crypto map problem on 1700

Sep 06, 2005 1 Replies

Hello I have several crypto maps connecting a pix a 6 1700 routers. One of my 1700 routers shows this error and the tunnels get disconnect and reconnected, can anyone see the problem here? thanks


02:17:40: ISAKMP (0:3): received packet from x.x.x.x(R) QM_IDLE
02:17:40: ISAKMP (0:3): processing HASH payload. message ID = 82696062
02:17:40: ISAKMP (0:3): processing SA payload. message ID = 82696062
02:17:40: ISAKMP (0:3): Checking IPSec proposal 1
02:17:40: ISAKMP: transform 1, ESP_3DES
02:17:40: ISAKMP: attributes in transform:
02:17:40: ISAKMP: encaps is 1
02:17:40: ISAKMP: SA life type in seconds
02:17:40: ISAKMP: SA life duration (basic) of 3600
02:17:40: ISAKMP: SA life type in kilobytes
02:17:40: ISAKMP: SA life duration (VPI) of 0x0 0x46 0x50 0x0
02:17:40: ISAKMP: authenticator is HMAC-MD5
02:17:40: ISAKMP (0:3): atts are acceptable.
02:17:40: ISAKMP (0:3): IPSec policy invalidated proposal
02:17:40: ISAKMP (0:3): phase 2 SA not acceptable!
02:17:40: ISAKMP (0:3): sending packet to x.x.x.x (R) QM_IDLE
02:17:40: ISAKMP (0:3): purging node 1829095077
02:17:40: ISAKMP (0:3): Unknown Input for node 82696062: state = IKE_QM_READY, major = 0x00000001, minor = 0x0000000C

In article , wrote: :Hello I have several crypto maps connecting a pix a 6 1700 routers. One :of my 1700 routers shows this error and the tunnels get disconnect and :reconnected, can anyone see the problem here?

:02:17:40: ISAKMP: transform 1, ESP_3DES :02:17:40: ISAKMP: authenticator is HMAC-MD5

The PIX no longer supports 3DES MD5, if I recall correctly. Try switching to 3DES SHA.

If 3DES MD5 is working for you on some PIX but not the one in question, check to see if the one it is failing on is a newer software release.

Join the Discussion

Have something to add? Share your thoughts — no account required.

Didn't find your answer?

Ask the community — no account required