I have a Cisco 2600 (12.3) at one facility and I need to create an IPSec tunnel to the main facility via the Internet. The main facility has an OpenSWAN server for IPSec connectivity. Phase 1 completes but the only way I can get Phase2 to complete is with an ACL like "permit ip any any" attached to the crypto map. Clearly that breaks everything.
ip cef no ip domain lookup ip audit po max-events 100 crypto isakmp policy 1 encr 3des hash md5 authentication pre-share group 2 lifetime 28800 ! crypto isakmp key *********** address {REMOTEPUBLICIP} crypto isakmp keepalive 10 crypto isakmp peer address {REMOTEIP} crypto ipsec transform-set vpn esp-3des esp-md5-hmac crypto ipsec profile VPN set transform-set vpn ! crypto map VPN 1 ipsec-isakmp description USD-TO-GRD set peer {REMOTEPUBLICIP} set transform-set vpn set pfs group2 match address 102 ! interface Ethernet0/0 ip address {LOCALPUBLICIP} 255.255.255.224 full-duplex crypto map VPN ! interface Ethernet0/1 ip address 192.168.24.19 255.255.255.0 full-duplex ! no ip http server no ip http secure-server ip classless ip route 0.0.0.0 0.0.0.0 {PUBLICGATEWAY) access-list 102 permit ip any any
Otherwise Phase 2 fails with: ...
00:49:34: ISAKMP: transform 0, ESP_3DES
00:49:34: ISAKMP: attributes in transform:
00:49:34: ISAKMP: encaps is 1 (Tunnel)
00:49:34: ISAKMP: SA life type in seconds
00:49:34: ISAKMP: SA life duration (basic) of 28800
00:49:34: ISAKMP: authenticator is HMAC-MD5
00:49:34: ISAKMP (0:6): atts are acceptable.
00:49:34: ISAKMP (0:6): IPSec policy invalidated proposal
00:49:34: ISAKMP (0:6): phase 2 SA policy not acceptable! (local
216.120.174.238 remote 216.120.174.237)
00:49:34: ISAKMP: set new node -1915994121 to QM_IDLE
00:49:34: ISAKMP (0:6): Sending NOTIFY PROPOSAL_NOT_CHOSEN protocol 3 spi 2197085600, message ID = -1915994121 ...
Once the tunnel comes up with the any/any ACL rule "show crypto ipsec sa" looks like:
interface: Ethernet0/0 Crypto map tag: VPN, local addr. X.X.X.X protected vrf: local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0) remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0) current_peer: 216.120.174.237:500 PERMIT, flags={origin_is_acl,ipsec_sa_request_sent} #pkts encaps: 0, #pkts encrypt: 0, #pkts digest 0 #pkts decaps: 0, #pkts decrypt: 0, #pkts verify 0 #pkts compressed: 0, #pkts decompressed: 0 #pkts not compressed: 0, #pkts compr. failed: 0 #pkts not decompressed: 0, #pkts decompress failed: 0 #send errors 195, #recv errors 0 local crypto endpt.: X.X.X.X remote crypto endpt.: Y.Y.Y.Y path mtu 1500, ip mtu 1500, ip mtu idb Ethernet0/0 current outbound spi: 0 inbound esp sas: inbound ah sas: inbound pcp sas: outbound esp sas: outbound ah sas: outbound pcp sas: protected vrf: local ident (addr/mask/prot/port): (192.0.0.0/192.0.0.0/0/0)