I need to connect two 2801 over fast ethernet with ipsec encryption. I also need ospf so I configuring gre over ipsec:
crypto isakmp policy 15 encr 3des hash md5 authentication pre-share group 2 lifetime 3600 crypto isakmp key hryakwesdxc address 192.168.200.241 ! ! crypto ipsec transform-set hryak ah-sha-hmac esp-aes 256 mode transport ! crypto map hryak local-address FastEthernet0/1 crypto map hryak 10 ipsec-isakmp set peer 192.168.200.241 set transform-set hryak set pfs group2 match address 187 qos pre-classify
interface Tunnel0 description Hohryak-P100-GRE bandwidth 10240 ip address 192.168.200.226 255.255.255.252 ip mtu 1440 ip route-cache policy no ip route-cache cef ip route-cache flow no ip mroute-cache qos pre-classify tunnel source FastEthernet0/1 tunnel destination 192.168.200.241 tunnel flow egress-records
This configuration doesn't work- ping work, but only small ping, packets larger than 100 can't reach another router over ipsec.
If I add compression to transform set crypto ipsec transform-set hryak ah-sha-hmac esp-aes 256 comp-lzs
than all is OK except of performance- I get just about 10Mbit throughput and 100% cpu load- with IP Input.
I guess that compression is done on CPU. I don't need compression anyway :-)
btw, all is OK with physical channel- if I remove crypto I get about50Mbit throughput.
Could you tell me what is wrong? How can I get ipsec working without compression? May be this is IOS problem (I use 12.4.17a )?