minimum you will have to have a line with "peer", and line with the "match address" (ACL defining the protected networks) and a "transform-set" line.

 

The second command I listed above would show your whole Crypto Map configuration.

 

- Jouni

Community Member

Jouni Thank you for the reply

Jouni

 

Thank you for the reply.

sMc
Super Bronze

Hi, Were you able to check

Hi,

 

Were you able to check the settings and get the connection working?

 

- Jouni

Community Member

Jouni Please review and

Jouni

 

Please review and advise.

 

MyASA# show run crypto ipsec
crypto ipsec transform-set AES_256_SHA esp-aes-256 esp-sha-hmac
crypto ipsec transform-set 3DES_SHA esp-3des esp-sha-hmac
crypto ipsec transform-set AES_SHA esp-aes esp-sha-hmac
crypto ipsec transform-set 3DES_MD5 esp-3des esp-md5-hmac
crypto ipsec df-bit clear-df outside

 

MyASA# sh run crypto map | in 790
crypto map VPN 790 match address (PeerNm)
crypto map VPN 790 set peer 74.x.x.x
crypto map VPN 790 set transform-set AES_256_SHA
 

 

PeerASA#show run crypto ipsec

crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac

crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac

crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac

crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

crypto ipsec transform-set trans esp-3des esp-sha-hmac

crypto ipsec transform-set trans mode transport

crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac

crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac

crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac

crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

crypto ipsec security-association lifetime seconds 28800

crypto ipsec security-association lifetime kilobytes 4608000

 

 

PeerASA# sh run crypto map | in 595

crypto map outside_map 595 match address outside_595_cryptomap

crypto map outside_map 595 set peer 170.x.x.x

crypto map outside_map 595 set transform-set ESP-AES-256-SHA

crypto map outside_map 595 set security-association lifetime seconds 28800

crypto map outside_map 595 set security-association lifetime kilobytes 4608000

sMc
Community Member

Jouni No still having trouble

Jouni

 

No still having trouble.
 

sMc
289
Views
0
Helpful
5
Replies
CreatePlease to create content