877 VPN problem to 837

Hi Igor,

You may wish to investigate Cisco 800 Router Documentation:

Brad Reese BradReese.Com - Cisco Repair

On both routers use:

debug crypto isakmp debug crypto ipsec

then

clear crypto sa

to make sure all VPN stuff is cleared and do a ping or whatever is appropriate to bring up the VPN. The routers will spit out several thousand lines of debug to the console and a close inspection of this should show where the problem lies.

JR

I agree.

As a confidence booster, I use 837 and 877 and have no issue with crypto.

The config that you have posted looks OK. I use different parameters,

crypto isakmp policy 1 encr 3des hash md5 authentication pre-share group 2

crypto isakmp key xxx address 8..... crypto isakmp key xxx address 8..... ! ! crypto ipsec transform-set Home esp-3des esp-md5-hmac

! crypto map Home 2 ipsec-isakmp set peer 8....... set transform-set Home match address 110

This works.

I do notice that you have pretty old 877 software. Much as I hate the idea of "blind" upgrades I do get the idea there there have been some issues with

12.4(9)T1 is the latest.

You might add to the debugs debug crypto isakmp error debug crypto ipsec error

If you can possibly compare a working crypto set with a broken one then yuo might get an idea of what is wrong.

sh cry ip sa

WHAT YOU ARE ENCRYPTING local ident (addr/mask/prot/port): (8...9/255.255.255.255/47/0) remote ident (addr/mask/prot/port): (8...4/255.255.255.255/47/0)

When the tunnel is UP you get something like this FOR EACH DIRECTION inbound esp sas: spi: 0x9163F57(152452951) transform: esp-3des esp-md5-hmac , in use settings ={Tunnel, } conn id: 2006, flow_id: C83X_MBRD:6, crypto map: Home sa timing: remaining key lifetime (k/sec): (4424389/509) IV size: 8 bytes replay detection support: Y Status: ACTIVE

Also chek that you NAT is OK (your config looks OK) sh ip nat tr

I enabled debug

But strange thing is on either routers it does not show any debugging for IPSEC

You do need to know how to drive debug, it is not entirely obvious, until you know:-)

Debug output goes to the logging "system" lets call it.

The logging system then sends it to whatever places are configured and you then can view it there.

To see logging on a telnet session (strictly, any vty session) you have to have:-

conf t logg monitor debug ! this is the ("not configured" default) end

Then you need to enter the

terminal monitor

command on the sesion that you want to have the logging output sent to.

Alternatively:

conf t logg buffered 60000 debug end

and then sh log

Or both.

Read the cisco debugging advice regarding CPU. It is possible to stop a router from functioning such that it requires a power cycle if you turn on debugging.

I know 'cos I have done it.

BTW term no mon turns it off and not as might be expected no term mon