Hi Anshul,
I must admit - this is certainly one question that could be worded
better in our WB.
We want you to setup DMVPN between R9 and R4 - and from your "show
crypto ipsec sa" below it looks like you have that working correctly
based on this:
#pkts encaps: 2799, #pkts encrypt: 2799, #pkts digest: 2799
#pkts decaps: 2803, #pkts decrypt: 2803, #pkts verify: 2803
So the next part is having the R9 setup as the EasyVPN server - and
connecting to R9 with the XP Workstation and the Software IPSec client.
Have you tried connecting with the client? Does it connect and XAuth?
What IP Address does the client show that you relieved from the R9
Easy VPN Server?
It doesn't look like it is connected based on the below output only
showing an Phase 2 SA on the Tunnel interface. If the Client were
connected - you should also show a Phase 2 SA on the Ethernet interface.
R9#show crypto ipsec sa
interface: Tunnel0
Crypto map tag:
Try connecting the client and get back to us with that info.
Cheers,
Mark Snow
CCIE #14073 (Voice, Security)
CCSI #31583
Senior Technical Instructor - IPexpert, Inc.
A Cisco Learning Partner - We Accept Learning Credits!
Telephone: +1.810.326.1444
Fax: +1.309.413.4097
Mailto: [EMAIL PROTECTED]
IPexpert - The Global Leader in Self-Study, Classroom-Based, Video On
Demand and Audio Certification Training Tools for the Cisco CCIE R&S
Lab, CCIE Security Lab, CCIE Service Provider Lab , CCIE Voice Lab and
CCIE Storage Lab Certifications.
On Dec 2, 2007, at 10:11 PM, Anshul Arora (akarora) wrote:
Hi All,
I've got DMVPN to work as desired between R9 as hub and R4 as spoke
router. But Easy VPN on R9 is not going through. I'm not able to
123.0.0.11 as instructed in the proctor guide for its verification.
What configuration is missing? Appreciate any help.
Thanks,
-Anshul
R9#sh run
Building configuration...
Current configuration : 3074 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R9
!
boot-start-marker
boot-end-marker
!
logging buffered 51200 warnings
!
aaa new-model
!
!
aaa authentication login remoteusers local
aaa authorization network remotegroup local
!
aaa session-id common
!
resource policy
!
!
!
ip cef
!
!
no ip domain lookup
!
!
!
username cisco privilege 15 secret 5 $1$imf1$pd8nsPdPLllXJPCGS6vd0.
username ccie password 0 ccis
!
!
!
crypto isakmp policy 10
hash md5
authentication pre-share
!
crypto isakmp policy 20
hash md5
authentication pre-share
group 2
crypto isakmp key ccie address 0.0.0.0 0.0.0.0
!
crypto isakmp client configuration group myvpngroup
key ipexpert
dns 123.1.1.1
wins 123.1.1.2
domain cisco.com
pool dynpool
crypto isakmp profile VPNclient
match identity group myvpngroup
client authentication list remoteusers
isakmp authorization list remotegroup
client configuration address respond
!
!
crypto ipsec transform-set strong esp-3des esp-md5-hmac
!
crypto ipsec profile cisco
set transform-set strong
!
!
crypto dynamic-map dynmap 10
set transform-set strong
set isakmp-profile VPNclient
reverse-route
!
!
crypto map MYMAP 10 ipsec-isakmp dynamic dynmap
!
!
!
!
interface Tunnel0
ip address 49.0.0.9 255.255.255.0
no ip redirects
ip mtu 1400
ip nhrp authentication ccie
ip nhrp map multicast dynamic
ip nhrp network-id 1
ip nhrp holdtime 300
tunnel source FastEthernet0
tunnel mode gre multipoint
tunnel key 1
tunnel protection ipsec profile cisco
!
interface Loopback0
ip address 9.9.9.9 255.0.0.0
!
interface Loopback99
ip address 199.99.99.99 255.255.255.0
!
interface Loopback49
ip address 49.9.9.9 255.255.255.0
!
interface FastEthernet0
ip address 192.1.49.9 255.255.255.0
duplex auto
speed auto
crypto map MYMAP
!
interface FastEthernet1
no ip address
shutdown
duplex auto
speed auto
!
interface BRI0
no ip address
encapsulation hdlc
shutdown
!
interface FastEthernet2
!
interface FastEthernet3
!
interface FastEthernet4
!
interface FastEthernet5
!
interface FastEthernet6
!
interface FastEthernet7
!
interface FastEthernet8
!
interface FastEthernet9
!
router eigrp 49
redistribute static metric 1 1 1 1 1
network 49.0.0.0 0.0.0.255
network 49.9.9.0 0.0.0.255
no auto-summary
!
router ospf 1
router-id 9.9.9.9
log-adjacency-changes
network 9.9.9.9 0.0.0.0 area 10
network 192.1.49.0 0.0.0.255 area 10
!
router bgp 65500
no synchronization
bgp router-id 9.9.9.9
bgp log-neighbor-changes
network 199.99.99.0
neighbor 192.1.49.4 remote-as 245
no auto-summary
!
ip local pool dynpool 123.0.0.10 123.0.0.20
!
!
no ip http server
no ip http secure-server
!
no cdp run
!
!
!
!
!
!
control-plane
!
!
line con 0
exec-timeout 0 0
logging synchronous
line aux 0
line vty 0 4
access-class 23 in
privilege level 15
transport input telnet ssh
line vty 5 15
access-class 23 in
privilege level 15
transport input telnet ssh
!
!
webvpn context Default_context
ssl authenticate verify all
!
no inservice
!
end
R9#ping 123.0.0.11
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 123.0.0.11, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
R9#show cry
R9#show crypto ips
R9#show crypto ipsec sa
interface: Tunnel0
Crypto map tag: Tunnel0-head-0, local addr 192.1.49.9
protected vrf: (none)
local ident (addr/mask/prot/port):
(192.1.49.9/255.255.255.255/47/0)
remote ident (addr/mask/prot/port):
(192.1.49.4/255.255.255.255/47/0)
current_peer 192.1.49.4 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 2799, #pkts encrypt: 2799, #pkts digest: 2799
#pkts decaps: 2803, #pkts decrypt: 2803, #pkts verify: 2803
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0
local crypto endpt.: 192.1.49.9, remote crypto endpt.: 192.1.49.4
path mtu 1500, ip mtu 1500
current outbound spi: 0x26FE71FC(654209532)
inbound esp sas:
spi: 0x7071D464(1886508132)
transform: esp-3des esp-md5-hmac ,
in use settings ={Tunnel, }
conn id: 51, flow_id: Motorola SEC 2.0:51, crypto map:
Tunnel0-head-0
sa timing: remaining key lifetime (k/sec): (4399234/1705)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
inbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0x26FE71FC(654209532)
transform: esp-3des esp-md5-hmac ,
in use settings ={Tunnel, }
conn id: 52, flow_id: Motorola SEC 2.0:52, crypto map:
Tunnel0-head-0
sa timing: remaining key lifetime (k/sec): (4399233/1689)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
outbound ah sas:
outbound pcp sas:
R9#
